How dentists write HIPAA-compliant Google review responses

Yes, a dentist can reply to Google reviews, and HIPAA-compliant responses are short. The reply may not confirm that the reviewer is a patient, and it may not mention treatment, visits, billing or insurance, even when the reviewer brought those up first. Thank them, say you can’t discuss anyone’s care in public, and give a phone number. Three dental offices have paid federal penalties for replies that did more.

Why a one-line reply can count as a disclosure

HIPAA protects more than the chart. The federal definition covers information a provider holds that relates to “the provision of health care to an individual” or to “payment for the provision of health care,” and that identifies the person.

On a review, the reviewer’s name sits right above your answer. Anything you add that ties that person to care or payment completes the definition:

• “We’re sorry your cleaning ran late” confirms they were treated.
• “Your insurance denied the claim, not us” is payment information.
• “You missed two appointments” is visit history.
• “We referred you to a specialist” is treatment.

The cases below support a simple test: say nothing that would only be true if the reviewer were a patient.

The wider playbook, listing and board rules included, is in the local SEO guide for dentists. This post stays on the reply box.

Three dental offices that paid over a reply

Here are three actions HHS’s Office for Civil Rights has published against dental practices over review replies, each started by a complaint to OCR.

OCR’s notice in the North Carolina case quotes the reply. It begins “It’s so fascinating to see [Complainant’s full name] make unsubstantiated accusations when he only came to my practice on two occasions since October 2013,” walks through his treatment plans, his insurance approvals and a referral “for a root canal treatment to be performed by my endodontist colleague,” and ends “Get a life.” Review and reply both went up on September 28, 2015.

The penalty tier came from what happened next. In August 2016 OCR told the practice the reply was an impermissible disclosure and that it “should remove its response promptly.” According to the notice, the reply “remains public as of the date of this Notice”, and the practice did not answer an administrative subpoena. OCR put the violation in the tier it calls “willful neglect not corrected.” The penalty covered one patient.

Every detail in the three replies was something only the dental office knew: the treatment plan, the claim, the referral, the visit dates.

“They already said they were a patient”

The record does not support this as a defense.

New Vision Dental’s resolution agreement describes replies that supplied “full names where only Yelp monikers were used by the patients” and “detailed information about patient visits and insurance that may not have been previously mentioned in their initial reviews.” When the reviewer posts as “J.R.” and the reply names them, the reply did the identifying.

The problem is not only new details. A findings report by SturdyWeb, published in August 2026 on The HIPAA Journal by an author affiliated with the firm, looked at 80,300 recent Google replies from 4,019 medical and dental practices in California and the Pacific Northwest. It estimated that 26.3% of replies disclosed or confirmed patient information, counting a reply if it “confirmed a patient or visit relationship, disclosed a clinical detail, or referenced billing or insurance information tied to the reviewer.” Among the replies its reviewers confirmed by hand, 58% did it by confirming patient or visit status. Its summary: “The more common failure was smaller: the practice confirmed something the reviewer had already said.”

The report says it “should not be read as a national HIPAA violation rate,” and gives no separate rate for dental offices.

Practitioners disagree on how strict to be: in a Local Search Forum thread on this question, one marketer called “only a mushy and generic response” compliant, while another thought refusing to acknowledge a patient went too far. Our view: write the reply so it would read the same if the reviewer had never set foot in the office.

Wording that stays generic

Google’s own reply tips mostly help: “Never share a reviewer’s private information,” and for a complex situation, ask the reviewer “to contact you via phone or email to resolve the issue privately.” One tip does not suit a dental office: “Personalize your reply: Address the reviewer by name and acknowledge their specific feedback.” That is how a reply ends up confirming a crown or a claim.

These are starting points, not legal advice. Have whoever handles privacy for the practice approve them first.

Words to keep out of any reply, whatever the stars: “your visit”, “your appointment”, “your treatment”, “your plan”, “your insurance”, “see you at your next cleaning”, a date, a procedure, a dollar amount, and the reviewer’s name. Also leave out “we have no record of you.” If you only say that when it’s true, the practice is answering the question in both directions.

What to do about a fake or unfair review

Google removes reviews that break its Maps content policy: fake engagement, impersonation, harassment, off-topic content, conflicts of interest (including “current or former employment”) and more.

Google’s report page sets the limits plainly: “Do not report a review just because you disagree with it or dislike it,” and “Google doesn’t get involved in conflict between businesses and customers.” The steps:

1. Open the profile, go to Read reviews, select the report icon next to the review, and choose the reason that fits.
2. Track it in the Reviews Management Tool. Google says evaluation “typically takes several days.”
3. If Google finds no violation, you get a one-time appeal from the same tool, covering up to 10 reviews.

Wait for the decision before replying. An angry reply to a review you think is fake is the UPI pattern.

Check the replies already posted

The New Vision Dental corrective action plan required the practice, within 30 days, to remove all of its social media posts with patient information from January 1, 2014 onward, send breach notices to every patient named in them, post a substitute notice on its Yelp page and report the breaches to HHS.

Google lets you edit or delete any reply from the profile. An afternoon with the reply history on Google, Yelp and Facebook is a reasonable start:

• Sort replies into clean, needs editing, and should come down.
• Note anything that named a patient, a date, a procedure, a claim or a balance.
• Take the list to your privacy officer or counsel before deleting anything, because whether a past reply calls for breach notices is their call, not a marketing one.

Who should hold the reply box?

Two of the three practices were cited for more than the reply itself. Elite and New Vision were both found to lack policies on “releasing PHI on social media/public platforms.” In the North Carolina case, OCR’s first data request asked for the practice’s policies “with respect to responding to patients’ reviews on online platforms” and got none.

Write three decisions on one page:

• Who may reply. One or two named people, trained on the rule above. Not whoever is at the desk.
• What they may say. The approved replies, and nothing outside them without a second person reading it first.
• What happens to a complaint. The reply moves it to a phone call, and the call goes into the same process as any other patient complaint.

An AI drafting tool follows the same rule: it must not repeat any detail from the review, and a person reads the draft before it posts.

What HIPAA doesn’t settle for you

HIPAA is federal law. It sets a floor, and a state privacy law that is “more stringent” survives alongside it, so your state may add rules to what you may say in public about a patient. No state law was checked for this post, so read your own state’s rules and your dental board’s guidance as well.

None of this is legal advice for a specific reply. When a review mentions a threat, a malpractice claim or a board complaint, hold the reply and call whoever advises the practice on privacy.

What you control today is small: a reply table, a named person, and an afternoon with the old replies. LocalBiz can handle the profile and the website around that work.