The Office for Civil Rights has penalized medical practices over online reviews. The reviews weren’t the violation. The replies were.
You need more reviews, and every step toward them feels like a privacy risk. It isn’t, once you see what the practices that got penalized actually did wrong. Their mistakes were specific and repeatable, and each one has a control that blocks it.
So this guide opens three public cases and works backward from them. What the practice wrote, what OCR found and what would have stopped it. Then it builds the request process, the reply rules and the staff roles from what the cases show. I run Local SEO for medical practices, and I build review processes the same way: from the failures. None of this is legal advice, so your privacy officer or healthcare counsel approves the final version.
What Did Three Practices Write That Cost Them a Settlement?
Each practice replied to patient reviews in public and included information that confirmed or described a patient’s care. OCR treated those replies as impermissible disclosures of protected health information. The three cases below are public settlements, and each one ended with a payment and a two-year corrective action plan.
Elite Dental Associates, Dallas, October 2019
The practice answered Yelp reviews with a patient’s last name and details about the patient’s health condition. OCR found that Elite had disclosed the protected health information of multiple patients, and that it had no policy on social media disclosures and no compliant notice of privacy practices. The settlement was $10,000 plus a corrective action plan, with OCR monitoring for two years. The control that would have stopped it: one written reply script and a rule that no reply names or describes a patient.
New Vision Dental, California, December 2022
The practice answered Yelp reviews with patients’ full names, plus visit details and insurance information that hadn’t appeared in the original reviews. The settlement was $23,000 plus a two-year corrective action plan. The control that would have stopped it: a rule that replies never add a fact the reviewer didn’t post, and a second person reading each reply before it goes live.
Manasa Health Center, 2023
The psychiatric practice answered negative Google reviews and exposed diagnosis and treatment details for four patients. OCR also found a failure to implement HIPAA Privacy Rule policies and procedures. The settlement was $30,000 plus a two-year corrective action plan, announced in June 2023. The control that would have stopped it: the same reply script, and a policy that routes any review describing clinical care to the privacy officer instead of the front desk.
What Do the Three Cases Have in Common That a Reply Policy Can Block?
They share three patterns, and a written reply policy blocks all three. Every reply was public, every one added or confirmed patient details and, in the two cases where OCR noted it, the practice had no policy that told staff what to write.
That list turns into a short script. I give practices three templates, and the third one handles the review that already names a treatment:
Positive review: Thank you for the kind words. We appreciate your feedback and the time it took to write it.
Negative review: Thank you for your feedback. We take every comment seriously. Please call our office at [number] so we can talk with you directly.
A review that names a treatment or a doctor: the negative template, word for word. The reply doesn’t mention the treatment, the provider or the visit, even to correct a mistake.
Confirming a fact the patient posted still confirms the relationship. That is the disclosure OCR penalized, and a law-firm summary of these cases warns about it directly: confirming facts a patient posted online can raise HIPAA problems. Google’s reply guidance points the same way: keep replies short, never share a reviewer’s private information and take complex issues to phone or email.
Does Asking for Reviews Create the Same Exposure?
It creates a different exposure. A reply discloses information in public. A request uses patient contact information to reach someone, and the exposure sits in the list, the vendor and the wording.
HIPAA doesn’t name review requests. It regulates the patient information used to send them: a name paired with the fact of a visit is protected health information. Three controls cover it. The request goes out from the practice’s own scheduling or EHR system to every eligible patient the same way. Any review tool that receives names, phone numbers or visit status signs a business associate agreement first. And the message carries no care details:
Hi [First name], thank you for choosing [Practice name]. If you have a minute, we’d appreciate an honest Google review: [direct review link]. Reply STOP to opt out.
The message still names your practice, so it reveals a relationship. That is why the vendor needs an agreement and the message stops there. HHS’s marketing FAQ separates marketing, which generally needs written authorization, from treatment and operations communications, and it admits the categories overlap. A review request sits in that overlap, so I keep it generic and ask counsel to confirm the classification.
Texts add a second rule. The federal TCPA governs consent to receive them, separate from HIPAA. I treat a review text as a marketing-grade message: consent on file, an opt-out in every message, and no request to anyone who opted out. A card with a QR code at checkout carries no patient data at all, which makes it the lowest-risk channel.
What Does Google Forbid Even When HIPAA Allows It?
Google forbids incentives, selective asking, quotas and scripted content, and the Federal Trade Commission’s 2024 rule backs the same limits. HIPAA says nothing about any of them, which is why a process can pass a privacy review and still break platform rules.
| Tactic | Allowed? | The rule behind it |
|---|---|---|
| A gift card or discount for a review | No | Google bans incentives, and the FTC rule bans paying for reviews that express a particular sentiment |
| Asking only patients likely to be happy | No | Google bans selectively soliciting positive reviews and discouraging negative ones |
| A QR code on the checkout card | Yes | Google lets merchants share a review link or QR code |
| Staff asking in person, no pressure | Yes | Google bans pressuring patients to post on the premises |
| A monthly review quota for staff | No | Google bans quotas for how many reviews staff solicit |
| Asking a patient to name a staff member | No | Google bans requests for specific content |
| A reply with treatment details | No | HIPAA, as the three cases show |
Google’s review policy states each of these rules, and a request that offers no incentive and doesn’t steer the rating or the content stays inside them.
Who Owns Each Step Inside the Practice?
A named role owns each step, and the policy fits on one page. Without owners, the reply that reaches the public is whatever the nearest staff member typed.
| Step | Owner | Rule |
|---|---|---|
| Sending review requests | Practice manager | Same message to every eligible patient, vendor agreement on file |
| Replying to reviews | One or two trained staff | Templates only, no patient details |
| Approving replies to negative reviews | A second person | Reads before it posts |
| Reviews describing clinical care or threatening action | Privacy officer | No reply until reviewed |
| Opt-out list | Practice manager | Honored immediately, recorded |
| Training | Privacy officer | New staff before they touch the profile |
This page also answers OCR’s first question after a complaint: what safeguards did the practice have? The Elite Dental and Manasa findings both cite missing privacy policies and procedures, so a written, dated policy is evidence in your favor.
Frequently Asked Questions
Can I give patients a gift card or discount for a review?
No. Google prohibits incentives for reviews, including discounts and free services, and the FTC’s rule bans paying for reviews that express a particular sentiment. Every patient gets the same invitation and honest reviews come in on their own schedule.
Can I ask only my happiest patients?
No. Google bans selective solicitation, and a hand-picked list is also a patient list handed to a vendor. Invitations go to everyone who completes a visit, in the same way.
A reviewer describes their treatment. Can I confirm it?
No. Confirming a fact the patient already posted still confirms the relationship, and that is the disclosure OCR penalized. The generic reply applies, with an invitation to call.
Do I need patient consent to send a review request?
HIPAA doesn’t name review requests, and the right basis depends on the channel. For texts, TCPA consent rules apply. I add a line to the intake form that lists review requests among the practice’s communications, then confirm the wording with counsel.
Does the review vendor need a business associate agreement?
Yes, when the vendor receives patient names and contact details linked to visits. No agreement means no patient list goes to that vendor.
Can front-desk staff ask for a review in person?
Yes, with a QR code or link and without pressure. Google bans pressuring patients to post in the office, setting staff quotas and asking for specific content.
Want a review process your privacy officer will approve? Book a strategy call.
References
- Google Maps contribution policy, Fake engagement rules
- Google Business Profile Help, Reviews help page
- HHS, HIPAA marketing FAQ (loads in a browser; blocks scripted checks)
- Federal Trade Commission, Final rule announcement (August 2024)
- HIPAA Journal, Elite Dental Yelp settlement
- Nixon Peabody, Responding to online reviews (July 2023)
