A patient leaves a one-star review. They say your clinic "never listened" and their shoulder is no better. You know the rest of the story: four missed appointments and a home program they never started. The urge to set the record straight is strong.
That reply is how healthcare practices end up paying HIPAA settlements over reviews. Asking patients for reviews is not.
Asking for a review is not the problem
You can ask your patients to review you on Google. The two review-related HIPAA settlements below were both about what a practice wrote in its replies, not about asking.
Where practices get into trouble is in three places: how they reply, what they offer in exchange, and which patients they choose to ask. Each one has a clear rule, and none of them is hard to follow once you know it.
One habit to build from the start: keep the request itself generic. "Thanks for choosing [Clinic Name]. Would you share your experience on Google?" is safe to send to anyone. "Hope your knee is recovering well after surgery!" mentions a condition in a message that may be read by someone other than the patient. Leave treatment out of it.
Replies are where practices get fined
The Department of Health and Human Services' Office for Civil Rights, which enforces HIPAA, has settled with practices over exactly this.
In 2023, Manasa Health Center, a New Jersey mental health provider, paid $30,000 after replying to negative online reviews with details about patients' diagnoses and treatment. The investigation found improper disclosures involving four patients. The OCR director put it plainly: "Simply put, this is not allowed."
In 2022, New Vision Dental in California paid $23,000 after its replies to patient reviews included patient names, treatment details and insurance information. Announcing it, the OCR director wrote: "This is a clear NO."
Neither practice set out to harm anyone. They were defending themselves against reviews they felt were unfair, which is exactly the situation you'll be in sooner or later.
The reply on the left confirms the reviewer is a patient. The one on the right doesn't.
What a safe reply looks like
The safest reply doesn't confirm the reviewer is a patient at all. No mention of their visit, their condition, their therapist or their schedule, even to say something kind.
For a positive review:
Thank you for taking the time to share this. We're glad you had a good experience with our team.
For a negative review:
We take every concern seriously, and we'd like to understand what happened. Please call our office manager at [phone number] so we can talk directly.
Notice what's missing from the negative reply. No "our records show," no "you missed several appointments," no "we're sorry your recovery has been slow." Each of those confirms the person is a patient and says something about their care.
The reply isn't really written for the reviewer. It's written for the next person reading your profile, and a calm, short answer that invites a conversation reads better than a rebuttal anyway.
Don't offer anything in exchange for a review
This is where well-meaning practices slip. A raffle entry for everyone who leaves a review, a discount on their next session or a small gift card all feel harmless.
Google's policy for reviews says businesses must not "offer incentives – such as payment, discounts, free goods and/or services - in exchange for posting any review." Note the word any. It doesn't matter whether you ask for a positive review or an honest one. If something is offered for posting, it breaks Google's rules.
The Federal Trade Commission's guidance for businesses adds a second layer: if you do offer an incentive, you can't condition it, "explicitly or implicitly, on the review being positive."
Since Google already prohibits incentives for reviews posted on Google, the simplest policy is the best one: offer nothing. Just ask.
Ask every patient, not just the happy ones
Many review tools offer a feature that screens patients first. A text asks, "How was your visit?" Patients who tap five stars get sent to Google. Everyone else lands on a private feedback form. This is often called review gating, and both Google and the FTC say not to do it.
Google lists "selectively solicit positive reviews from customers" as rating manipulation. The FTC says the same thing for businesses: "Don't ask for reviews only from customers you think will leave positive ones."
Google's policy also lists asking staff to collect "a certain number of reviews," or reviews "that include specific content," as manipulation. So skip the front-desk review quotas, and never suggest what a patient should write.
It's worth checking how your current review requests work. If anything sits between "How was your visit?" and the Google review form, it may be filtering patients without you realizing it.
Putting reviews on your own website
Showing reviews on your website is a gray area, and it helps to separate two things.
Testimonials your practice publishes itself have a physical therapy case behind them. In 2016, Complete P.T., Pool & Land Physical Therapy, a practice in the Los Angeles area, paid $25,000 after posting patient testimonials on its website, with full names and face photos, without valid HIPAA authorizations. The OCR director said practices need a valid authorization form for this, "including for posting on a website and/or social media pages." If you collect a testimonial and put it on your site, get a signed HIPAA authorization first. An email saying "sure, go ahead" isn't the same thing.
Reviews patients posted on Google haven't been ruled on. HHS hasn't said whether embedding or copying them needs an authorization. A widget that shows your Google reviews as Google displays them is the lower-risk option, since it shows what patients chose to post publicly, as they posted it. Hand-picking reviews and republishing them as testimonials on your own pages is closer to the Complete P.T. situation, so the cautious approach is the same signed authorization. If you want a firm answer for your practice, this is a good question for a healthcare attorney.
Some state physical therapy boards also have their own rules about testimonials in advertising. Those vary by state, so check yours.
A simple, compliant way to ask
Put the pieces together and the process is short:
- Ask every patient at the same point. Discharge is a natural moment, or after a set number of visits. Same timing, every patient, no screening.
- Send them straight to Google. Your Google Business Profile can give you a link that opens the review form directly. Use that link, not a survey in front of it.
- Keep the message generic. Thank them for choosing your clinic and ask them to share their experience. No condition, no treatment details.
- Offer nothing for it. No discounts, raffles or gift cards.
- Reply without confirming anything. Thank positive reviewers in general terms. Invite negative reviewers to call. Never reference their care.
A review request that mentions no condition, offers nothing and goes straight to Google.
How many reviews you need depends on the clinics around you. We covered that in How Many Google Reviews Do You Actually Need to Outrank the Clinic Down the Street? The point here is that the number only helps if the way you get there doesn't put the practice at risk.
This article explains general rules and public enforcement cases. It isn't legal advice. If you have a specific situation, such as a review you're unsure how to answer, talk to a healthcare attorney.
Want a second set of eyes on your reviews?
I'll look up your practice's Google profile, check how review requests reach your patients, and flag any existing replies that confirm someone is a patient. You'll get a plain-English summary of what I find.
No pitch, no obligation. Request a free practice review.