Replying to reviews shows prospective patients that the practice listens. It is also the place where dental practices most often create a privacy problem, because a reply is a public statement by the practice about a person.
Why confirming they’re a patient is a disclosure
Under HIPAA, the fact that someone is your patient is itself protected health information. A reply that says “we reviewed your chart,” “as we discussed at your cleaning,” or even “we’re sorry your visit was frustrating” confirms that the reviewer was seen at your practice. Mentioning treatment, dates, billing, insurance or anything from the record goes further.
It doesn’t matter that the patient revealed it first. A patient can share their own information publicly; that doesn’t give the practice permission to discuss it. HHS’s Office for Civil Rights, which enforces HIPAA, has taken enforcement action against dental practices over replies to online reviews, so treat this as a real risk.
Reply templates
Write a few approved templates, adjust the wording so replies don’t all look identical, and keep them general.
- Positive: “Thank you so much for taking the time to share this. Our team works hard to make everyone feel welcome, and kind words like these mean a lot to us.”
- Negative: “We take every concern seriously and want everyone who contacts our office to have a good experience. Privacy rules limit what we can say here, but we would welcome a conversation. Please call our office manager, [name], at [number].”
- Mixed: “Thank you for the feedback, both the good and the parts we can do better. We’re always working to improve, and our office manager, [name], would be glad to talk with you at [number].”
Notice what these replies don’t do: they don’t say “your visit,” “your treatment” or “when you were here.” They talk about the practice’s standards, not the person.
What never to say
- Anything confirming the reviewer is, or was, a patient.
- Treatment, diagnosis, appointment dates, balances, insurance or payment history.
- “Our records show” or any correction of their account using information from the chart.
- The names of other patients, or details about staff discipline.
- Anything you wouldn’t want read aloud to a state board or a judge.
Who replies
Limit reply access to one or two trained people using the approved templates. The dentist who feels personally attacked at 10 p.m. is the person most likely to write the reply that causes trouble. Wait a day on anything that stings. Include review replies in your regular HIPAA training, and if you are unsure about a specific reply, ask your privacy officer or a healthcare attorney before posting. More on privacy is in the compliance guides.