How to Respond to Google Reviews as a Medical Practice

A one-star review lands on a Friday afternoon. It's unfair, it's specific, and it's wrong about something you can prove in thirty seconds. Every instinct says correct it, and there's a box sitting right underneath inviting you to.

Here's the reframe that makes everything after it straightforward. That box is a public communication from a covered entity, about a person, concerning their care. Your practice is under the same obligations there as it is in an email or a phone call. The interface being a review site changes nothing about what you're allowed to say.

Confirming they were a patient is already the disclosure

What people miss is how early the line sits. Most practices assume they're safe right up until they mention a diagnosis or a procedure. The protected fact starts well before that, at the moment you confirm this person received care from you at all.

So a reply opening with, we're sorry your visit didn't meet expectations, has already done it. So has, our records show you were seen on the fourteenth. So has thanking somebody for choosing your practice under a review posted with a first initial and no surname. The reviewer is free to tell the world they were your patient. Your confirmation is a separate act, and that one is yours.

What OCR has actually penalized

This isn't a theoretical risk anybody is inflating to sell you a service. The enforcement has been running for years and the fact patterns are ordinary.

• In 2019 a Texas dental practice paid $10,000 after disclosing patient information in a response on a review site.
• In 2022 a California dental practice paid $23,000. Among the findings: it had used patients' full names in replies where the patients themselves had posted under nicknames, and had added detail about visits and insurance that the reviews never mentioned.
• Also in 2022, a North Carolina practice with two locations drew a $50,000 civil monetary penalty over information disclosed in a response to a Google review.
• A separate action carried a $30,000 penalty, where the information disclosed across four patients concerned the diagnosis and treatment of mental health conditions.

The amounts are not the useful part. The pattern is. In every one of these the practice was answering criticism it considered unfair, and the correction it wanted to make was the violation. Dental practices are over-represented here, partly because dentistry collects more reviews than most of medicine does, which is also why SEO for a dental practice leans on the review field so heavily.

The patient posting their own details changes nothing

Of everything on this page, this is the point practices get wrong most often, and it's worth saying flatly. A patient who publishes a detailed account of their own surgery, their own diagnosis and their own bill has waived nothing on your behalf.

Their privacy is theirs to give up. Your obligation is a separate duty sitting on your practice, and no act of theirs lifts it. OCR has been consistent on this point: your response has to comply regardless of what the patient chose to publish first.

Which produces the situation that feels most unjust in all of this. A review can contain twelve accurate clinical details and you may not confirm, deny or discuss a single one of them in public. That asymmetry is the rule working exactly as designed, and arguing with it in a reply box is how every penalty above happened.

The reply that holds up every time

There's a structure you can apply without thinking, which matters, because these get written at the end of a bad day by somebody who is annoyed.

• Acknowledge in general terms. We take feedback about our care seriously.
• Say nothing that confirms a visit, a treatment, a date or a relationship.
• Give exactly one route offline. A named role, a phone number, an invitation to call.
• Sign as the practice or a role rather than a provider by name.
• Stop there. The urge to add one clarifying sentence is where all of these go wrong.

Something close to: we take all feedback seriously and would like the chance to understand this properly, so please contact our practice manager on the number listed and we'll look into it. That reply is publishable under any review, from anybody, including someone who was never a patient at all.

That last point gets underrated. A reply disclosing nothing still works when you genuinely can't tell whether the reviewer is a patient, a competitor, or a person who has confused you with the practice upstairs.

When the review is factually wrong

There's a narrow band you can address, and knowing where it stops is most of the skill.

General policy and process are fair game as long as no person is attached. Billing statements are issued after insurance responds. Published hours are on the profile. Follow-ups get scheduled at the time of the appointment. None of that confirms anybody's care.

The specifics stay off limits however wrong they are, and that covers wait times, what was said in the room, whether a procedure was necessary, and anything at all about a bill. Every one of those attaches to a person the moment you write it.

Where a review crosses from negative into defamatory, that's a conversation with your own counsel about the platform and the poster. It isn't a conversation to hold in the reply box, and what you post in the meantime should be the safe reply above.

Removal is worth trying and usually fails

Google removes reviews that breach its policies: no genuine experience of the business, conflicts of interest, spam, harassment, off-topic content. Those grounds are real, and reporting on them costs you nothing but the time.

What is not grounds is that the review is unfair, overstated, or written by somebody who ignored their aftercare instructions. Most of the negative reviews a practice wants gone sit in that second group, so plan for the reply to be your actual remedy. A patient reading your profile in six months sees how you handled it, and that part stays in your control.

Positive reviews carry the same rule

It's easy to relax under five stars and thank somebody warmly for trusting you with their procedure. Naming the procedure confirms it happened.

Keep the good ones short and generic. Thank you, we appreciate you taking the time to write. The detail you'd like attached to that review belongs inside the review itself, which comes down to how you ask patients for it in the first place.

Decide who holds the pen

Most breaches of this kind were never decisions. A provider sees the review on their phone between patients and answers it in ninety seconds.

Write the rule down and hand it to one person. A single named owner replies to everything, with a second read on anything negative before it posts, and providers route reviews to that person rather than answering directly.

If an agency or a patient communication vendor replies for you, they're handling protected information on your behalf, and that deserves a considered arrangement rather than a checkbox in an onboarding form. It belongs on the list of things worth asking before you hire anybody, next to who actually writes your clinical content.

The replies already sitting under your profile

Every practice I audit has years of replies posted by people who have since left, or by an agency nobody briefed properly. They're public, they're indexed, and nobody has read them since the day they went up.

So that's the check I'd run first here. I read back through the replies published under your Google profile and your other listings, flag any that confirm treatment or identify a patient, and tell you which to edit or delete and in what order. It comes back inside 24 to 48 hours at no cost. Most practices come out of it fine with two or three to tidy. The ones that don't are usually glad they found out this way rather than the other way.

Written by Ashikur Rahman

Founder of Proximity Ranker, with nine years in SEO and a law background that shapes the medical and legal work we do. Meet the founder.

Back to the blog