How to turn a negative review into your best marketing asset (without breaking HIPAA)
Four healthcare practices have faced a combined $113,000 in HHS penalties and settlements for replying to bad reviews with patient details. The reply that actually wins over future patients says almost nothing about the patient who left the review.
It's 9:40 on a Tuesday night, and a one-star review lands on your Google profile. The reviewer says they waited 50 minutes and nobody explained the bill. Your office manager has the chart open and wants to post the real story. That instinct, setting the record straight, is the most expensive thing a practice can do with a bad review. The reply that actually wins over future patients looks almost nothing like it.
Your reply is written for the next patient
A negative review is a conversation with one unhappy person that hundreds of strangers get to watch. BrightLocal's 2026 Local Consumer Review Survey of 1,002 US adults found that 97% of consumers read reviews for local businesses and 77% say negative reviews make them less likely to choose one. It also found that 80% are likely to use a business that responds to all of its reviews, compared with 47% for one that responds only to negative reviews.
These are self-reported answers about local businesses in general, not medical practices, but the direction is clear: prospective patients grade your reply, not just the complaint.
Northwestern's Spiegel Research Center found purchase likelihood typically peaks at ratings of 4.0 to 4.7, not 5.0, though that study covered retail products rather than healthcare. One bad review is not a crisis. A bad reply can be.
The reply that gets practices fined
The HHS Office for Civil Rights has taken at least four enforcement actions over what practices posted in response to reviews. Elite Dental Associates in Dallas settled for $10,000 in 2019 after replying on Yelp with a patient's name, treatment plan, insurance, and cost details. A North Carolina dental practice was assessed a $50,000 civil money penalty in 2022. New Vision Dental in California paid $23,000 that same year for repeatedly disclosing names, visit details, and insurance in Yelp replies. In 2023, Manasa Health Center, a New Jersey psychiatry practice, paid $30,000 after answering negative Google reviews with diagnosis and treatment details for four patients.
None of these replies were malicious. They were practices defending themselves with facts. A patient sharing details first did not give the practice permission to add more. Health law firms commenting on these cases generally go further, advising that even confirming the reviewer was a patient can count as disclosing protected health information. That is a widely held legal reading rather than a quoted OCR rule, so confirm your policy with your compliance lead or counsel.
What a safe reply actually says
A reply that protects you and persuades readers thanks the reviewer, confirms nothing about them, and moves the conversation offline. Something like:
"Thank you for sharing this. We take every concern seriously, and privacy laws keep us from discussing anyone's care online. Please call our practice manager, Dana, at (555) 555-0100 so we can talk directly."
Notice what is missing. No "sorry about your visit," because that confirms a visit happened. No dates, procedures, or billing details, even to correct an error.
The catch: a reply this careful can sound canned, and BrightLocal found that 50% of consumers are put off by generic or templated responses. The fix is to answer the theme of the complaint as a policy. For a wait time complaint, "Long waits are not the experience we want for anyone, and we're reviewing how we schedule" responds without confirming anything about the reviewer.
Where the marketing value actually comes from
The asset is not the review. It is what you do after it.
First, fix the pattern. If three reviews in a quarter mention billing confusion, fix it, then talk about the fix publicly in general terms: a written cost estimate before every procedure, a text when the doctor runs late. That is marketing built from criticism, with no patient attached.
Second, outweigh the outlier with volume. BrightLocal found that 47% of consumers won't use a business with fewer than 20 reviews, and 74% only care about reviews from the last three months. Ask every patient, consistently. The FTC's consumer review rule, in effect since October 2024, bars incentives conditioned on a review expressing a particular sentiment (16 CFR 465.4).
Third, be careful about reposting. OCR's $182,000 settlement with Cadia Healthcare involved patient success stories posted online without authorization. Our read, not a stated OCR rule, is that the safe default is written HIPAA authorization before using any patient's words in marketing, even words they already posted publicly.
What to actually check this week
Read your last 10 review replies. Flag any name, date, procedure, insurance detail, or the words "your visit."
Decide who is allowed to reply: one or two trained people, not whoever is at the front desk that night.
Write three approved replies that thank the reviewer, confirm nothing, and give a direct phone number.
Pull every negative review from the last three months and look for a repeated theme you can fix.
Confirm written authorization is on file for every testimonial or review screenshot on your website and ads.
Set a response window. BrightLocal found 81% of consumers expect a reply within a week.
The bottom line
A negative review is public proof of how your practice handles a hard moment. Handled well, it shows the next patient that you listen, you fix things, and you protect their privacy even when that is harder. Handled badly, it becomes the subject of an HHS press release.
Have you actually read your last ten review replies with HIPAA in mind, or have you been trusting that whoever writes them knows where the line is?
Important questions about practice reviews
- Can a patient waive HIPAA by posting a negative review publicly?
- No. A patient sharing details about their own visit does not give the practice permission to add or confirm any information in a public reply. Health law professionals generally advise that even confirming the reviewer was a patient can count as disclosing protected health information, so treat every public reply as if you know nothing about the person who wrote it.
- Can we ask Google or Yelp to remove a negative review?
- Platforms will remove reviews that violate their own policies, such as spam, fake content, or off-topic posts, but they will not remove a review simply because it is unfavorable or factually disputed. Your best path is a careful, privacy-safe reply that shows future patients how you handle complaints.
- Who at the practice should be allowed to respond to reviews?
- Limit replies to one or two trained staff members, such as the practice manager or a designated marketing coordinator. Whoever was at the front desk that evening, or whoever is most upset about the complaint, should not be the one writing the public response.
- Do we need written patient authorization to repost a positive review on our website or in ads?
- This is widely treated as a risk area worth reviewing with your compliance lead or counsel. The cautious, commonly recommended default is to obtain written HIPAA authorization before using any patient's words in marketing, even words the patient already posted publicly.
- Is it okay to offer a discount or gift card to encourage patients to leave reviews?
- The FTC's consumer review rule, in effect since October 2024, bars offering incentives that are conditioned on a review expressing a particular sentiment. You can ask patients to leave honest reviews, but tying a reward to a positive review creates a regulatory risk signal.
- How quickly do we need to respond to a negative review?
- BrightLocal's 2026 survey found that 81 percent of consumers expect a reply within a week. Setting a clear internal response window, and assigning a specific person to monitor incoming reviews, keeps your practice from letting a complaint sit unanswered while prospective patients are reading it.
James Thompson is a UX and Product Design Leader with over 20 years of experience driving multi-million dollar revenue growth through user-centric design. A Nielsen Norman Group UX Master Certified practitioner, James specializes in digital transformation, heuristic evaluations, and modular design systems. He has led UX design for HIPAA-compliant, patient-facing platforms and ADA/WCAG-compliant healthcare products, translating complex regulatory requirements into interfaces that support both clinical workflows and diverse patient populations.
Ready for a website that earns trust and books more patients?
Mederi Digital builds healthcare websites that are accessible, private, and made to convert. Grab a free 30-minute strategy call and we'll map the quickest wins for your practice.
Book a free strategy call