How to respond to negative reviews without violating HIPAA
Short answer: To respond to a negative review without violating HIPAA, keep the reply short and general. Thank the person, say that privacy rules keep you from discussing anyone's care online, and invite them to contact your office. Never confirm that the reviewer is a client, and never mention appointments, diagnoses, treatment or dates.
Federal regulators have penalized practices for getting review replies wrong, including a psychiatric practice that disclosed a client's diagnosis in a reply.
Why are review replies risky?
Review replies are risky because even confirming that someone was seen at your practice can reveal protected health information, and a detailed defense of your treatment almost always does. A reply is public and can be hard to take back, so one careless sentence can expose a client. The published enforcement examples below show what that has cost practices.
Enforcement examples from published HHS Office for Civil Rights (OCR) announcements:
- A dental practice was hit with a $50,000 civil money penalty for disclosing patient information in a response to an online review.
- A psychiatric practice paid $30,000 after replies to negative Google reviews disclosed patients' information, including a mental health diagnosis.
Source note: Those figures come from HHS OCR resolution announcements. Confirm them against the current HHS OCR list of resolution agreements and civil money penalties (opens in a new tab) before relying on them. The notes above are general information only and are not a substitute for legal review of any reply.
What does a safe reply look like?
A safe reply is short, calm and general. It thanks the person, explains that privacy rules keep you from discussing anyone's care online and moves the conversation to a private call, all without confirming that the reviewer is a client. In practice, a safe reply:
- does not confirm or deny that the person is a client
- does not mention appointments, diagnoses, treatment or dates
- describes your general policies instead of the specific situation
- invites the person to contact you privately
Example:
"Thank you for sharing your feedback. Our privacy obligations prevent us from discussing any individual's care online. We take every concern seriously and would welcome a call to our office manager at the number on our website."
What does an unsafe reply look like?
An unsafe reply confirms that the reviewer was seen at your practice or adds details about their care, such as a session date, a treatment plan or a diagnosis. Even a friendly, well-meant reply can do this when it tries to explain what happened. A reply like this one is the kind to avoid:
"We are sorry you felt rushed during your session on Tuesday. As we discussed, your treatment plan requires..."
This confirms a relationship, a date and treatment details.
The table below sets common risky phrases next to safer wording:
| Risky wording | Why it is risky | Safer wording |
|---|---|---|
| "Thanks for coming in last week." | Confirms the reviewer was seen at your practice and when. | "Thank you for taking the time to share your feedback." |
| "We are sorry your therapy has not helped yet." | Confirms treatment and comments on the outcome. | "We are sorry to hear you are disappointed." |
| "As your clinician explained in session..." | Confirms a client relationship and refers to private care. | "Our privacy obligations prevent us from discussing anyone's care online." |
| "Please call us to talk about your treatment plan." | Ties the offer to a specific person's care. | "We would welcome a call to our office manager at the number on our website." |
If the review itself names a diagnosis or treatment, do not repeat or confirm it. See scenario 7 in our reply examples for wording that stays general.
How do you write a reply to a negative review, step by step?
Write the reply in five short steps, and give yourself time before you start. The same steps work for any negative review, on any review site:
- Wait a day before replying to anything upsetting.
- Thank the person for their feedback, without saying they were seen at your practice.
- Add one sentence saying that privacy rules keep you from discussing anyone's care online.
- Invite the person to call or email your office, so the conversation moves off the review site.
- Ask a second reader to check the draft for dates, treatment details or anything that confirms a client relationship, then post it or leave the review unanswered.
What reply template can you copy?
Use the same three parts every time: a thank-you, a privacy line and a private follow-up. Keep each to one short sentence and change only how people reach your office:
"Thank you for sharing your feedback. Our privacy obligations prevent us from discussing anyone's care online. Please call our office manager at the number on our website so we can listen."
The rule behind the template comes from the HIPAA Privacy Rule, which HHS explains in its Summary of the HIPAA Privacy Rule (opens in a new tab). For twenty versions written for specific situations, use the reply examples for 20 common scenarios.
Should you reply at all?
You can choose either way. A short, general reply can show future clients that you take feedback seriously, and leaving a review unanswered is always an option, especially when emotions run high. What matters most is that any reply you post is calm, general and read by a second person first.
- Replying with a short, general message shows future clients that you take feedback seriously. For ready-to-edit wording, see these therapist negative review response examples.
- Not replying is always allowed and sometimes wiser, especially if the review is emotional.
- Never reply in anger. Wait a day and have someone else read your draft.
What about fake or abusive reviews?
Most review sites let you report reviews that break their policies, such as reviews from people who were never clients, spam or threats. Report them through the platform rather than arguing in public. When you flag a review, name the platform policy it breaks, and keep any public reply general so it neither confirms nor denies that the person was a client. For wording, see scenario 6 (a review that is clearly false) and scenario 20 (spam or a competitor attack).
Should therapists ask for reviews?
Several professional ethics codes discourage soliciting testimonials from current clients because of the potential for undue influence. Check your code before asking. Encouraging reviews from colleagues or referral partners may be a better fit. See our comparison of ACA, APA, NASW and AAMFT rules.
What if a client posts in crisis?
If a review suggests someone may be at risk, do not engage publicly. Follow your crisis procedures, which may include reaching out privately through the contact information you have on file. For a short public reply that points to emergency help without confirming anything, see scenario 17 in our reply examples.
Frequently asked questions
Can I thank someone for a positive review?
Yes, with a short, general thank-you such as "Thank you for your kind words." that does not confirm they are a client. See four positive review replies.
Can I ask the reviewer to take it down?
You can contact them privately through normal channels, but do not pressure them or offer incentives.
Does this apply to Psychology Today and Yelp too?
Yes. The privacy rules apply wherever you post a reply about care, so use the same short, general wording on Google, Yelp, Psychology Today or any other review site.
What makes a review reply risky under HIPAA?
Any reply that confirms the reviewer was seen at your practice, or that mentions their appointments, diagnosis, treatment or dates, can disclose protected health information. Keep the reply general and move the conversation to a private call.
Should I reply to a negative review right away?
Wait a day before replying to anything upsetting. Then keep the reply short and general, and have someone else read it before it posts.
Has anyone been fined for replying to a review?
Yes. Published HHS OCR announcements describe civil money penalties tied to review replies that disclosed patient information. See the enforcement examples above, and check the current OCR press releases for the latest cases.
Can a therapist respond to a Google review at all?
Yes. You can reply to any review as long as the reply stays general and does not confirm that the reviewer is a client. Thank the person, say that privacy rules keep you from discussing anyone's care online, and invite them to contact your office. Leaving the review unanswered is always an option too.
Is replying to a review a HIPAA problem by itself?
The risk comes from what the reply says. The published enforcement examples involve replies that disclosed patient information. A reply that confirms the reviewer was seen at your practice, or mentions their appointments, diagnosis, treatment or dates, can disclose protected health information, so keep every reply short and general.
What should a reply never say?
It should never confirm or deny that the person is a client, and never mention appointments, diagnoses, treatment, dates or outcomes. If the review names a diagnosis or treatment, do not repeat or confirm it. The risky and safer wording table shows common phrases to swap out.
What should a reply to a negative review include?
Three short parts. Start with a thank-you that does not say the person was seen at your practice. Add one sentence saying privacy rules keep you from discussing anyone's care online, then invite them to call or email your office. Ask a second reader to check it before it posts, as in the five steps above.
Can I handle a complaint privately instead of replying in public?
Yes. Leaving a review unanswered is always an option, and you can contact the person privately through your office's normal channels, without pressure or incentives. If you do reply in public, keep it short and general and invite the person to call or email your office, as in the safe reply example above.
What if a review names a diagnosis or treatment?
Do not repeat or confirm it. Keep the reply general, thank the person and invite a private call, even when the review names a diagnosis or treatment first. The risky and safer wording table shows how to stay general.
Should I report a fake review or reply to it?
Report it through the platform first, as in the fake review section above, and keep any reply general, as in scenario 6.
What if a reviewer seems to be at risk?
Follow your crisis procedures and keep it out of a public back-and-forth, as in the crisis section above. For a short public reply that points to emergency help, see scenario 17.
Do I need a lawyer before I reply to a review?
Not for a routine short reply. Keep the reply general using the steps above. The steps here are general information, not legal advice. If a review raises a legal threat, a serious allegation or a question about your specific obligations, talk to a healthcare attorney before you post.
How does Discreet help?
Discreet drafts review replies and flags wording that could confirm a client relationship. A person on your team reads and approves every reply before it posts.
General information only, not legal advice. Figures above should be confirmed against current HHS OCR announcements.