Run Practice Reputation as a System, Not a Reaction

Why ad hoc review responses cost practices money

Regulators treat review responses as disclosures. In 2023, the HHS Office for Civil Rights settled with Manasa Health Center, a New Jersey psychiatric practice, for 30,000 dollars after it disclosed the diagnoses and treatment information of four patients while replying to negative Google reviews.

It was not an isolated case. OCR penalized Dr. U. Phillip Igbinadolor, D.M.D. and Associates 50,000 dollars, settled with New Vision Dental for 23,000 dollars, and with Elite Dental Associates for 10,000 dollars, all over review responses. The OCR director's statement was blunt: disclosing patient information in response to negative reviews is simply not allowed.

The pattern in every case is the same. A frustrated owner or office manager replied in the moment, confirmed the reviewer was a patient, and added clinical detail to rebut the complaint. A system exists to make that moment impossible.

Part one: monitor before you manage

You cannot respond well to a review you find three weeks late. Assign one owner, set a weekly cadence, and cover Google Business Profile first since it drives most local discovery, then the health-specific platforms your patients actually use.

Track three numbers per location: average rating, review volume per month, and time from review posted to response. Volume and recency matter as much as the rating itself, because a practice with 12 reviews from 2023 reads as inactive next to a competitor adding several per month.

• Google Business Profile, checked weekly at minimum
• Healthgrades, Vitals, WebMD, and Zocdoc if you take bookings there
• Yelp and Facebook, which patients still cross-reference
• Internal channels: post-visit surveys and front-desk complaints, which predict public reviews

Part two: respond without violating HIPAA

The core rule is that you may never confirm or imply that a reviewer is a patient, even when they name themselves, and even when the review is positive. Any reply that references their visit, diagnosis, billing, or treatment connects an identifiable person to your care and is a disclosure.

The compliant pattern is a short, generic reply that speaks only to your policies: thank the person for the feedback, state your practice's general standards, and invite them to call your office manager directly. Then move the real conversation offline, where you can verify identity and actually resolve the complaint.

Write two or three approved response templates, have your compliance contact sign off once, and require that any deviation goes through the practice owner. Staff should never improvise a reply to a negative review.

Part three: generate reviews the FTC allows

The fix for a thin or aging review profile is asking every patient, not buying volume. The FTC's Consumer Review Rule, finalized in August 2024, prohibits fake reviews, undisclosed insider reviews from staff or their immediate relatives, and incentives conditioned on a specific review sentiment, whether positive or negative. Civil penalties run up to 53,088 dollars per violation, and the FTC sent its first warning letters under the rule in December 2025.

The rule also prohibits suppressing or selectively displaying reviews based on negative sentiment. That means no gating, where you survey patients first and only invite the happy ones to post publicly. Ask everyone, the same way, at the same point in the visit cycle.

In practice: a text or email within 24 hours of the visit with a direct link to your Google profile, sent to all patients. Consistent asking beats any shortcut, and it is the only approach that survives an FTC or platform audit.

Part four: removal requests and legal escalation

Not every bad review deserves a reply. Google removes only reviews that violate its content policies, such as spam or profanity, and its own guidance says not to report a review just because you disagree with it. Flag violations through your Business Profile, expect evaluation to take several days, and use the one-time appeal if the first report is rejected.

Legal escalation is the last step, not the second. It fits three situations: a review that is provably false in its factual claims rather than merely negative, a reviewer who was never a patient or is a competitor, or an explicit demand for money or free care in exchange for removal.

Be careful with cease and desist letters. The same FTC rule that bans fake reviews also prohibits using intimidation or unfounded legal threats to remove negative reviews. If you escalate, do it through a healthcare attorney with a documented factual basis, not a template letter from the front office.

Put it on a calendar and measure it

The whole system fits in about an hour a week once templates and the review ask are automated: Monday monitoring pass, templated responses within 48 hours, review requests firing automatically after each visit, and a quarterly check on rating, volume, and response time per location.

The payoff is not the rating itself. It is that prospective patients comparing three local practices see a current, well-handled profile and book with you. That is the standard Rank and Rejuvenate holds its own reputation work to: the metric that matters is booked appointments, not a vanity score.