Updated 2026-07-04

HIPAA-compliant review responses

For a healthcare practice, the review response rules everyone else uses are inverted. "Be specific, name the visit, address the details" - the standard advice on every other page of this site - is exactly what gets a practice an OCR complaint. Any response that confirms or denies that a person is your patient is a HIPAA disclosure, even if the reviewer announced it themselves. The patient waiving their own privacy in a review does not waive your obligations.

The framework that works has three moves. Acknowledge: thank the person for the feedback without confirming a relationship ("thank you for sharing this" - you're thanking a reviewer, not a patient). Generalize: state your practice's standard in the abstract ("clear cost estimates in advance of every procedure is something we hold ourselves to") without touching the specific case. Invite offline: give a named contact and a phone line - phone, not email, since PHI over unencrypted email needs the same authorization that's missing in the public thread. Three sentences, no confirmation, no denial, no defense. It reads slightly formal, and that's the correct trade.

Thank you for taking the time to share this feedback. [QUALITY_AT_ISSUE, e.g. "Comfort during procedures" or "Clear communication about treatment options"] is something we hold ourselves to for everyone we see, and we review feedback like this with our clinical team.

If anyone reading this would like to discuss a specific concern about care at [PRACTICE_NAME], please call [CONTACT_NAME], our [ROLE, e.g. "practice manager"], directly at [PHONE] so we can review the details privately.

Thank you for this feedback. Clear, accurate cost estimates in advance of treatment - and clean handling of insurance claims - are standards we work to for everyone who visits [PRACTICE_NAME], and we take billing concerns seriously.

Billing questions involve details we can only discuss privately. Anyone with a concern about a charge or claim can reach [CONTACT_NAME] at [PHONE], and we'll walk through the specifics together.

Thank you so much for the kind words - reviews like this mean a great deal to the whole team at [PRACTICE_NAME]. We work hard to make every visit [QUALITY_PRAISED, e.g. "as comfortable and unhurried as possible"], and it's wonderful to hear when that comes through.

We appreciate you taking the time to share this.

[Note: no "thanks for being a patient," no "see you at your next appointment," no treatment references - a warm reply that still doesn't confirm patient status.]

Thank you for sharing your feedback. Out of respect for privacy, we don't discuss anyone's care or personal health details in a public forum - even details a reviewer has chosen to share - so we won't respond to the specifics here.

What we can say: [GENERAL_STANDARD, e.g. "clear communication about diagnoses and treatment plans"] is a standard we hold for every visit. If you'd like to discuss your experience, please call [CONTACT_NAME] at [PHONE], and we'll give it proper attention privately.

[Do not repeat, quote, or correct any health detail from the review - restating PHI is itself a disclosure.]