HIPAA-Compliant Review Responses for Dental Offices

A 1-star review says the bill was wrong and the wait was 40 minutes. The office manager knows exactly who wrote it, knows the patient skipped the pre-authorization, and wants to set the record straight. That's the reply that gets practices in trouble.

Replying to a review is still talking about a patient in public. Under HIPAA, a dental practice generally can't confirm that someone is a patient, let alone mention their visit, treatment, bill or insurance, without the patient's authorization, even if the patient brought it up first. Below are the do's and don'ts, two sample replies you can adapt, and the rules on asking for reviews in the first place. It's based on building and mock-testing our review request and response guard recipe. This isn't legal advice; your privacy officer or attorney has the final word.

Two settlements that show the line

New Vision Dental, California ($23,000). HHS's Office for Civil Rights received a complaint in November 2017 that the practice disclosed patient information on its Yelp page when replying to reviews, "sometimes providing full names where only Yelp monikers were used by the patients and including detailed information about patient visits and insurance." The practice paid $23,000 and agreed to a two-year corrective action plan that required removing social media posts with patient information and sending breach notices to the patients involved (HHS resolution agreement). HHS's summary of the case is blunt: "This practice is illegal under HIPAA" (HHS summary).
Elite Dental Associates, Dallas ($10,000). Elite agreed to pay $10,000 and adopt a corrective action plan to settle potential HIPAA violations over social media disclosures of patients' information (HHS, page dated October 2, 2019).

Neither case was about a hacked server. Both were about replying to reviews.

What you can't say

Don't put any of this in a public reply, even if the reviewer mentioned it first:

Anything that confirms they're a patient. "We've reviewed your chart", "When you were here last week", "As our patient, you..."
Their name, if they posted under a nickname, or their full name if they posted a first name.
Visit dates or times.
Treatment, diagnosis or what was done. "Your crown", "your root canal", "your cleaning".
Money: the bill, the balance, the estimate, a refund.
Insurance: the plan, what it covered, a denied claim.
Anything from their records, even to correct a false claim.
An offer in exchange for changing or removing the review. That's a separate problem, covered below.

What you can say

Thank them for the feedback.
Say that privacy rules keep you from discussing anyone's care online.
Invite them to call or email a named person, such as the office manager.
Describe your general policies without tying them to the reviewer: "Our office confirms insurance estimates before treatment" is general. "We told you your insurance wouldn't cover it" isn't.
Say nothing at all. Not every review needs a reply.

Sample replies

These are the templates our recipe suggests, with the practice name changed.

For a negative review:

Thank you for your feedback. Privacy rules mean we can't discuss anyone's care online or confirm whether someone is our patient. We'd welcome the chance to talk - please call our office manager at [phone]. - [Practice name]

For a positive review:

Thank you for taking the time to share this. We appreciate it! - [Practice name]

Even a happy reply can slip: "So glad your implant turned out great, Maria!" confirms a patient, a treatment and a name. Keep thank-yous generic.

Don't fix one problem by creating another

Two other rules apply when a practice tries to manage its reviews:

The FTC's rule on consumer reviews. It bans giving compensation or other incentives conditioned on a review expressing a particular sentiment (16 CFR 465.4), and using groundless legal threats, intimidation or knowingly false public accusations to keep a review from being posted or to get one removed (16 CFR 465.7) (eCFR, 16 CFR Part 465). "We'll waive your balance if you update your review" is the kind of reply to avoid.
Google's review policy. Google's contribution policy doesn't allow offering incentives for reviews, discouraging negative reviews or asking only happy customers for reviews (Google Maps user-contributed content policy).

That last point affects how you ask for reviews, not just how you reply. Sending every patient the same request, rather than screening for happy ones first, keeps you on the right side of it.

How our recipe handles both halves

Asking: at the end of the day, every patient with a completed visit and text consent on file gets the same generic text: no pre-screen question and no incentive. Nobody is asked more than once a year, and a family sharing one phone number gets one text, not one per child.

Replying: when a new review comes in, the office manager gets an email with a privacy-safe suggested reply and, if staff wrote a draft, a list of every risky phrase in it. The recipe never looks the reviewer up in Open Dental, and it never posts anything. A person reads it and posts.

What our test showed

All 6 scenarios passed on October 31, 2026, against mocks of Open Dental, Twilio, the email API and the review webhook, with fictional patients:

A 1-star Google review ("Waited 40 minutes and the bill was wrong.") with a risky staff draft: the office manager got the negative-review template above, and the draft was flagged for referring to the visit, treatment, records or bill; quoting records; confirming the reviewer is a patient; mentioning a visit date; mentioning an amount; using the reviewer's name; and offering something of value. Open Dental was never queried and nothing went to the patient.
A 5-star Yelp review with a safe draft: the thank-you template, and the draft passed.
The review request went out once, with the same wording for everyone with text consent. A same-day re-run asked nobody twice, two children on one parent's number got one text, and a patient asked within the last year wasn't asked again.
A review webhook without the shared secret was ignored.

How we tested, and what we didn't

Everything ran against mocks with invented patients and reviews. The phrase check is a list of written rules, not an AI model, so it catches the patterns it was written for and can miss a creative way of saying the same thing. Read every reply once more before posting. We haven't connected it to a live Google Business Profile, Yelp or Open Dental account. See how we test for more on our method.

Texting patients at all: is texting patients HIPAA compliant?
The calls behind a lot of bad reviews: dental missed-call text-back and its recipe.
Billing surprises, another source of 1-star reviews: a 72-hour insurance verification checklist and the insurance verification prep recipe.
Unscheduled treatment plans: Open Dental unscheduled treatment follow-up and the recipe.
Overdue cleanings: recall reactivation.

All five dental recipes are on the dental hub. If your practice has a review policy that works, tell us about it.

Sources

HHS Office for Civil Rights, New Vision Dental resolution agreement and corrective action plan (signed November 2022): complaint received November 29, 2017; $23,000; two-year CAP including removal of posts and breach notices. Checked October 31, 2026. hhs.gov
HHS Office for Civil Rights, New Vision Dental settlement summary (content last reviewed December 14, 2022). Checked October 31, 2026. hhs.gov
HHS Office for Civil Rights, Elite Dental Associates settlement summary (content last reviewed October 2, 2019): $10,000 and a corrective action plan over social media disclosures. Checked October 31, 2026. hhs.gov
16 CFR Part 465, Rule on the Use of Consumer Reviews and Testimonials, sections 465.4 and 465.7. Checked October 31, 2026. ecfr.gov
Google Maps user-contributed content policy: fake engagement, incentives and selective solicitation. Checked October 31, 2026. support.google.com
Test results: our review request and response guard recipe, 6 of 6 scenarios passed against mocks on October 31, 2026.

HIPAA-compliant review responses: what a dental office can and can't say