The short version. A patient can say anything they like about their visit in a review. You can't confirm they were a patient, name a treatment, mention a date, a diagnosis, a payment, an insurer, or anything that ties a real person to care they received — even if they wrote it first, even if it's wrong, even if it's a lie. Two dental practices have paid the federal government for replies that did exactly that. The safe reply thanks the words, states your standard without stating their visit, and moves the specifics to the phone. It's short, it's a little generic, and in this one case generic is correct.
This page is for any practice that holds a patient record: med spas, dental and orthodontic practices, dermatology, plastic surgery, physio, IV therapy, weight-loss clinics. If you're a salon or a restaurant, none of this applies to you — go to how to respond to a negative Google review.
What happened to the two practices that got it wrong
These are the cases HHS's Office for Civil Rights (OCR) has published, and they are small practices, not hospitals.
Elite Dental Associates, Dallas — $10,000 (2019). A patient complained to OCR that the practice had answered her Yelp review by disclosing her last name and details of her condition. OCR's investigation found the practice had disclosed protected health information for multiple patients in Yelp replies — a patient's name, treatment-plan details, insurance and cost information — and had no policy covering what could be said on social media. Settlement $10,000 plus a corrective action plan; OCR said the amount was low because of the practice's size and cooperation.
New Vision Dental, California — $23,000 (2022). OCR received a complaint that the practice had disclosed patients' names, treatment and insurance information in responses to online reviews. Settlement $23,000, a corrective action plan, and two years of monitoring.
Both were Yelp; the same rule applies to Google, Facebook and everywhere else. And note what triggered them: not a hack, not a lost laptop — a reply box.
Why "but they posted it first" doesn't work
The Privacy Rule restricts what a covered entity discloses. The patient isn't one; you are. Their review is their speech. Your reply — "Your crown failed because you missed two follow-ups" — is a disclosure by the practice that this named person was a patient, had a crown, and had a treatment history. That the patient mentioned the crown first doesn't authorise you to confirm it, and it certainly doesn't authorise the follow-up detail.
The mistake is almost always made in self-defence: the review is unfair, the owner knows the real story, and the reply tells it. Every fact in that reply is PHI.
Are med spas covered by HIPAA?
It depends, and you should assume yes for the purpose of replies. A med spa that sends claims or other health information electronically to an insurer is a covered entity outright. One that's cash-only may not be — but it is very often operating under a medical director or a nurse's licence, in a state whose medical-privacy and consumer-protection laws don't care whether HIPAA technically applies, and in front of a licensing board that does. Nothing on a review page is worth testing where the line is. Reply as if you're covered.
The safe reply: three moves
- Thank the words, not the visit. "Thank you for the kind words" — not "thank you for trusting us with your Botox." "Thank you for taking the time to write this" — not "we're sorry your appointment on the 14th…"
- State your standard, not their case. "Our rule is that nobody starts a treatment before every question is answered" describes the practice. "We explained the risks to you before your treatment" describes the patient.
- Move the specifics to the phone. "Please call the office and ask for the practice manager, who can go through what happened with you directly." The conversation you want to have is allowed — privately, with identity confirmed, off the review page.
That's the whole reply. Three or four sentences. (Oh Local drafts them in this shape and flags any phrase that would confirm a patient — see how Oh Local can help.) It won't win the argument, because winning the argument is the thing that costs $23,000.
Examples
A positive review, med spa. "Loved my results and the nurse explained everything before we started."
Thank you for the kind words — we're glad the visit felt clear and unhurried. Our team's rule is that nobody starts anything before every question is answered. We appreciate you taking the time.
A negative review, med spa. "Paid a fortune for filler and my lips look exactly the same. Nurse was nice but I feel ripped off."
Thank you for telling us — we take this seriously and would like to make it right. Please call the office and ask for the manager, who can review what happened with you directly.
A negative review, dental. "Billed me $400 more than the estimate and nobody warned me. Avoid."
We're sorry to read this, and we'd like to sort it out. Billing questions are exactly the kind of thing our office manager can go through line by line — please call and ask for her, and she'll take it from there.
A review you're sure is not a patient. "Terrible place, rude, don't go." — one line, no details, no name you recognise.
We're sorry your experience felt that way. We don't see enough here to know what happened — if you'd like to tell us, please call the office and ask for the practice manager.
Not "we have no record of you" — that is itself a statement about who is and isn't a patient, and to the next reader it sounds like an accusation.
What never goes in a reply
- Any confirmation the person was a patient — including "your appointment," "your visit," "your treatment," "your results."
- The treatment, procedure or product. Even in thanks. Even if it's in their review.
- Dates, cost, insurance, payment, balance. The two OCR cases both involved billing details.
- Anything about their health, condition, history or outcome.
- Anyone else's information — the other patient who was there that day, the employee's medical leave.
- A private detail to prove your point. This is the one that gets written at 11 p.m. Delete it.
Two practical things that make it easy
Write the four replies once. Positive, negative, billing, unrecognised — four templates in the three-move shape, personalised only with the reviewer's first name and one neutral phrase. Anyone at the desk can post them; nobody has to improvise under pressure.
Put it in the privacy policy you already have. Both OCR cases cited missing privacy policies and procedures as a separate failure — Elite's specifically for what could be released on social media. One paragraph in your HIPAA policies and procedures — "responses to online reviews contain no PHI; specifics are handled by phone by the practice manager" — closes that finding before it opens.
How Oh Local helps with this
Oh Local drafts replies for practices in the three-move shape, in your voice, and checks every draft against a list of phrases that confirm a patient or name a treatment before you see it. It's a guardrail, not a compliance review: you still approve every reply, and it posts under your name. The free audit shows which of your reviews are unanswered today.
How it works
- Run the free audit. We read your public Google reviews and replies and send you the numbers: reply rate, the reviews still waiting for an answer, and the oldest of them — with the table on this page to put them beside.
- Claim your page. Pick your listing, and your QR card and short link are ready to print — from your own phone, no onboarding call.
- Get the weekly email. Every new review with its reply drafted, private feedback that came in, and the short list of what to fix on your listing and site.
- Approve, and that’s it. You press approve on the replies you like. The rest — the card, the page, the measuring — runs on its own.
What you get
Your review page
A printed QR card and a short link that open every review option — Google, Tripadvisor, Facebook — capture the customer’s email, and give an unhappy customer a private word first. About four minutes to a printable QR.
Reviews handled
Every new review on your platforms, with the reply drafted in your voice, in one weekly email. Negative ones first. You approve, edit or skip; nothing posts without you.
Local standing
Where you rank around your shop, what competitors are doing, what changed on your listing — with the exact fix for each. Recommendations can lead to better rankings and more visibility; no tool can promise a position, including ours.
| Industry | Audited | Median reply rate | Never replied |
|---|---|---|---|
| Dallas restaurants | 358 | 16% | 22% |
| Dallas dental practices | 85 | 34% | 20% |
| Dallas retail shops | 83 | 25% | 25% |
| Dallas tattoo studios | 82 | 10% | 30% |
| Dallas barbershops | 81 | 15% | 21% |
| Dallas plastic surgeons | 75 | 30% | 23% |
| Dallas med spas | 74 | 81% | 8% |
FAQ
Can a dentist or med spa respond to Google reviews under HIPAA?
Yes. Replying is allowed; disclosing protected health information in the reply is not. A safe reply thanks the reviewer, states the practice's standard without describing the reviewer's care, and invites them to call the office — and never confirms the person was a patient or names a treatment, date, cost or insurer.
If the patient wrote about their treatment in the review, can I mention it in my reply?
No. The patient's review is their own speech; your reply is a disclosure by the practice. Confirming or adding to what they wrote — the treatment, the dates, why the outcome was what it was — is the exact conduct behind the $10,000 Elite Dental Associates settlement (2019) and the $23,000 New Vision Dental settlement (2022).
Does HIPAA apply to a med spa?
Often, and you should reply as if it does. A med spa that sends claims electronically to an insurer is a covered entity; a cash-only one may not be, but it usually operates under a medical licence, a state privacy law and a licensing board that all reach the same conclusion about a reply naming a patient's treatment.
What should a HIPAA-compliant review response say?
Three things: thanks for the words (not the visit), the practice's standard (not the patient's case), and an invitation to call the office and ask for the manager. Three or four sentences, no confirmation that the reviewer was a patient, no treatment, date, cost, insurance or health detail.
Can I say "we have no record of you" to a fake review?
Better not. It's a statement about who is and isn't a patient, and to the next reader it sounds like an accusation. Say you don't see enough in the review to know what happened, and invite them to call. If the review looks fake, report it through Google's flag as well — quietly, not in the reply.
