How to reply to a bad Google review without breaking HIPAA
The rule is short: never confirm that the reviewer is a patient, and never discuss any detail of their care. Even acknowledging someone was treated at your practice is a disclosure.
That constraint feels limiting, but it still leaves room for a reply that reads as warm and professional to everyone else looking at your profile. And that is who you are writing for. Not the reviewer: the next person reading.
What you cannot do
- Confirm or deny that the person is a patient.
- Reference their visit, diagnosis, treatment or billing.
- Correct their version of events with clinical facts.
- Mention anything you learned from their chart.
The instinct to defend yourself with specifics is strong, and it is exactly the instinct that produces a settlement. Practices have been penalised for responses that disclosed treatment details while correcting an inaccurate review.
A format that works
Three short parts.
Acknowledge, generally. "We're sorry to hear about this experience."
State a standard, not a fact about them. "Our team aims to keep wait times short and to explain costs clearly before any visit."
Move it offline. "Please call our office manager at (718) 689-3087 so we can look into it."
That is the whole reply. Two or three sentences. No names, no details, no defensiveness.
What good looks like
We're sorry to hear this. We take feedback about scheduling seriously and review it with our team every week. If you'd like to discuss your concerns directly, please call our office manager at (718) 689-3087.
Notice what it does not say. It never confirms a visit happened. It does not argue. It gives a path forward, which is the part prospective patients actually weigh.
A few more things
Reply to good reviews too, with the same restraint. "Thank you for the kind words" is fine. "Thanks for trusting us with your knee surgery" is a disclosure.
Never offer anything for a review. Not a discount, not a gift card, not entry into a drawing. That is a separate problem from HIPAA and it violates the platforms' own terms.
Ask everyone, every time. The real fix for one bad review is twenty honest ones. A short text or email after the visit, linking straight to your review page, does more than any single reply ever will.
Decide who replies. One trained person, within a couple of days, using the same format. Reviews answered by whoever is free are where mistakes happen.