HIPAA-compliant review response checker

Example: one risky reply, checked

A 1★ review from "Sarah K." complains about a painful root canal. Here is a reply a busy front desk might write, with what the checker marks:

• "Sarah": uses the reviewer's name. Instead: open with "Hi there" or no greeting at all.
• "root canal": names a treatment, condition or medicine. Instead: leave the treatment out. Speak about your team in general terms.
• "Dr. Patel": names the person who treated them. Instead: thank "our team" instead of one named provider.
• "last Tuesday": gives a date or time. Instead: remove dates and times that are about this person.
• "Our records": mentions records, bills or insurance. Instead: never discuss an account in public. Ask them to call your office manager.
• "you missed": argues about what happened. Instead: don't argue the facts in public, even if the review is wrong. Invite a call.
• "your follow-up": confirms they are your patient. Instead: thank them for the review or the kind words, not for the visit.
• "your insurance": mentions records, bills or insurance. Instead: never discuss an account in public. Ask them to call your office manager.
• "crown": names a treatment, condition or medicine. Instead: leave the treatment out. Speak about your team in general terms.

The same reply, with nothing about the patient in it:

We're sorry to read this. We take every concern seriously, and privacy rules keep us from discussing anyone's care in a public reply. Please call our practice manager at (555) 010-2030 so we can talk it through.

It is shorter and it still does the job: the next person reading the review sees a practice that takes complaints seriously and answers fast. The details move to a phone call, where they belong.

Can you reply to patient reviews under HIPAA?

Yes, as long as the reply shares no health information. The HIPAA Privacy Rule defines health information as anything about a person's health, the provision of health care to an individual, or payment for it (45 CFR 160.103). That is why "thanks for visiting us" is a problem. It is short, but it tells the world this person received care from you.

Two more points trip practices up. First, the patient posting first does not give you permission to answer with details. Second, the rule covers HIPAA covered entities: providers such as doctors, clinics, dentists, psychologists and chiropractors, if they send health information electronically for things like insurance claims (HHS: covered entities).

What OCR has penalized: four review-reply cases

The HHS Office for Civil Rights (OCR) enforces HIPAA and publishes its cases. These are the four cases that started with a reply to an online review that we found on hhs.gov when we checked, on October 22, 2026.

When OCR announced the Manasa case, its director put it plainly: "Simply put, this is not allowed." Every one of these practices was answering a complaint. None of them needed the patient's details to do it well.

What the checker looks for

Nine kinds of risk, each with a fixed list of words and patterns. Red marks are the ones to fix before you post. Amber marks need a second look.

It also checks two good habits: a way to reach you offline (a phone number, an email or "please call") and a line saying privacy rules keep you from discussing care.

Safe reply templates for patient reviews

These are examples, written to pass the checker. Swap in your number, keep them short, and don't add details from the review. For 18 more, by situation, see our HIPAA-safe review response templates for dentists.

Example reply to a 5★ review

Thank you for taking the time to leave such kind words. Our whole team works hard to make every visit easy, and reviews like this mean a lot to us.

Thank you so much for the five stars! We'll share your note with the team.

Example reply to a 4★ review

Thank you for the review. We're always looking for ways to do better, so if you'd like to tell us more, please call our office manager at [phone number].

Example reply to a 3★ review

Thank you for the feedback. We want everyone who contacts us to have a good experience. Privacy rules keep us from discussing anyone's care here, so please call our office manager at [phone number]. We'd like to listen.

Example reply to a 1★ or 2★ review

We're sorry to read this. We take every concern seriously, and privacy rules keep us from discussing anyone's care in a public reply. Please call our practice manager at [phone number] so we can talk it through.

Thank you for letting us know. We can't discuss any personal details here, but we want to hear more. Please call [phone number] and ask for our office manager.

Example reply to a review you think is fake

Privacy rules keep us from saying whether any person has or hasn't been seen at our practice. If you'd like to talk about this, please call our office manager at [phone number].

A good 1★ reply does three things: it says sorry without admitting anything about the person, it says why you can't discuss details, and it gives a real way to reach a named role, like the office manager. Our guide on how to respond to negative reviews covers the tone.

What this checker can't do

• It reads English word patterns. It doesn't understand meaning, so it can miss a risky sentence and flag a harmless one.
• It doesn't know your patients. A first name or a nickname it can't recognize will pass unless you type the reviewer's name above.
• It checks the reply, not the review. Whether to reply at all, and when to call your lawyer, is your call.
• It is not legal advice and not a compliance program. OCR's cases also faulted missing policies and training, not only the words.