Rules of the road for patient reviews
Seven questions clinic owners ask before texting patients for reviews. Each page gives the short answer first, then the detail, with the primary sources linked and the date we last reviewed it.
- HIPAA
Do I need a BAA to text patients for reviews?
Yes. A vendor that receives your patients' names and phone numbers to send review texts is a HIPAA business associate, so you need a signed Business Associate Agreement before any patient data moves. In Texas, HB 300 adds more: the vendor is covered by state law too, and every employee needs signed privacy training within 90 days of hire.
- TCPA
Do review texts need their own patient consent?
Usually, yes. A review text sent from an automated texting system needs the patient's prior consent under the TCPA, and consent given for appointment reminders may not stretch to a review ask. The safe path is a separate yes at intake: keep the record, and honor STOP within ten business days.
- FTC
Can we ask only happy patients for reviews?
No. The FTC says inviting only patients you expect to be happy can be deceptive under the FTC Act, even though its 2024 Consumer Review Rule doesn't name the practice. The rule itself bans fake reviews, incentives tied to a positive or negative review, undisclosed insider reviews and review suppression, with civil penalties up to $53,088 per violation.
- GOOGLE
Can my clinic ask patients for Google reviews?
Yes. Google lets a business ask for reviews, including by text, as long as every patient gets the same honest ask. Its policy bans incentives, asking only happy patients, discouraging negative reviews, pressuring patients in the office, requesting specific content and setting staff review quotas. Breaking it can get reviews removed and a profile restricted.
- TEXAS
Does the Texas privacy law apply to my clinic?
Usually not. The Texas Data Privacy and Security Act (TDPSA), in effect since July 1, 2024, does not apply to HIPAA covered entities or their business associates, and it exempts protected health information outright. Most 2–4 location dental, PT and chiropractic practices are also small businesses under SBA size standards, a second exemption.
- REPLIES
Can a clinic reply to patient reviews without breaking HIPAA?
Yes, as long as the reply never confirms the reviewer is a patient. Under HIPAA, the fact that someone received care is protected health information, and a public review is not permission to share it. Thank the reviewer in general terms, leave out names, visits and treatment, and invite them to call the office. Five-star reviews included.
- TEXAS AI
Does Texas require my clinic to tell patients when it uses AI?
Yes, if AI is used in a patient's care. Since January 1, 2026, Texas's TRAIGA (Business and Commerce Code §552.051(f)) requires a health care provider that uses an AI system in relation to a service or treatment to tell the patient, in plain language, by the first day of that service. Emergencies allow disclosure as soon as reasonably possible.