How to Ask Patients for Reviews Without Breaking the Rules

Ask every patient for a review in the same way, offer nothing in return, and never reveal patient details when you reply. Those three habits keep a practice inside the FTC's reviews rule, Google's review policy and HIPAA. We read the FTC, Google and HHS pages cited here on October 12, 2026.

Asking patients for reviews at a glance

• The FTC's reviews rule went into effect on October 21, 2024.
• The FTC says: "Don't ask for reviews only from customers you think will leave positive ones."
• Google prohibits reviews posted "due to an incentive offered by a business".
• Staff reviews need a clear disclosure of the job, under FTC guidance.
• HHS has settled with practices that disclosed patient details online, in review replies or social media posts, for $10,000 to $30,000.

Is it legal to ask patients for reviews?

Yes. Google's review tips page says: "To leave reviews, you can ask customers to visit a Google link or scan a QR code." The FTC's rule Q&A also recognizes "generalized solicitations to purchasers". The risk is in how a practice asks, who it asks and what it offers.

Can a practice ask only happy patients?

No. This is called review gating. The FTC's guide for marketers says: "Don't ask for reviews only from customers you think will leave positive ones." The FTC's rule Q&A says the rule has no specific ban on this. It adds: "But this practice could violate the FTC Act."

Google's content policy goes further. It bans attempts to "Discourage or prohibit negative reviews, or selectively solicit positive reviews from customers".

Can a practice offer a discount or gift card for a review?

Not for Google reviews. Google's tips page says offering "free or discounted goods or services" in exchange for reviews is "strictly prohibited". Its policy also bans "Reviews or ratings that have been paid for, directly or in kind."

The FTC rule is narrower. Its Q&A says it "does not prohibit giving incentives for reviews, as long as there isn't an express or implied requirement" that the review be positive or negative. The FTC guide adds that an incentivized review should disclose the incentive. Since Google bans incentives outright, the safe path is to offer nothing.

Can staff write reviews of the practice?

Only with a clear disclosure, and never on Google. The FTC guide says: "Don't ask your staff to write reviews of your business, at least not without ensuring that they disclose in their review that you employ them and asked them to write it." Google lists "current or former employment" as a conflict of interest that breaks its policy.

Can a practice ask for reviews while the patient is in the office?

Mention it, but do not push. Google says "merchants should not require or pressure users to leave ratings or write reviews while on the premises". A card with a QR code at checkout lets the patient decide later.

Does HIPAA allow emailing or texting a review request?

Contacting patients is allowed with safeguards. HHS FAQ 570 says providers may communicate electronically, "provided they apply reasonable safeguards when doing so." Keep the message free of diagnosis, treatment or visit details. A plain "Thanks for visiting us. Would you share your experience?" is enough.

HHS defines marketing as a communication that encourages the recipient "to purchase or use the product or service." A review request does not ask the patient to buy anything. Many practices treat it as outside that definition. Confirm this with your compliance advisor. For texts, also confirm you have the consent your texting platform and phone carrier rules require. Our post on texting patients under HIPAA covers the tools.

What happens if a practice replies to a review with patient details?

HHS treats it as a privacy violation. These settlements are on HHS's own pages.

In the Manasa case, HHS said the reply "included specific information regarding the individual's diagnosis and treatment of their mental health condition". In the New Vision case, OCR's director said: "Providers cannot disclose protected health information of their patients when responding to negative online reviews." Our guide to replying to patient reviews under HIPAA gives safe reply wording.

What is a safe review request process?

1. 1

   Pick one channel

   Use a Google review link or QR code from the Business Profile.

2. 2

   Ask everyone

   Send the same message to every patient after a visit, with no rating step first.

3. 3

   Keep it plain

   Leave out diagnosis, treatment and visit details.

4. 4

   Offer nothing

   No discounts, gifts or raffle entries for reviews.

5. 5

   Reply with care

   Thank the reviewer. Never confirm the person is a patient. Move details offline.

How Webpatch helps

Webpatch sets up review request flows for healthcare practices that send every patient the same link and keep patient details out of the message. We check review software for gating features. We train staff on reply wording and build it into your reputation management process. We are not a law firm, so we work with your compliance advisor on the legal questions. Contact Webpatch to review your process.

This article is for education only. It is not legal advice and has no legal standing. Have a qualified professional review your situation before you act.