How to Respond to Google Reviews Without Breaking HIPAA

A parent leaves a glowing review that names their son, his diagnosis and how far he has come since starting therapy. Your first instinct is to write back something warm and personal. That instinct is exactly what gets practices in trouble.

Quick answer: You can reply to Google reviews, and you should. Just never confirm or hint that the reviewer is a client, and never add any detail about their care, even if they shared it first. Keep every reply general and move anything specific to a private phone call. This post is part of our Google Business Profile guide for therapy practices, which covers the rest of your profile.

Why a simple "thank you" can be a HIPAA problem

Under HIPAA, the fact that someone is or was your patient is protected health information on its own. So a reply like "We loved working with Ava on her handwriting!" discloses two things the parent never authorized you to share publicly: that Ava is your patient, and what she is treated for.

It doesn't matter that the parent posted it first. Their review is their choice. Your reply is a disclosure by a covered provider, and that is what regulators look at.

What happened to practices that got this wrong

These are real cases from the federal Office for Civil Rights (OCR), the office that enforces HIPAA:

• Manasa Health Center, a New Jersey practice serving adults and children, paid $30,000 in 2023 after responding to a patient's negative online review with information about the patient.
• New Vision Dental in California settled with OCR in 2022 after replying to Yelp reviews with patients' names and details about their visits and insurance.

Neither practice set out to break the law. They were defending themselves or trying to be friendly. That's the point: the risky reply is usually the human one.

Copy-ready replies for every kind of review

A 5-star review: "Thank you so much for taking the time to share this. Our team loves what we do, and kind words like these mean a lot."

A 5-star review that mentions a child, diagnosis or progress: Use the same reply as above. Don't echo the name, the condition or the progress. A short, warm, general thank-you is enough.

A negative review: "We take every concern seriously and would welcome the chance to talk. Please contact our office directly so we can listen and help."

A review you think is unfair or false: Reply with the same general message, then use Google's own tools to report the review if it breaks Google's rules. Never correct the facts publicly ("Actually, you missed three sessions"), because correcting them confirms they were a client.

A review from someone you never treated: Still don't say "this person was never our client." Keep it general and invite them to call.

Words to keep out of every reply

• The reviewer's name or their child's name
• Any diagnosis, condition or reason for therapy
• Dates, session counts, schedules or therapist assignments
• Insurance, billing or payment details
• Phrases like "your son," "your visit," "during treatment" or "we're glad your daughter is doing better"

Put it in writing for your team

If more than one person replies to reviews, pick one owner and give them a two-line policy: reply within a few days, use the approved templates only, and send anything tricky to the practice owner first. Most problems come from a well-meaning front desk team member replying from their phone at 9pm.

Replying regularly still matters for your profile. Google says on its local ranking help page that review count and score factor into local results, and a profile with thoughtful replies looks cared for to the next parent reading it. If you want more reviews coming in, our guide on how to get more Google reviews the right way walks through a habit that stays inside Google's rules.

Reviews are one piece of being found. If you'd rather hand off your profile, posts and review replies, see how we handle marketing for pediatric therapy practices, or book a free strategy call.

Frequently asked questions

Can I thank a parent who mentioned their child's diagnosis in a review?
Yes, but thank them in general terms only. Don't repeat the diagnosis, the child's name or any detail about care.

Should I reply to negative reviews at all?
Usually yes. A calm, general reply that invites a private conversation shows future families you take concerns seriously, without disclosing anything.

Can I ask a parent to edit their review to remove details?
You can reach out privately and let them know they're welcome to edit it if they like. Never pressure them, and never make the request publicly.

Does this apply to Facebook and Yelp reviews too?
Yes. The same HIPAA rules apply to replies on any platform. The OCR cases above involved Yelp and other review sites.

Is this legal advice?
No. This is general guidance from a clinician who also does marketing. For specific situations, talk to your compliance officer or a healthcare attorney.

Keep reading

• Google Business Profile for Therapy Practices: The Complete Guide
• How to Get More Google Reviews for Your Therapy Practice (the Right Way)
• Why Your Therapy Practice Isn't Showing Up on Google Maps

About Courtney

Courtney Potenti, MS, OTR/L, is a licensed occupational therapist with 10+ years of clinical experience and the founder of Social-OT, a done-for-you marketing company for OT, PT and speech therapy practices. She still treats patients herself, so every strategy she shares is built for clinicians with a full caseload. More about Courtney and Social-OT.