Home / Dental Practices / Review requests after every visit, plus a privacy check on review replies (Open Dental)
Dental Practices problem 4: Few patients leave reviews, and replying to bad ones can leak patient information
Review requests after every visit, plus a privacy check on review replies (Open Dental)
Part 1: every evening, each patient with a completed visit and text consent gets the same short request for a Google review, at most once a year and once per family phone. There is no 'were you happy?' pre-screen and no incentive. Part 2: when a new public review arrives, the office manager gets an email with a privacy-safe reply template and, if a staff draft was attached, a list of phrases in it that would confirm the reviewer is a patient or reveal care, dates or amounts. Nothing is posted automatically and the reviewer is never looked up in Open Dental.
The problem
A careless reply can be a HIPAA disclosure. HHS settled with a dental practice that answered online reviews with patient details.
- HHS Office for Civil Rights, Dec 2022: New Vision Dental paid $23,000 and took on a two-year corrective action plan after replies to Yelp reviews disclosed patients' names, treatment and insurance details. Source: HHS press release: OCR settlement with New Vision Dental over PHI in replies to online reviews (Dec 14, 2022) (US regulator (HHS Office for Civil Rights))
- Google's review policy bars merchants from offering incentives for reviews, discouraging negative reviews or selectively soliciting positive ones, which is why everyone gets the same request. Source: Google Maps user-contributed content policy: prohibited and restricted content (rating manipulation) (Platform policy)
Who it's for
US dental offices on Open Dental that want more Google reviews and a check before anyone answers a negative one.
Tools and monthly cost
| Tool | Official price |
|---|---|
| Twilio US SMS, sent or received | $0.0083 per 160-character segment, plus carrier fees of about $0.0035-$0.005 per segment pricing page |
| Open Dental API (per location, paid by whoever holds the developer key) | Free: Read All only (1 request per 5 s). $15 / month: adds Comm, InsuranceSimple and others (1 request per second). This recipe writes commlogs or recall status, so it needs the $15 tier pricing page |
| Resend (sends the emails) | Free: 3,000 emails / month, 100 / day. Pro: $20 / month for 50,000 pricing page |
| Google Workspace with the HIPAA BAA accepted (call lists and logs live in Google Sheets) | Any paid Workspace edition (not the legacy free edition) can accept Google's BAA in the Admin console; Sheets is covered. You probably already pay for Workspace pricing page |
| n8n, self-hosted | Community Edition is free; you pay for the server. n8n Cloud is not an option here: n8n staff said in January 2026 that n8n does not offer a BAA for Cloud pricing page |
Example month: Illustrative arithmetic. Assume 350 completed visits a month, 200 eligible after consent, family and once-a-year rules: 200 one-segment texts = $1.66 plus carrier fees of $0.70-$1.00. Review emails stay inside Resend's free 3,000 a month (or use Gmail in your BAA-covered Workspace). Open Dental API $15 per location. About $18 a month plus your n8n server.
Setup
- Read the 'HIPAA, TCPA and BAAs' section on the dental hub first. Ask your compliance officer whether a review request counts as a treatment-related message or as marketing for your texting consent.
- Use the Twilio number, A2P campaign and SMS webhook from the missed-call recipe. Set REVIEW_URL to your Google review link and REVIEW_ASK_EVERY_DAYS (default 365).
- Give the workflow an Open Dental API key with the $15 tier (reads completed appointments and patients).
- New reviews: send them to the 'mss-d4-review' webhook (rating, text, reviewer, optional staff draft) from whatever watches your Google Business Profile, with the header x-review-token set to REVIEW_WEBHOOK_TOKEN. Requests without it are ignored.
- Set OFFICE_MANAGER_EMAIL and PRACTICE_FROM_EMAIL, verify your sending domain in Resend or swap the email node for Gmail. The email carries only the public review and the template. The workflow also has a manual 'run now' webhook used by our tests. Delete it, or put it behind n8n's header authentication, before you go live.
Download
Download dental-review-request-and-response-guard.zip
Contains the n8n workflow, the mock data, the test runner with its last results, and the mock server we tested against. All keys in .env.example are fake.
Test result
Every workflow was imported into n8n 2.45.4 and run end to end on our test machine. Open Dental's API, Twilio, Stedi, Google Sheets and the email sender (Resend) were replaced by a local mock server built from their official API docs: it checks the same request shapes and required fields, enforces Open Dental's request throttle (HTTP 429) and records every call. We also compared the mock's field names with Open Dental's public test database (read-only GET requests with the test key Open Dental publishes, no writes). These recipes use no AI model; every decision is a written rule. Patients, plans and phone numbers are invented. Verified with mocks; no real patient data used, and nothing was sent to a real phone, patient, payer or account.
6/6 scenarios passed (run 2026-10-28)
| PASS | V1 | End of day: everyone with a completed visit and text consent gets the same generic request (no pre-screen, no incentive); no consent -> not asked |
| PASS | V2 | Same day re-run: nobody asked twice |
| PASS | V3 | Two kids on one parent's number: one text; returning patient within a year: not asked again |
| PASS | V4 | 1-star review + risky staff draft: privacy-safe template, every risky phrase flagged, emailed to the office manager; Open Dental never queried |
| PASS | V5 | 5-star review, safe draft: thank-you template, draft passes |
| PASS | V6 | Review webhook without the shared-secret header: ignored |
Actual output from the test run
Scenario V1 review request, and the V4 email to the office manager about a 1-star review (invented review). Names and numbers are invented.
V1: Thanks for choosing Maple Grove Dental. If you have a minute, we'd value a review: https://example.com/maple-grove/review Reply STOP to opt out. --- Subject: Respond carefully: new 1-star review (Google) New 1-star review on Google - https://maps.example/review/abc1 "Waited 40 minutes and the bill was wrong." Suggested reply (post it yourself; add nothing about the person or their care): Thank you for your feedback. Privacy rules mean we can't discuss anyone's care online or confirm whether someone is our patient. We'd welcome the chance to talk - please call our office manager at +15555550100. - Maple Grove Dental Your draft needs changes before posting: - refers to their visit, treatment, records or bill - quotes records - confirms they are a patient - mentions a date of a visit - mentions an amount - uses the reviewer's name - offers something of value (looks like paying for a review change) Reminder: never confirm someone is a patient, never mention treatment, dates, fees or insurance, and do not offer anything in exchange for changing or removing a review.
Verified with mocks
- Every patient with a completed visit and TxtMsgOk = Yes gets the same request; no consent, no request. There is no satisfaction pre-screen and no incentive in the wording.
- Same-day re-run asks nobody twice; one text per family phone; a patient asked within the last year is not asked again.
- 1-star review with a risky staff draft: the privacy-safe template ('we can't discuss anyone's care online or confirm whether someone is our patient... please call our office manager'), every risky phrase flagged, emailed to the office manager. Open Dental is never queried for a review.
- 5-star review with a safe draft: thank-you template, nothing flagged.
- Review webhook without the shared-secret header is ignored.
- Verified with mocks; no real patient data used.
Documented from official API docs only
Built to the vendor's documentation but not run against a live account. Check these on yours.
- Open Dental API v1 appointments (AptStatus Complete) and patients (from Open Dental's API docs).
- How reviews reach the webhook: not built. Google's Business Profile API or your reputation tool can send them; we did not test either.
- Resend email API (from Resend's docs).
Limitations
- The phrase check is a list of patterns, not a privacy review. It catches common slips (your visit, your crown, a date, an amount, the reviewer's name) and will miss others. A person must read every reply before posting.
- Nothing is posted to Google or any site; the office manager posts by hand.
- Built for Open Dental only. Dentrix, Eaglesoft, Curve and NexHealth versions are not built, and we make no claim that this works with them.
- Business associate agreements are your job: self-host n8n on infrastructure covered by a BAA (n8n does not offer one for n8n Cloud), accept Google's Workspace BAA before any patient name goes into a Sheet, and ask your compliance officer whether your texting setup needs Twilio's HIPAA offering (Security or Enterprise Edition plus a BAA, sales-quoted). Patient replies can contain health details even when our texts do not.
- Not a compliance guarantee. We designed around HIPAA and the TCPA (generic texts with no treatment, fee or name; consent from Open Dental; staff lists kept in BAA-covered Google Workspace), but whether your setup is compliant depends on your contracts, your server and how your staff use it. Check with your compliance officer or counsel and your state dental board before you turn it on.