Dentists And Med Offices: Reviews Without HIPAA Trouble

Bring up review requests in a medical or dental office and the conversation usually dies in about four seconds. Somebody at the front says "we cannot do that, HIPAA," everyone nods, and that is the end of it.

It is a reasonable instinct and it is aimed at the wrong half of the problem. Asking for a review is almost never where a practice gets in trouble. Replying to one is.

Worth saying up front: I am not your compliance person and this is not legal advice. Run anything you change past whoever handles that for you. But the shape of the rule is simple enough that it is worth understanding, because most offices are avoiding the safe part and doing the risky part without thinking about it.

The rule goes one direction

A patient can say whatever they want about you in public. They can name their procedure, post their x-ray, describe their whole visit. They are not a covered entity. Nothing about HIPAA restricts what a patient chooses to share about their own care.

You are the one who is restricted. And the trap is that the restriction does not care whether the patient went public first.

If somebody writes a one star review complaining about a bill, and you reply "we saw you on the 14th and the crown was already scheduled," you just confirmed in public that this person is your patient and disclosed what they came in for. That is a disclosure of protected health information, and the fact that they posted first is not the defense it feels like.

That is the part that catches practices. It never feels like a records release. It feels like defending yourself. It is the same thing.

Why the reply is the risky part

Everything in you wants to correct the record. Somebody wrote something unfair, in public, with your name on it, and the version of events they gave is not what happened.

And you know exactly what happened, because you have the chart open in front of you.

That is the moment. The chart is right there, the facts are on your side, and one sentence would clear it up. Practices post that sentence and it is the wrong move whether or not anybody ever complains about it.

The safe reply says nothing about the person and nothing about their care. It sounds like this:

"Thank you for the feedback. We take concerns like this seriously and would like to talk about it directly. Please call the office and ask for our practice manager."

No confirmation they were a patient. No mention of a visit, a date, a procedure, or a bill. It moves the conversation to a channel where you can actually say things.

It feels weak the first time you post it. It is not. Everyone reading it knows what a professional reply looks like, and a defensive one with clinical detail in it reads worse to a stranger than the original complaint did.

Collecting is the safe half

Here is the part offices talk themselves out of for no reason.

Asking a patient to leave a review is not a disclosure. You are not publishing anything. You are handing somebody a link and letting them decide what, if anything, to say. Whatever they write is their own information to share.

The care worth taking is in how you ask, not whether you can:

Do not send review requests through a channel that reveals why they were there. "How was your root canal today" in a text is worse than the review would have been.

Do not ask a patient to include their procedure. Never suggest what to write about their care. If they volunteer it, that is theirs. If you prompted it, it is on you.

Do not review-gate. Asking happy patients only and quietly skipping the unhappy ones violates Google's policy for everybody, and in a medical setting it looks worse when it comes out.

Do not pay for reviews or trade one for a discount on treatment. That is its own problem in healthcare on top of the platform policy.

Do this

1. 1Ask at checkout, in person, before they walk out. The relief of being finished is the whole window.
2. 2Keep the ask generic. "If you have thirty seconds, a Google review really helps other people find us." That is the entire script.
3. 3Never name the procedure in the ask, in a text, in an email subject line, or anywhere it shows on a lock screen.
4. 4Make it one tap at the front desk. A card or a tap is a review; a link you send tonight is not.
5. 5Write one approved reply template with your compliance person, and post exactly that on every review, good or bad.
6. 6Never reference a visit, date, treatment, chart, or balance in a public reply. Not once, not to correct something false.
7. 7Move every real dispute to a phone call. That is the only place you can actually discuss the case.
8. 8Ask on every visit, including hygiene and cleanings. Routine visits are where the volume is.

The practices that get this right

They are not the ones with clever replies. They are the ones with a boring template posted under every single review, and a front desk that asks everybody at checkout without thinking about it.

That combination gets you a steady page of recent reviews and nothing anybody has to explain later, which is exactly what you want in a regulated business.

The only hard part is the asking, every visit, when the lobby is full. That is a friction problem, so we make a tap card for the front desk at shop.optechsol.llc.

Write the reply template this week, before the next one comes in that makes you want to explain yourself.