Can You Reply to Patient Reviews Under HIPAA?What You Can and Cannot Say

Yes, you can reply to patient reviews under HIPAA, but your reply cannot confirm the reviewer is a patient or reveal anything about their care. This applies even when the patient posted the details first. This guide covers the rule, four practices that paid penalties, and replies you can copy.

Review replies and HIPAA at a glance

• Can you reply? Yes. The American Medical Association (AMA) says no federal law prohibits it.
• The limit: no patient information, including the fact that the person is a patient.
• The patient went public first: that does not give the practice permission to share anything.
• Published penalties: four practices paid between $10,000 and $50,000 from 2019 to 2023.
• Who got penalized: three dental practices and one psychiatric practice.
• Why replies matter: 59.48% of patients are more likely to choose a provider who responds to reviews.

Does HIPAA allow you to reply to patient reviews?

Yes. HIPAA limits what a reply contains. It does not stop you from replying. The AMA states that no federal law or regulation prohibits physicians from responding to online reviews.

The limit is strict. The AMA advises: "Don't disclose any information about the patient. Don't even acknowledge the person is a patient in your office."

The reason is simple. A review reply is public. Confirming that a named person visits your practice reveals that they receive care from you. That is protected health information (PHI).

What can you not say in a review reply?

You cannot say anything that identifies the reviewer as a patient or describes their care. Five common mistakes cause most problems.

• Confirming the visit. "We enjoyed seeing you last week" confirms a patient relationship.
• Correcting the record. "You missed two appointments" discloses appointment history.
• Naming a treatment or diagnosis. This is the detail in every penalty below.
• Mentioning billing or insurance. Payment for care is also PHI.
• Thanking a happy patient for their visit. A friendly reply to a 5-star review can break the same rule.

What has replying badly cost practices?

Four practices paid between $10,000 and $50,000. The HHS Office for Civil Rights (OCR) published all four cases. Each practice was small.

The money was only part of the cost. New Vision Dental had to remove every post containing PHI back to January 1, 2014. It also had to send breach notices to affected patients and accept two years of monitoring.

The $50,000 case was a civil money penalty, not a settlement. The practice did not respond to OCR's data request or its subpoena.

OCR's position is direct. After the Manasa case, its director said of disclosing patient information in review replies: "Simply put, this is not allowed."

How do you reply safely? The Webpatch Stranger Test

The Webpatch Stranger Test is one question you ask before posting any reply. Could a stranger learn from this reply that the reviewer is your patient, or anything about their care? If yes, rewrite it.

Use the test inside this four-step method.

1. 1

   Wait before you reply

   Do not reply while angry. Name one trained person who posts every reply for the practice.

2. 2

   Write about policy, not the person

   Describe how your practice works in general. The AMA suggests explaining standard protocols without mentioning the patient.

3. 3

   Run the Webpatch Stranger Test

   Read the draft as a stranger would. Remove anything that confirms a visit, a treatment, a date, or a bill.

4. 4

   Move it offline

   Give a phone number or email for the office. Resolve the details in private and keep a record.

What does a safe reply look like?

A safe reply thanks the person, states a general policy, and offers a private channel. It works the same whether or not the reviewer is a real patient.

Should you still reply to reviews at all?

Yes. Reviews drive patient choice, and replies are part of that. A 2025 RepuGen survey of 1,212 US patients found that 73.28% consider online reviews when choosing a provider. In the same survey, 59.48% said they are more likely to choose a provider who responds to both positive and negative reviews.

Google is the main venue. In that survey, 77.78% of patients used Google for provider reviews. Google says more reviews and positive ratings can help a business's local ranking.

So silence has a cost too. The goal is a reply that passes the Webpatch Stranger Test every time.

When can you mention a patient's details?

Only with the patient's valid written HIPAA authorization. A verbal okay does not count, and neither does a public review. This also covers testimonials and patient stories on your website.

Ask a healthcare attorney to review your authorization form before you rely on it.

How Webpatch helps

Webpatch is a technology company that works with healthcare practices. We build websites and manage their security, HIPAA compliance, SEO, and AEO. Reviews are part of local visibility, so we treat reply rules as part of that work.

Tracking is a related risk. Read our guide on whether your website's tracking is HIPAA-compliant.

We are not a law firm. We handle the technical side and work alongside your privacy officer or attorney.

This article is general information, not legal advice. Rules can change. Confirm current requirements with HHS or a healthcare attorney.