Replying to Patient Reviews Without a HIPAA Problem

Write every review reply so that it would be just as true if the reviewer had never been inside your office. HIPAA treats patient information as protected, and a public reply that confirms someone is a patient can be a disclosure, even when the reviewer already said so in their own review. Thank people in general terms, never mention a visit, a doctor or anything about care, and move any real conversation off the review site.

The reviewer posting first doesn't change your side

A patient can say whatever they like about their own care. It's their information, and they can share it. Your practice's obligations stay the same after they do. When a reply says "we're glad you enjoyed your first visit with Dr. Lee" or "we looked at your file and see you missed two appointments", the practice has confirmed a relationship and added details, in public, under its own name.

This isn't a theoretical worry. HHS, through its Office for Civil Rights, has taken enforcement action against healthcare providers over the way they replied to online reviews. The guidance HHS publishes for providers is on its HIPAA for professionals pages, and your compliance adviser can tell you how it applies to your office. State privacy laws can add their own rules on top.

The safe habit is to neither confirm nor deny. That cuts both ways: "you were never a patient here" is a statement about your records too, and it invites an argument you can't win in public.

Reply wording that confirms nothing

These are starting points to adapt with your compliance adviser. Each one could be posted under a review from someone who has never visited.

For a positive review:

Thank you for taking the time to write this. We appreciate it.

Thanks for the kind words. Our team will be glad to read them.

For a negative review:

Thank you for your feedback. We take every comment seriously. Our privacy obligations mean we can't discuss anyone's care in a public reply, so please contact our office and ask for the office manager. We'd like to talk with you directly.

For a complaint about something outside the treatment room, like parking, the phone or the website:

Thank you for letting us know. We've passed this on to our team.

Even that last one stays general on purpose. A reply about a wait time or a billing question starts to imply that the person had an appointment or an account, so keep it to "we've passed this on".

Notice what none of these do. They don't apologize for a specific event, explain what happened, or defend the doctor. That can feel cold when a review is unfair, but anyone reading the page sees a practice that answers politely and keeps quiet about the people who come through its door, which is a fair thing for a prospective patient to learn about you.

What the front desk should never write

Print this list and keep it next to whoever handles the replies:

• The reviewer's name, or any greeting that uses it.
• The name of the doctor, therapist or staff member they mention.
• Any date, appointment, visit, exam, X-ray, plan of care or result.
• Anything about insurance, a claim, a balance, a payment or a refund.
• A correction of their version of events ("you arrived 20 minutes late", "you canceled twice").
• "We have no record of you" or anything else about what your records show.
• An invitation tied to care, such as "see you at your next appointment".
• Anything written within an hour of reading an upsetting review. Wait a day and have a second person read the draft.

Taking it offline, properly

"Please contact our office" only works if the office knows what to do when the person does. Decide in advance:

1. Who takes the call or email. The office manager is a good choice, rather than the person who handled the original complaint.
2. How you confirm you're speaking with the person who wrote the review before discussing anything, under your normal privacy procedures.
3. What can be offered to fix a real service problem, decided as a matter of policy, not as a trade for the review.

On that last point: never offer a discount, a refund or anything else in exchange for changing or removing a review. Offering incentives for reviews is against Google's policies, and a deal to edit one is the same problem from the other direction.

When a review breaks Google's rules

Some reviews aren't from patients at all, or they contain content Google doesn't allow. Fake reviews are prohibited, and Google lists the other kinds of prohibited and restricted content it removes. Flag those through Google instead of arguing in the reply. If you reply while the flag is pending, use the same neutral wording as any other negative review.

Set it up once, then follow it

Replies go better as a written process than as whatever the person at the desk feels that day. A one-page policy covers it:

• Who replies. One or two trained people, with the doctor or office manager approving the templates.
• Approved templates. Four or five replies like the ones above, reviewed by a healthcare attorney or compliance adviser and saved where the front desk can find them.
• Other sites. The same rules apply on Yelp, Facebook, Healthgrades and anywhere else patients leave reviews.
• Timing. Reply within a few days, so the page doesn't look abandoned, but never in the heat of the moment.
• A yearly check. Read your last twelve months of replies against the "never write" list. Edit or remove any that slipped through.
• New staff. Anyone who gets access to the profile reads the policy before their first reply, and the access is removed the day they leave.

Replies are one small, very public part of local SEO for chiropractors, and they stay on your profile until someone changes them. Write your templates this week, have them reviewed, and go back through the replies already posted on your profile.