Dentists Fined for Replying to Online Reviews: Every HHS Case, With Sources
The short answer is yes: dental and other health care practices have paid HIPAA penalties and settlements after replies to online reviews disclosed patient information. This page lists the HHS cases, with sources, including what was disclosed and on which site when HHS named it. This page is general information, not legal advice.
Paste your draft into the free PlainReply checker. For whether replying itself is banned, see Is responding to a Google review a HIPAA violation?
The short answer: yes, review replies have led to HIPAA penalties
HHS's Office for Civil Rights has imposed a civil money penalty and entered settlements after finding that providers disclosed protected health information in responses to online reviews. The dental cases below range from a $10,000 settlement to a $50,000 civil money penalty. A patient's own post does not give the practice permission to disclose information about them in a public reply.
This page is a sourced list of those cases: who paid, how much, and what HHS said was disclosed. The separate guide Is responding to a Google review a HIPAA violation? answers whether a reply is banned. For safer wording examples, see negative dental review response examples.
The dental cases from HHS
2019: Elite Dental Associates, Dallas, $10,000
Elite Dental Associates, a Dallas dental practice, agreed to pay $10,000 and adopt a corrective action plan that included two years of monitoring by OCR. An HHS press release dated October 2, 2019, says a patient complained on June 5, 2016, that Elite had responded to a social media review by disclosing the patient's last name and details of the patient's health condition. OCR's investigation found that Elite had impermissibly disclosed the protected health information of multiple patients in response to patient reviews on the Elite Yelp review page. (HHS press release; the live page returned 403, so this was checked against the archive.org copy; also the HHS case page, content last reviewed October 2, 2019)
2022: Dr. U. Phillip Igbinadolor, D.M.D. & Associates, P.A., North Carolina, $50,000 civil money penalty
Dr. U. Phillip Igbinadolor, D.M.D. & Associates, P.A., a dental practice with offices in Charlotte and Monroe, North Carolina, was assessed a $50,000 civil money penalty after it "impermissibly disclosed a patient's PHI on a webpage in response to a negative online review." HHS reported that the practice did not respond to OCR's data request, did not respond or object to an administrative subpoena, and waived its rights to a hearing by not contesting the findings. (HHS, content last reviewed March 28, 2022; also ADA News)
OCR's Notice of Proposed Determination, dated October 22, 2020, says the patient posted a negative Google review on the practice's Google page using a pseudonym, and that the practice replied on that Google page. According to the notice, the reply named the patient and described his visits and a root canal referral. (HHS, Notice of Proposed Determination)
2022: New Vision Dental, California, $23,000
B. Brandon Au, DDS, Inc., doing business as New Vision Dental, a general dental practice in South Pasadena and Glendora, California, paid $23,000 and agreed to a two-year corrective action plan. The resolution agreement says OCR received a complaint on November 29, 2017, alleging that the practice disclosed protected health information on its Yelp business page when responding to reviews, sometimes providing full names where patients had used only Yelp monikers, and including detailed information about patient visits and insurance. OCR reviewed the Yelp page and confirmed that the practice had been posting responses that compromised PHI. (HHS, Resolution Agreement and Corrective Action Plan; also the HHS case page, content last reviewed December 14, 2022)
Not just dentists: Manasa Health Center, New Jersey, $30,000
Manasa Health Center is not a dental practice. It appears here only as an example that HHS has acted on the same kind of review-reply disclosures outside dentistry.
Manasa Health Center, LLC, a New Jersey provider of adult and child psychiatric services, paid $30,000 and agreed to a corrective action plan that, according to HHS, would be monitored for two years. An HHS press release dated June 5, 2023, says a complaint received in April 2020 alleged that a reply to a patient's negative online review included specific information regarding the individual's diagnosis and treatment of their mental health condition, and that OCR also found the practice had disclosed the protected health information of three other patients in responses to their negative online reviews. (HHS press release; the live page returned 403, so this was checked against the archive.org copy; also the HHS case page, content last reviewed June 5, 2023)
What the replies had in common
In the cases above, the public reply went beyond a general acknowledgment. HHS described disclosures of names, health conditions or treatment, visits, or insurance — on Yelp in the Elite and New Vision matters, and on the practice's Google page in the North Carolina civil money penalty.
The HIPAA Privacy Rule's minimum necessary standard requires a covered entity to make reasonable efforts to use or disclose only the protected health information needed for the purpose. That standard does not apply to a disclosure to the individual who is the subject of the information, but it does apply to many other disclosures. A public review page is not a private conversation with that person. (HHS, Summary of the HIPAA Privacy Rule)
HHS also publishes an index of resolution agreements and civil money penalties. (HHS)
State dental boards can act too: the 2026 Iowa case
This was a state dental board matter, not an HHS HIPAA penalty. In August 2026, reporting on an Iowa Dental Board settlement said an Iowa dentist was fined $1,000 after the board alleged that he "posted unprofessional responses to negative online reviews of him and included patient information" in those responses. The settlement also included a warning and an ethics program. (KCRG / Iowa Capital Dispatch)
How to check a reply before you post it
PlainReply is a free, rule-based wording checker. It checks your draft for wording that can reveal patient information. It does not post for you, it does not store your text, and it is not a legal review. You can also use the safer reply templates.