Keep a public reply brief, general and focused on taking feedback seriously. Do not confirm that the reviewer is or was a patient, or discuss care, appointments, diagnosis, treatment, payment or records. Invite the person to contact the practice privately. A reviewer’s own account of an experience does not, by itself, give a provider a basis to add protected health information (PHI) in response.
Why a public reply can create a privacy problem
A response to a review is still a disclosure by the organization. HHS’s Office for Civil Rights (OCR) has publicized enforcement matters involving PHI disclosed in replies to negative online reviews. A provider can therefore create a privacy risk while trying to defend its reputation or correct a reviewer’s account.
HIPAA applies to covered entities and business associates within the rule’s scope. HHS describes covered providers as health care providers that conduct certain health care transactions electronically. PHI is individually identifiable health information held or transmitted by a covered entity or business associate, in any form or medium. As HHS puts it: “The HIPAA Privacy Rule establishes national standards to protect individuals’ medical records and other individually identifiable health information (collectively defined as ‘protected health information’) and applies to health plans, health care clearinghouses, and those health care providers that conduct certain health care transactions electronically.”
Whether HIPAA applies depends on the organization and the information involved. This is general information, not a determination about a particular practice, review or dispute, and it does not cover every state privacy law or platform rule.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
#1 Best Overall
What to leave out of the reply
Do not confirm or elaborate on a reviewer’s relationship with the practice, even if the reviewer identifies themselves as a patient or describes specific care. Avoid details that could connect a person to the organization or reveal information about their interaction.
- Whether the person is or was a patient, or visited a particular location.
- Appointment dates, scheduling exchanges or the reason for a visit.
- Diagnosis, treatment, medications, clinical notes or other care details.
- Billing, payment, insurance or account information.
- Records, messages or the practice’s version of what happened in an individual case.
Do not use a public reply to rebut allegations with facts from a chart or internal account. Even a well-intended correction may reveal more than the public response needs to say.
Rank #2
- Ideal for Gifting
- Ideal for a bookworm
- Compact for travelling
A practical response pattern
- Acknowledge the feedback generally. Use a neutral phrase such as “We take feedback seriously.” Avoid saying “we treated you,” “your appointment” or similar wording that confirms a relationship.
- Move the conversation to a private channel. Invite the reviewer to contact the office directly. Do not ask them to post identifying or medical information publicly.
- Keep the message short. HHS guidance says covered entities generally must take reasonable steps to limit PHI use and disclosure to what is necessary for the purpose. A public reputation reply can ordinarily acknowledge feedback without case-specific details.
- Route sensitive or disputed cases internally. If the review alleges misconduct, includes a threat or otherwise calls for a substantive response, preserve it and send the draft through the organization’s privacy and legal process rather than litigating the facts online.
Illustrative wording: “We take feedback seriously and want to learn more. Please contact our office directly so we can discuss your concerns privately.” This is an example, not an HHS-approved statement or a guarantee that wording is sufficient in every circumstance.
What enforcement examples show—and do not show
Manasa Health Center
In a 2023 announcement, HHS OCR said Manasa Health Center, a New Jersey psychiatric services provider, paid $30,000 and agreed to a corrective action plan to resolve potential violations after a complaint alleged it disclosed PHI in a response to a negative review. The announcement describes a resolution agreement, not a court judgment.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchElite Dental Associates
HHS’s 2019 HIPAA compliance report describes Elite Dental Associates agreeing to pay $10,000 and take corrective action after an OCR investigation found impermissible PHI disclosures in responses on its Yelp review page, among other issues.
These amounts relate to specific matters; they are not typical-penalty estimates, and they do not show how often providers disclose PHI in review responses. The official sources cited here provide no population-level rate.
Rank #4
Build review replies into the privacy process
HHS says providers and health plans need privacy procedures, workforce training and an assigned person responsible for privacy compliance. A practice can use those controls for public reviews by establishing who may respond, what general language is appropriate and which cases require privacy or legal review. Staff should know not to improvise a case-specific explanation in public.
HHS guidance about communications with family, friends and others involved in a patient’s care addresses specified care-related circumstances; it does not establish a public-review exception. A reviewer’s disclosure is not a reason to treat a public response as a private care conversation.
Best Value
- It can be a gift option
- Comes with secure packaging
- Helpful in various ways
Before publishing: a quick check
- Does the reply confirm or imply that the person received care from the organization?
- Does it mention a visit, appointment, diagnosis, treatment, payment or record?
- Can the organization acknowledge the feedback and invite private contact without those details?
- Does the review need to be preserved or escalated under internal privacy or legal procedures?
If a draft includes individualized facts, remove them and use the organization’s privacy process before posting. Questions about state law, platform-specific rules or a particular factual dispute require advice tailored to that situation.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
