This is general information, not legal advice.
You can ask patients for Google reviews without violating HIPAA. Asking is the low-risk part, as long as the request is generic and any vendor that sends it has signed a business associate agreement (BAA). The real exposure comes afterward, in a reply that confirms someone is a patient or in a review reused for marketing without written permission. Every enforcement action about online reviews that we found on the HHS website involved what a practice wrote back, not what it asked.
In a Tebra survey of 3,964 US adults fielded in June 2025, 79% of patients said they read reviews before choosing a provider.
Where the HIPAA risk sits
- The request. Sending it uses a patient's name and contact details, which are protected health information in your hands. HIPAA lets a practice use patient information for its own health care operations, a category that includes quality assessment and customer service. We read a plain request for feedback as fitting there. HHS has not, as far as we can find, published guidance that names review requests, so treat that as a reasonable reading and not a ruling.
- The vendor. If a review service receives patient names, phone numbers or visit dates in order to send requests, it is handling patient information on your behalf. HHS describes that as a business associate relationship, which requires a written agreement.
- The reply. A public response can disclose that the reviewer is a patient, and often more. This is where practices have been penalized.
- Reuse. Copying a review onto your website or social media is a new use of patient information by the practice. The Privacy Rule requires a valid authorization for uses and disclosures it does not otherwise permit, so get written permission first.
HIPAA defines marketing as a communication that encourages the recipient to buy or use a product or service, and it generally requires written authorization. A request for feedback is not that. A request bundled with a promotion might be, depending on what is promoted and who pays for it, so keep the two apart.
What regulators have penalized
The HHS Office for Civil Rights (OCR) has published several cases about online reviews. All of them concern what the practice wrote in response.
- Elite Dental Associates, Texas, 2019. Paid $10,000 to settle disclosures of patient information on social media. The resolution agreement describes responses to patient reviews on the practice's Yelp page.
- Dr. U. Phillip Igbinadolor, D.M.D. & Associates, North Carolina, 2022. OCR imposed a $50,000 civil money penalty after the practice disclosed a patient's information on a webpage in response to a negative online review and did not respond to OCR's data request.
- New Vision Dental, California, 2022. Paid $23,000 over disclosures of patient information in response to online reviews.
- Manasa Health Center, New Jersey, 2023. Paid $30,000 after OCR said it disclosed the information of four patients in responses to negative reviews on Google.
The three practices that settled also agreed to corrective action plans. Asking for reviews was not the issue in any of these cases. Answering them carelessly was.
How to ask
- Ask every patient, not only the happy ones. Google's policy says businesses may not discourage negative reviews or selectively solicit positive ones. Trigger the request from a completed visit, not from a satisfaction score.
- Offer nothing in return. Google prohibits incentives such as free or discounted services in exchange for reviews. A Federal Trade Commission rule announced in 2024 also bars incentives conditioned on a review expressing a particular sentiment.
- Keep the message generic. Name the practice and include the link. Leave out the provider's specialty, the service and anything else about the visit.
- Do not press patients at the front desk. The same Google policy says businesses should not pressure people to write reviews while on the premises, or ask for specific content. Send the request afterward and let the patient decide.
- Cover texting consent. A review request is not an appointment reminder. The FCC ties a patient's consent to health care messages to the scope of the consent given, and whether that stretches to a review request is a judgment call. Name feedback requests in your consent wording and honor every opt-out.
- Sign the BAA first. No patient list goes to a review vendor until the agreement is in place.
A request by text can be this short.
Hi [first name], thank you for choosing [practice name]. We would appreciate your honest feedback. You can leave a review at [link]. Reply STOP to opt out.
And by email.
Thank you for visiting [practice name]. We would be grateful for an honest review on Google. Good or bad, your feedback helps us improve. You can leave it at [link].
How to reply without disclosing anything
One rule covers most situations. Never confirm or deny in public that the reviewer is a patient, and never add details, even ones the reviewer already shared. A patient telling their own story does not give the practice permission to add to it.
| Risky reply | What it reveals | Safer reply |
|---|---|---|
| We are sorry your appointment on Tuesday ran late. | A visit and its date | We work hard to run on time and would like to hear more. Please call our office. |
| As we explained, your plan did not cover that treatment. | Insurance and treatment details | Billing questions are best handled privately. Please call our office manager. |
| We are glad your knee is feeling better. | A health condition | Thank you for the kind words. They mean a lot to our team. |
For a positive review, a short thank-you is enough.
Thank you for taking the time to share this. Feedback like yours means a great deal to our team.
For a negative one, acknowledge it and move the conversation offline.
Thank you for the feedback. Privacy rules prevent us from discussing any individual's situation in public, but we take concerns seriously. Please call [name] at [phone number] so we can look into this.
Then follow up privately and note what was done. Limit who can post replies to one or two trained people, and write the rule down. In the Manasa case, the potential violations OCR listed also included a failure to implement policies and procedures for protected health information.
Reusing reviews in your marketing
A five-star review is tempting to copy onto a website, a flyer or a social post. Ask first. A valid HIPAA authorization has to say what information will be used, who will use it, for what purpose and until when, and it must be signed and dated. The patient can revoke it in writing later, so keep track of where each quote appears.
A short checklist
- Requests go to every patient after a completed visit
- No discounts, gifts or prize draws for reviews
- Messages name the practice and nothing about the care
- A BAA is signed with any vendor that receives patient details
- Replies never confirm that the reviewer is a patient
- Written authorization is on file before a review is reused
In Klauve, reputation tools gather Google reviews from every location into one list and let you reply from the same page. A review request can go out by text or email after a visit is marked complete. What a reply says is still up to the person writing it.
If you want a second pair of eyes on how your practice asks for and answers reviews, talk to us.
Frequently asked questions
Is it a HIPAA violation to ask patients for Google reviews?
Not in itself. We read a plain request for feedback, sent by the practice or by a vendor under a BAA, as a permitted use of patient contact details for health care operations. We have not found HHS guidance that addresses review requests by name, so keep the message generic and check with counsel if your situation is unusual.
Can we reply to a negative review from a patient?
Yes, as long as the reply does not confirm the person is a patient or mention anything about their care. Thank them, say that privacy rules prevent a public discussion, and invite a phone call. OCR has penalized practices that answered negative reviews with patient details.
Can we offer a gift card or discount for a review?
No. Google's policy prohibits incentives in exchange for reviews, and reviews gathered that way can be removed. The FTC's rule on reviews also bars compensation that is conditioned on a review expressing a particular sentiment.
Can we post a patient's Google review on our website?
Get the patient's written authorization first. The review is public on Google because the patient chose to post it there. Republishing it is a separate decision by the practice, and the Privacy Rule requires authorization for uses and disclosures it does not otherwise permit.
Does a review-request service need to sign a BAA?
If it receives patient names, contact details or visit information from you, plan on it. A vendor that handles patient information on a practice's behalf is a business associate under HIPAA. A service that only gives you a link or QR code to share yourself, and never sees patient data, is a different case.