Can a clinic reply to patient reviews without breaking HIPAA?

A clinic can reply to any review, good or bad, as long as the reply doesn't confirm that the reviewer is a patient or say anything about their care. The patient chose to post. The clinic didn't get permission to answer with details. Since 2019, the U.S. Department of Health and Human Services (HHS) has penalized at least four practices for review replies that revealed patient information. One was a Dallas dental office.

Why is confirming someone is a patient a HIPAA problem?

HIPAA's Privacy Rule protects "individually identifiable health information": information that identifies a person and relates to their health, the provision of health care to them, or payment for that care (45 CFR 160.103). The fact that a named person was treated at your clinic fits that definition. You don't have to mention a diagnosis.

A clinic may not use or disclose protected health information except in the ways the rule allows (45 CFR 164.502(a)). Answering an online review isn't one of them. So "We're sorry your crown took two visits" and "Great to see you at your follow-up" are both disclosures.

Doesn't a patient give up privacy by posting a review?

No. A patient can say whatever they like about their own care. The clinic still can't. Outside the permitted purposes, HIPAA requires a written authorization, and a valid one must spell out what will be disclosed, to whom and why, and must be signed and dated by the patient (45 CFR 164.508). A Google or Yelp review is none of those things.

It doesn't matter whether the reviewer already named their treatment. In the New Vision Dental case, HHS described replies that sometimes gave patients' full names where the reviewers had posted only under Yelp nicknames. The replies also added visit and insurance details the reviews hadn't mentioned.

What did the practices HHS penalized actually do?

Announced	Practice	What the replies did	Outcome
Oct 2, 2019	Elite Dental Associates, Dallas, TX	Answered Yelp reviews with a patient's last name, treatment plan, insurance and cost details, and disclosed other patients' information the same way. Had no policy for social media.	$10,000 settlement, 2-year corrective action plan (HHS)
Mar 28, 2022	A North Carolina dental practice	Disclosed a patient's information on a webpage in response to a negative online review, then didn't respond to HHS.	$50,000 civil money penalty, final June 1, 2021 (HHS (PDF), press release)
Dec 14, 2022	New Vision Dental, CA	Replied to Yelp reviews with patient names, treatment and insurance information.	$23,000 settlement, 2-year corrective action plan (HHS, press release)
Jun 5, 2023	Manasa Health Center, NJ	Answered four patients' negative Google reviews with details including a mental health diagnosis and treatment.	$30,000 settlement, 2-year corrective action plan (HHS, press release)

Three details recur. Three of the four cases (Elite, New Vision, Manasa) began with a single complaint, and in each one HHS went on to find other replies doing the same thing. Those same three practices were also cited for having no written policy on how protected information is handled, which HIPAA requires (45 CFR 164.530(i)). Manasa's corrective plan also made it send breach notices to every patient whose information it had posted online.

In the New Vision case, HHS's civil rights director put it plainly: "Providers cannot disclose protected health information of their patients when responding to negative online reviews. This is a clear NO." (HHS press release)

Does this apply to five-star reviews too?

Yes. The rule is about what the reply reveals, not about tone. A warm "Thanks for trusting us with your knee rehab" confirms a patient and their treatment just as surely as an angry reply. A physical therapy practice near Los Angeles paid $25,000 in 2016 for posting patient testimonials, with full names and photos, on its website without valid authorizations (HHS). Praise is still patient information.

What does Texas law add?

Texas's medical records privacy law (Health and Safety Code chapter 181, tightened by HB 300 in 2012) sits on top of HIPAA:

• It covers more people. A "covered entity" includes anyone who comes into possession of protected health information, plus their employees, agents and contractors (§ 181.001).
• Electronic disclosures need a separate authorization each time, except to another covered entity for treatment, payment or operations, or where other law allows it (§ 181.154).
• Staff must be trained on state and federal privacy law within 90 days of being hired (§ 181.101). That includes whoever answers your reviews.
• The Texas Attorney General can sue. Penalties run up to $5,000 per negligent violation, $25,000 per knowing or intentional one, and up to $1.5 million a year for a pattern or practice. Against a licensed clinic, the Attorney General can seek these civil penalties only after its licensing board refers the case, and the clinic also faces discipline from that board (§ 181.201, § 181.202).

What can a reply safely say?

Thank them, state your general standards, and offer a phone call. Leave out names, visit dates, providers, treatment, insurance, billing, and any "we checked your chart." The same goes for "you were never a patient here."

For a positive review:

Thank you for taking the time to write this. We'll share it with the team.

For a negative review:

Thank you for the feedback. We take every concern seriously, and to protect everyone's privacy we don't discuss anyone's care online. Please call our office manager at [office phone] so we can talk directly.

Use the same few replies for everyone. Then a reply never depends on who wrote the review.

What if a review is false or abusive?

Don't argue the facts in public. Correcting the record means discussing the care, which is the disclosure. If a review breaks Google's content policies (spam, profanity, a conflict of interest and so on), report it from your Business Profile. Google says it doesn't remove reviews just because a business disagrees with them (Google). Your reply is public and appears under the review as coming from your business (Google).

What this means for your clinic

• Put it in writing. Keep a short written policy on who may reply to reviews and what a reply may contain. HIPAA requires written privacy policies, and three of the four penalized practices didn't have them.
• Train whoever replies. In Texas, that's within 90 days of hire, and again within a year when the law changes materially.
• Keep approved templates. One person replies, using the approved wording, at every location.
• Check your old replies. Delete any that name a patient or mention care, then ask counsel whether you owe anyone a notice.
• Take every complaint offline. The reply's only job is to offer a phone number.

How Automynds handles it

Every Automynds review program comes with a reply playbook. It has ready-to-use replies for positive and negative reviews, written so that no reply confirms a reviewer is a patient. The playbook is part of the front-desk script, and you get it at onboarding.

Your team posts every reply. Automynds never replies to reviews for your clinic.

We walk whoever answers your reviews through the playbook and keep a record of the training.

Our review texts go out under a signed Business Associate Agreement (see HIPAA and the BAA), and every patient gets the same link (Google review policy). Questions: hello@automynds.com.