Skip to content
Teeth ShakersDental Practice Marketing Get the newsletter

HIPAA and Patient Privacy in Marketing · Chapter 2 of 6

Review replies and social media

Quinn GoodmanBy Dental marketing strategist

Reviews and social media are where privacy mistakes are most public. A reply or a post is a statement by the practice about a person, visible to anyone, and it can’t be fully taken back once it has been screenshotted.

Review replies

The core rule is simple: never confirm that a reviewer is a patient, and never mention their treatment, appointment, bill or history, even if they described it themselves in the review. A patient talking about their own care doesn’t give the practice permission to discuss it. The full approach, with reply templates for good, bad and mixed reviews, is in replying to reviews without violating HIPAA. The same rule applies to comments on your social posts and to messages on review sites.

The practice’s own posts

  • No patients without written authorization. Photos, videos, first names, birthday shout-outs and “welcome to our newest patient” posts all identify someone as a patient. See patient photos, stories and testimonials.
  • No anonymized stories that can be traced. “A local teacher came in Tuesday with a cracked molar” may identify a person to everyone who knows them.
  • Check the background of every photo for schedules, charts, x-rays and screens.
  • Limit who can post. Name the people who post and reply for the practice, and use the practice’s own accounts, not a staff member’s personal profile.

Staff posting on their own accounts

Team members have personal social media lives, and that’s fine. Your written social media policy should make a few things clear: staff never post about patients, even without names; never post photos taken at work that show patients or patient information; never reply to reviews or comments about the practice from personal accounts; and never confirm to friends online that someone they know is a patient. Include it in onboarding and in your regular HIPAA training.

When patients tag the practice

Patients often post their own smile photos, check-ins and thank-you messages and tag the practice. That is their choice to make about their own information. What the practice does next is a separate question:

  • A short, general thank-you is usually fine. Don’t add details about their visit or treatment.
  • Resharing, quoting or reposting a patient’s post to the practice’s page is the practice using it in its marketing. The conservative approach is to get written authorization first.
  • If a patient posts something private or upset, take it offline with a general invitation to call the office manager.

When someone on the team isn’t sure, the answer is to wait and ask the privacy officer. A post that goes up an hour later loses nothing.