Patient Reviews Under HIPAA: Ask Everyone, Confirm No One

For most small businesses, reviews are a marketing project. For a therapy practice they are a regulated activity, because every step touches patient information held by a covered entity: the list of people you might ask, the tool that sends the ask, the words a happy family lets you put on your website, and the reply you type under a one-star review at eleven at night. Practices get the first steps roughly right and then lose the whole game at the last one — the Office for Civil Rights has now penalized provider after provider not for asking, but for replying.

This article is the review system for a practice that has to live inside those rules: when in the care arc to ask, the word-for-word ask for three channels, the screen to run before any review tool touches your patient list, what a testimonial on your own site requires that a Google review does not, and the reply discipline that keeps your practice out of an OCR press release. If what you need is the Google Business Profile itself — categories, completeness, local ranking — that is its own article in this library; this one is about the rules that follow the patient relationship onto every platform.

Three separate authorities regulate a patient review, and they restrict different people at different moments. Mixing them up is how practices end up afraid of the legal part and casual about the dangerous part. HIPAA restricts the practice, and almost entirely on the disclosure side — what leaves your hands, in a reply, a testimonial, or a patient list handed to a vendor. The FTC’s consumer-review rule, 16 CFR Part 465, in effect since October 21, 2024, restricts how reviews are procured and suppressed: buying or selling fake reviews, paying for reviews that must be positive or negative, and silencing critics with unfounded legal threats are now federal violations with civil penalties attached. And each platform sets its own solicitation policy — Google permits a neutral ask but prohibits incentives and selective solicitation, while some platforms discourage asking at all, so read the current policy of any platform before you point an ask at it.

Start with the asymmetry, because the whole system is built on it. A patient may post anything about their own care — names, diagnoses, session-by-session detail — and no privacy law is violated, because HIPAA binds covered entities and their business associates, not the people they treat. The practice, by contrast, may publicly disclose nothing that identifies a patient without authorization. Not the treatment details, not the billing history, and not the threshold fact underneath all of it: that this person is a patient at all. When a reviewer writes under their real name and your reply opens with “we’re sorry your evaluation ran long,” you have confirmed a treatment relationship to everyone who ever searches either name. That confirmation is a disclosure of protected health information, and OCR has treated it as one in every review-reply enforcement action it has published.

The ask itself sits on the permitted side of the line. Asking your own patient, through your own channels, for an honest review of their experience is not a disclosure to anyone — the risk enters when a third party or the public gets involved. That gives the review program three regulated edges, and the rest of this article walks them in order: the ask must not be gated or bought, the tooling must not leak the patient list, and the public-facing output — testimonial or reply — must not identify anyone without written permission.

The timing question has a clinical answer, not a marketing one. A review is a story about an experience, so the ask lands best at the moments the family can see the shape of that story: discharge, when the episode of care has an ending; and the milestone conversation mid-care, when a goal the family cared about has visibly moved. An ask in week two, before anything has changed, produces either silence or a thin review — and an ask in the middle of a billing dispute produces the review you deserve for asking then. Build the ask into the discharge workflow and the milestone conversation so it happens on schedule rather than on memory.

Timing is also where the uniformity rule does its work. Picking the moment is yours; picking the families is not. The same ask goes to every family who reaches that moment — the one whose child met every goal and the one whose episode was bumpy — because the moment you start selecting for expected sentiment, you have crossed from scheduling into review gating, which Google’s fake-engagement policy prohibits by name. Uniform timing is also what an auditor of any kind — a platform, a regulator, your own conscience — will recognize as a policy rather than a curation.

Every version of a compliant ask has the same four properties: it asks for honesty rather than praise, it offers nothing of value, it never mentions the patient’s condition or results, and it is identical for every family. Everything else — warmth, brevity, your practice’s voice — is yours. The kit below covers the three channels a small practice actually uses: the spoken line in the discharge conversation, the follow-up text the same day, and the email version for practices that close episodes with a written summary. Replace the bracketed values; keep the structure.

The moment a review-request tool sends messages on your behalf, it is working from your patient list — names, phone numbers, email addresses, visit dates. Held by a covered entity, those identifiers are protected health information even with no diagnosis attached, and a vendor that creates, receives, maintains, or transmits PHI while performing a service for you is a business associate under HIPAA. That is not a judgment call; it is the definition. So the screen before any tool goes live is short: a signed business associate agreement before the first patient record flows, or the tool does not get the list. “We’re SOC 2 certified” is an answer to a different question — certifications describe security posture, while the BAA is the legal instrument HIPAA actually requires, and sending a patient list to a vendor without one is an impermissible disclosure all by itself, before anything goes wrong.

Two follow-on rules keep the tooling honest. First, the BAA covers the data handling, not the solicitation design: a gated funnel run by a business associate is still gating, and the platform policy and FTC exposure land on your practice, whose name is on the profile. Second, feed the tool the minimum it needs — HIPAA’s minimum-necessary principle applies to disclosures to business associates, and a review request needs a name and a contact channel, not a diagnosis code or a visit history. If the simplest compliant setup is your own EHR sending the discharge text from the templates above, that is not a lesser system. It is the same system with one fewer contract to manage.

A review on Google is the patient’s speech on a platform. A testimonial on your website is your disclosure in your marketing, and the Privacy Rule treats it that way: uses and disclosures of PHI for marketing purposes require the individual’s prior written authorization under 45 CFR 164.508, with narrow exceptions that a website success story does not fit. Grateful consent in the hallway is not an authorization. Neither is the patient having already posted the same words publicly. The authorization is a specific signed document: it describes the information to be used, names who discloses and who receives it, states the purpose, carries an expiration, and tells the patient they may revoke it — and it is signed before the story goes up, not after.

OCR has made an example of exactly this shortcut. In 2025 it announced a $182,000 settlement with Cadia Healthcare Facilities, a group of skilled-nursing providers that had posted patient “success stories” — names, photographs, and details of conditions and treatment — on marketing websites without valid HIPAA authorizations. The agency’s stated position in that action is the operating rule for every practice: a valid written authorization comes before any patient’s information appears in a testimonial. For a small therapy practice the practical system is one reusable authorization form reviewed by counsel once, offered only to families who volunteer, filed in the chart, and honored instantly on revocation — and if that feels like more machinery than a homepage quote is worth, the compliant alternative is marketing the practice rather than the patients.

Every enforcement action OCR has published about online reviews is about the reply. Elite Dental Associates paid $10,000 in 2019 after responding to Yelp reviews with patient information. New Vision Dental paid $23,000 in 2022 after replies that, among other things, posted patients’ full names when they had reviewed under pseudonyms, plus details of their visits and insurance. Manasa Health Center, a New Jersey psychiatric practice, paid $30,000 in 2023 over replies to negative reviews that disclosed protected health information, including information about a patient’s mental health. Each settlement also came with a corrective action plan — years of monitored policies, training, and reporting — purchased by replies that took minutes to type.

The fix is not better judgment in the moment — the moment is precisely when judgment is worst, because the person who feels accused is the person typing. The fix is a protocol decided in advance, small enough to actually follow:

1. 01

   One person responds, and it is never the treating clinician

   Name a single responder — the owner or practice manager — and route every review to them. The clinician who was named in the review is the one person guaranteed to write the reply that ends up in a press release.

2. 02

   Negative reviews wait 24 hours

   Nothing about a review gets worse in a day, and every review-reply enforcement case on the record features a fast, heated response. The cooling-off period is the single cheapest safeguard in this article.

3. 03

   Run the one-question screen

   Before anything is posted, ask: could a stranger reading this reply conclude that this specific person is, or ever was, a patient here? If yes — including “we’re sorry about your visit” — the reply does not go up. Speak about the practice’s general standards, never about the reviewer’s care.

4. 04

   Move the substance offline

   The public reply has one job: show future readers a composed practice and offer a direct channel. The actual dispute — the balance, the schedule, the outcome — is handled by phone or portal, where a conversation with the patient about their own care is permitted and productive.

5. 05

   Flag policy violations through the platform, not the reply box

   A review that is fake, abusive, or from someone with a conflict can be reported under the platform’s content rules. What a practice must never do is pressure the reviewer — the FTC rule reaches review suppression through unfounded legal threats, and a healthcare practice threatening a family in public loses even when it wins.

6. 06

   Log it like the compliance event it is

   Date, review, decision, reply text, who approved it. The log turns “we have a policy” into evidence, and a quarterly read of it tells you which operational problems keep generating one-star feedback — which is the part of reputation you can actually fix.