The operating rule
A healthcare practice can respond to a public review, but it cannot use the reply to confirm or disclose patient-specific information.
The American Medical Association states that HIPAA does not categorically prohibit physicians from responding. It also warns that the response cannot disclose patient-specific information, even when the reviewer shared that information first. A safe operating posture is to answer as though you cannot verify who wrote the review.
Read the AMA guidance renewed in 2025Make a 30-second public-reply decision
Stop before drafting. Decide what can be said without referring to an individual record or relationship.
Start here
Can you answer without individual facts?
If not, do not improvise in public. Route the matter through the practice's approved private process.
If yes
Use general language
Thank the reviewer, state a general value, and offer an authorized contact path without confirming care.
Before publish
Review the final edit
Recheck every change for patient status, health details, appointments, records, billing, and insurance references.
Keep the public boundary visible
The right column is not a list of bad manners. It is information the practice should not disclose or confirm in a public response.
Public reply can do
Public reply must not do
Thank the reviewer for sharing feedback.
Confirm that the reviewer received care.
State a general practice value or policy.
Mention appointments, treatment, diagnosis, records, billing, or insurance.
Offer a general office contact path.
Use chart details to correct or challenge the reviewer.
Invite a private conversation without promising an outcome.
Repeat health information the reviewer disclosed first.
Remove the disclosure, not the empathy
These examples are drafting patterns, not legal determinations. Each safer version stays general and leaves individual facts out of the public response.
Positive treatment comment
The reply no longer confirms a procedure, recovery, or patient relationship.
High-risk wording
“We are glad your procedure went well and that you are recovering quickly.”
Safer pattern
“Thank you for taking the time to share this feedback. Our team appreciates hearing from the people we serve.”
Wait-time complaint
The reply removes appointment confirmation and another person's care details.
High-risk wording
“Your appointment started late because the emergency before you required extra time.”
Safer pattern
“We take concerns about timeliness seriously. Please contact our office through the number on our website so the appropriate team member can listen.”
Billing dispute
The reply does not confirm insurance, a balance, records, or prior conversations.
High-risk wording
“Your insurer denied the claim, and our records show we explained the balance twice.”
Safer pattern
“We understand that billing concerns can be frustrating. Our office can review questions through our established private support process.”
Review contains health details
The reply does not adopt, repeat, or add to the reviewer's health disclosure.
High-risk wording
“The dosage and follow-up plan you described were selected for your condition.”
Safer pattern
“Thank you for sharing your perspective. To protect privacy, we do not discuss individual matters in a public forum.”
Public review replies have produced real enforcement
HHS Office for Civil Rights actions make the boundary concrete. UPI received a $50,000 civil monetary penalty after disclosing patient information in response to a review. New Vision Dental agreed to a $23,000 settlement and corrective action plan. HHS also resolved a review-response matter with Manasa Health Center.
Our safeguard audit held every sampled healthcare draft
On August 19, 2026, we ran a privacy-safe retrospective audit of pending production drafts updated in the prior 90 days. The deterministic healthcare safeguards sent all 11 healthcare drafts to approval or blocking, and allowed none for automatic posting.
- pending drafts audited
- 1,424
- healthcare drafts
- 11
- held for approval
- 10
- blocked
- 1
Limits: eleven healthcare drafts are too few to establish false-positive or false-negative rates. This was a point-in-time backtest of pending drafts, not prospective clinical validation. The result does not prove HIPAA compliance.
Final pre-publish review
Run this check on the final text after every human edit.
- 01The reply does not confirm that the reviewer is or was a patient.
- 02It does not repeat or add health, treatment, appointment, billing, or insurance details.
- 03It does not quote private records or use them to defend the practice.
- 04Any policy statement is general and applies without identifying the reviewer.
- 05The offline contact path is real, authorized, and described without promising a result.
- 06A trained person reviewed the final edited text, not only the first draft.
HIPAA-aware review response FAQ
Can a healthcare practice respond to a Google review under HIPAA?
Can a practice repeat health information the reviewer posted first?
Is it safe to say that the reviewer was never a patient?
What should a practice say to a negative patient review?
Can AI make a review response HIPAA compliant?
Does Reply Champion guarantee HIPAA compliance?
Put healthcare replies behind the right controls
Reply Champion helps you screen for disclosure risks, require human approval, and recheck the exact text before it goes public. Try it free for 7 days with no credit card required.
Reply Champion is a workflow tool, not legal advice or a guarantee of compliance.