Responding to Negative Reviews as a Dentist: HIPAA Rules and Safe Templates

Negative reviews sting. But a reply is not really written just for the person who posted it. Write it for everyone who reads it afterward and wonders how you treat people when something goes wrong. The goal is not to win an argument. It is to show that you listen without exposing private information.

This guide keeps the response process simple: pause, acknowledge the concern, protect privacy and offer a private next step. It also covers the HIPAA risks behind public replies, with verified enforcement examples and templates that never confirm patient status.

TL;DR

• Do not reply in anger. Use one to two business days as an internal response target, not a legal deadline.
• Thank the reviewer, show concern and offer a direct way to contact your office.
• Never confirm patient status or repeat treatment, billing or insurance details.
• A reviewer's public disclosure is not permission for your practice to disclose information.
• Report policy violations rather than arguing, and never trade compensation for a changed review.
• Use repeated complaints to improve the practice, with a person approving sensitive replies.

The purpose of a public reply

A useful reply is calm, brief and practical. You do not need to settle the complaint in the comment thread. You need to explain how someone can raise a concern privately, without suggesting that you recognize the reviewer or know their history.

Google recommends professional, polite replies that stay short and simple. For a dental practice, put privacy ahead of personalization. A reply can sound human without referring to a visit or promising a better appointment next time.

Source: Google Business Profile Help, tips to get more reviews and write replies.

The HIPAA rule you cannot skip

For a practice covered by HIPAA, protected health information includes identifiable information about health care and payment for care. A public reply can disclose PHI even without naming a procedure. Confirming that an identifiable reviewer is a patient can reveal a care relationship. Treat that confirmation as information to keep out of public replies.

Source: HHS, Summary of the HIPAA Privacy Rule.

The reviewer may describe treatment, name a dentist or post a bill. That does not give the practice a valid HIPAA authorization to publish its side. HHS distinguishes disclosures permitted by the Privacy Rule from those requiring authorization. Do not treat an online review as a substitute for that authorization.

Source: HHS, Privacy Rule guidance on authorized uses and disclosures.

Keep appointment dates, diagnoses, procedures, balances, insurance details and statements about records out of the reply. Avoid “We explained this during your visit,” “You declined treatment” and “We cannot find you in our system.” Your public response is not the place to establish whether someone received care.

Real OCR enforcement involving review replies

On October 2, 2019, HHS published its enforcement announcement about Elite Dental Associates, Dallas. The dental practice agreed to pay $10,000 and adopt a corrective action plan to settle potential HIPAA Privacy Rule violations involving social media disclosures of patients' PHI.

Source: HHS OCR, Elite Dental Associates settlement, October 2, 2019.

On December 14, 2022, HHS published its announcement about New Vision Dental in California. The practice paid $23,000 and agreed to a corrective action plan. HHS identified impermissible disclosures of PHI in responses to online reviews, along with other potential HIPAA violations.

Source: HHS OCR, New Vision Dental settlement, December 14, 2022.

HHS's Manasa Health Center settlement page, last reviewed June 5, 2023, reports a $30,000 payment and a corrective action plan over potential Privacy Rule violations involving responses to negative online reviews and missing policies and procedures. Manasa provided psychiatric services in New Jersey; it was not a dental practice.

Source: HHS OCR, Manasa Health Center settlement, 2023.

The lesson is broader than avoiding procedure names. Give staff a written public-response policy, approved language and a clear escalation path. This is practical guidance, not a replacement for advice from your privacy officer or attorney.

A response framework your team can use

1. Pause and route the concern

Save the review link and assign an owner. If it raises a clinical concern, threat or privacy issue, route it to the appropriate lead before posting. Keep any internal investigation separate from the public reply.

2. Thank and acknowledge

Start with “Thank you for sharing this feedback.” Acknowledge the concern without agreeing with the account or confirming a relationship. “We take concerns about communication seriously” is more useful than a defensive explanation.

3. Offer a private next step

Provide your office manager's published business number. Do not invite clinical details in the comment thread. Once someone contacts you privately, follow your normal identity-verification and privacy procedures before discussing records.

4. Review before publishing

Read the draft as if the review were anonymous. Does it imply that you recognize the person? Does it reveal anything from practice records? Remove those details. For the wider workflow, see our dental review management guide.

Privacy-first templates for common complaints

Replace the contact placeholders before posting. These examples deliberately avoid confirming a visit, account or patient relationship. Adapt the tone, not the privacy boundary.

Long wait

Thank you for sharing this feedback. We take concerns about waiting and communication seriously. Please contact our office manager at [office number] to discuss the concern privately.

Billing or insurance surprise

Thank you for raising this concern. Clear communication about costs matters to our team. We do not discuss individual matters publicly. Please call our office manager at [office number].

Front-desk manner

Thank you for the feedback. Respectful communication is a standard we set for our team. Our office manager can be reached at [office number] for a private conversation.

Pain or treatment concern

We take concerns about care seriously. To protect privacy, we do not discuss individual matters here. Please call [office number] to speak with our team privately.

A review you do not recognize

Thank you for raising a concern. We do not discuss individual matters in public comments. Please contact our office manager at [office number] so the concern can be reviewed privately.

Do not add “We have no record of you.” A missing name match is not a reason to discuss your records publicly. If you suspect a policy violation, use the reporting process separately.

What not to do

• Do not argue about what happened or attach screenshots of records.
• Do not repeat private details simply because the reviewer posted them first.
• Do not ask staff, family or friends with conflicts of interest to bury criticism with praise.
• Do not offer a discount, refund or gift in exchange for posting, revising or removing a review.

Google prohibits incentivized reviews, selective solicitation of positive reviews and reviews based on conflicts of interest. Keep complaint resolution separate from review requests.

Source: Google Maps, prohibited and restricted content policy.

Report violations, not disagreement

Google says only reviews that violate its policies are eligible for removal. Disliking a review or disputing its account is not enough. Identify the actual policy issue, report it and keep a record. Google's Reviews Management Tool lets you check report status.

Source: Google Business Profile Help, report inappropriate reviews.

Do not include clinical records in a routine platform report. Ask your privacy lead how to handle supporting material if a report would require disclosing identifiable health information.

Make the process safer, not just faster

Review recurring themes monthly: waiting, billing explanations, phone access and communication. Assign an owner and a practical change. Use our guide to requesting reviews ethically to keep the collection process separate from complaint handling.

If a vendor handles PHI on your behalf as a business associate, HHS generally requires a business associate agreement. A BAA alone is not the whole privacy program. Review access, safeguards and the information shared; do not paste chart details into an unapproved AI tool.

Source: HHS, business associate guidance.

How Aron helps

Aron's review automation includes email or SMS alerts, AI reply drafts and controls for star ranges and approval before posting. Keep human approval on for negative reviews. For vendor evaluation, see our dental reputation management software guide.

FAQ

How quickly should I respond?

Use one to two business days as your team's target, not a legal requirement. Pause longer when privacy, clinical or legal review is needed. A safe reply matters more than an immediate one.

Can I confirm someone is a patient if they said so first?

Do not confirm it in a public reply. Their decision to share information is not your authorization to disclose it. Keep the response general and offer private contact.

What if the review is false?

Do not publish records to prove your side. Report a specific policy violation if there is one. Otherwise, use a brief general reply or seek advice before responding.

Can I offer a refund?

Handle any legitimate billing resolution privately through your normal process. Never condition a refund or other benefit on changing or removing a review. Google's policy prohibits that exchange.

Are positive replies a privacy risk too?

Yes, if they disclose identifiable health information or confirm a care relationship. Use “Thank you for the kind feedback” rather than mentioning treatment or a future visit. Apply the same review policy to every star rating.

What if a reply already exposed PHI?

Stop further disclosure and involve your privacy officer promptly. Preserve an appropriate internal record and arrange correction or removal. Have the privacy lead assess any applicable breach-response duties rather than assuming deletion resolves the issue.

Want to review the wider process? Start with the free AI Marketing Scorecard.