Can I Reply to a Patient Review Without Violating HIPAA?
Use the free tool — Review Responder
What HIPAA means for your review reply
HIPAA is a privacy law that applies to healthcare practices. It matters here because a patient review often invites you to say more than you should. This is not legal advice. If you run a medical, dental, therapy, or similar practice, confirm the rules with a compliance professional or attorney before you reply to any review.
The one rule you must never break
Never confirm that someone was a patient. That single fact is protected. It does not matter if the reviewer already said it themselves in their post — your reply should not repeat it, agree with it, or add any detail that ties a specific person to your practice.
What you should never put in a public reply
- Never state facts about the customer's visit that you can't verify.
- Never share health, financial, or personal details in a public reply.
- Never confirm someone was a patient, even to correct their story.
What you can safely say instead
You can still respond without admitting fault or confirming anything private. The general approach for a difficult review works here too:
- Acknowledge the review without arguing.
- Don't admit fault.
- Take the conversation offline (invite them to call or email you directly).
- Say what you do for every patient or customer, in general terms, without pointing to this specific person.
Is this legal advice, and what can a tool like this do?
No — nothing here is legal or medical advice. Review Responder is a writing aid, not a compliance checker. It drafts a reply in your voice, in English or Spanish, and the first reply is free. But you, the practice owner, are responsible for the reply's accuracy and for following HIPAA and each platform's rules. The tool is not affiliated with Google, Yelp, or Meta, so check their posting rules too. Read every draft carefully before you post it, and when in doubt, ask a compliance professional or attorney — especially for anything involving a patient.
What to do next
Paste the actual review, along with a line about your business and how you sound, into Review Responder. You'll get a draft reply back in your own voice. Before posting, read it against the rule above: no confirmation that the person was a patient, and no health, financial, or personal details. If anything feels uncertain, confirm with a compliance professional first.
Review Responder is a writing aid. Replies are drafts for the business owner to edit and approve; the owner is responsible for their accuracy and for complying with platform rules and privacy law (for example, HIPAA for healthcare practices — never confirm someone was a patient). It is not affiliated with Google, Yelp or Meta.