Is responding to a Google review a HIPAA violation?
Short answer: replying isn't prohibited, but what you say can be. The AMA notes that “HIPAA does not explicitly prohibit physicians from responding to online reviews,” but that a patient's own public disclosure “is not permission for the doctor to disclose anything.” (AMA) This page is general information, not legal advice.
What can turn a reply into a disclosure
Protected health information includes information that identifies a person and relates to their health care or payment for it. A reply can disclose that just by confirming someone was treated. That's why the ADA warns that “fines might also apply if your response merely confirms that a patient was indeed at your practice.” (ADA)
Enforcement cases involving review replies
| Year | Practice | What happened | Outcome | Source |
|---|---|---|---|---|
| 2022 | Dr. U. Phillip Igbinadolor, D.M.D. & Associates, P.A., North Carolina | Disclosed a patient's PHI “on a webpage in response to a negative online review”; didn't respond to OCR's data request or subpoena | $50,000 civil money penalty | HHS |
| 2022 | New Vision Dental, California | Complaint alleged review replies included patient names, treatment and insurance information | $23,000 + corrective action plan | HHS |
| 2023 | Manasa Health Center, New Jersey (psychiatry) | Disclosed PHI of four patients in responses to negative Google reviews | $30,000 + corrective action plan | HHS |
| 2026 | Iowa dentist (state dental board, not HHS) | Board alleged review responses “included patient information” | $1,000 civil penalty, warning, ethics program | KCRG |
“But the patient posted it first”
That doesn't give you permission to repeat it. The ADA: “Just because a patient identifies themself in a review, they have NOT waived their right to privacy!” A 2026 industry analysis of healthcare review replies found the most common problem was practices confirming something the reviewer had already said. (HIPAA Journal, a study by a firm affiliated with the author, covering California and the Pacific Northwest.)
How to reply safely
- Speak about your office's general policies, not the person
- Don't confirm or deny that they're a patient
- Leave out treatments, dates, bills and names
- Invite them to call
- Keep positive replies to a simple thank-you
Examples: positive replies · negative replies · templates · dentists fined for review replies · how to respond to a patient complaint · HIPAA social media rules · how to respond to a Yelp review
State rules can be stricter
HIPAA doesn't override stricter state privacy laws, and the ADA notes that practices not covered by HIPAA “must comply with state privacy laws.” Check with your privacy officer or attorney.