A one-star review that names a specific treatment and accuses you of overcharging is one of the more provoking things a practice owner will read. The instinct is to correct the record: explain what actually happened, cite the chart, point out that the patient cancelled twice and refused the radiographs you recommended.
Every sentence of that reply is a potential HIPAA violation. The Office for Civil Rights has settled enforcement actions with dental practices specifically for disclosing patient information in responses to online reviews, including on Yelp. Confirming that someone is your patient is itself a disclosure of protected health information.
Meanwhile, the way a lot of practices try to generate positive reviews has become explicitly unlawful. The FTC's Consumer Reviews and Testimonials Rule took effect on October 21, 2024 and prohibits fake reviews, reviews bought with incentives conditioned on sentiment, undisclosed insider reviews, and using threats to suppress reviews.
This post covers both halves: how to get reviews legitimately, and how to respond without creating a privacy problem. It is educational. Confirm specifics with a healthcare attorney, and check your state dental board's advertising rules, which sometimes regulate testimonials separately.
Key takeaways
- You generally cannot confirm that a reviewer is a patient, discuss their treatment, or correct their account of it in a public reply. Even acknowledging the relationship is a disclosure.
- A HIPAA-safe reply is short, non-specific, apologizes for the experience described without confirming anything, and moves the conversation offline to a named person and phone number.
- The FTC rule (16 CFR Part 465) prohibits creating or buying fake reviews, conditioning incentives on a positive review, undisclosed reviews by employees or family, misrepresenting a site you control as independent, and using unfounded legal threats to suppress reviews.
- You may ask patients for honest reviews, including with a neutral incentive, as long as nothing about the ask signals that the review must be positive. Practically, do not incentivize at all: Google's own policies prohibit offering incentives for reviews regardless of sentiment.
- "Review gating," meaning screening patients for satisfaction first and only routing the happy ones to public review platforms, violates Google's policy and sits uncomfortably close to the FTC's prohibition on selectively soliciting positive sentiment. Ask everyone.
- The most effective review strategy is procedural, not promotional: a consistent, in-person ask at the right moment, by a specific person, with a text message sent while the patient is still in the parking lot.
How the FTC rule limits what you can do
The Consumer Reviews and Testimonials Rule became effective October 21, 2024. Its core prohibitions, in plain language:
| Prohibited | What it looks like in a dental practice |
|---|---|
| Fake or false reviews and testimonials | Writing reviews yourself; buying reviews from a service; posting a testimonial from someone who was never a patient; using AI to generate reviews |
| Buying reviews expressing a particular sentiment | Offering a free whitening, a gift card, or a raffle entry for a five-star review, or any incentive where positive sentiment is a condition, expressly or by implication |
| Undisclosed insider reviews | Your office manager, spouse, or assistant posting a review without disclosing the relationship; the owner reviewing the practice |
| Review suppression through threats | Sending a legal threat you know is unfounded, or intimidating a patient, to get a review removed or changed |
| Misrepresenting a company-controlled review site as independent | Running a "dental reviews" site you own that presents itself as neutral and features your practice |
| Fake indicators of social media influence | Buying followers or engagement for the practice's social accounts |
Violations of a trade regulation rule can carry civil penalties per violation, and the per-violation amount is adjusted for inflation annually. The FTC publishes the current figures; it is high enough that this is not a theoretical risk for a business with a pattern of violations.
The rule reaches your own website too. Testimonials on your site are subject to the same prohibitions as reviews on third-party platforms. If you edited a patient's words, wrote a "composite" testimonial, or posted one from a friend who was never treated, fix it now. Also make sure you have written photo and content consent for any patient whose words or images you use, separate from the FTC question.
What you are allowed to do
The rule does not prohibit asking for reviews. It prohibits conditioning them on sentiment. Google's own contribution policy is stricter on one point: it prohibits merchants from offering incentives such as payment, discounts, or free goods and services in exchange for posting a review, while expressly permitting merchants to solicit or encourage reviews that reflect a genuine experience, without offering incentives and without attempting to influence the rating or the content.
So the safe operating rule is simple and easier than the legal analysis:
Ask every patient, ask the same way, offer nothing, and accept whatever they write.
Review gating, and why to stop
A common vendor feature: text the patient a question like "How was your visit?" with a thumbs up and thumbs down. Thumbs up routes to Google. Thumbs down routes to a private feedback form that never reaches a public platform.
This is review gating. Google's policies treat attempts to influence the rating as prohibited, and platforms have removed reviews and penalized profiles over it. From an FTC standpoint, selectively soliciting only those likely to leave positive reviews is the kind of sentiment-based manipulation the rule targets, and the FTC has previously brought actions involving suppression of negative reviews.
Practical alternative that is both compliant and better: send the same review request to everyone, and separately run an internal feedback mechanism that goes to everyone too. Ask for public reviews from all patients; ask for private feedback from all patients. Do not use one to filter the other.
The mechanics that actually produce reviews
Volume of reviews comes from process, not from cleverness. What works:
| Element | Detail |
|---|---|
| The right moment | At checkout, immediately after a positive interaction, while the patient is still standing there. Not three days later by email |
| A specific person | Assign it. "Everyone asks" means nobody asks. Usually the checkout person or the hygienist who treated them |
| A verbal ask, then a text | The verbal ask creates the commitment; the text removes the friction. Send the text before they leave the parking lot |
| A direct link | Send the Google review link, not "search for us on Google." One tap |
| One platform at a time | Pick your primary platform (usually Google) and send everyone there. Spreading requests across five platforms yields a thin presence on all of them |
| Steady cadence | A handful of reviews every month reads as authentic. Forty in one week reads as a campaign and can trigger platform filtering |
| Track it | Count asks and count reviews received. A conversion rate under about 10% usually means the ask is weak or the link is buried |
A compliant verbal script. "If you have a minute, an honest review on Google really helps other people find us. I can text you the link right now if that is easier." Note what it does not do: it does not ask for five stars, does not mention a reward, and does not screen for satisfaction. Put it in your front desk scripts so it is said the same way every time.
Do not run a staff contest on review counts with prizes tied to positive reviews. Incentivizing staff to generate reviews creates pressure that ends in gating, in staff writing reviews themselves, or in asking only patients who seemed happy. If you want to recognize the team, tie it to the number of asks made, which is the behavior you actually control, and audit it.
What HIPAA stops you from saying in a reply
Protected health information includes the fact that an individual received care from you. That is the part practices get wrong. Consider a reply like:
We are sorry you were unhappy. You were seen on the 14th, you declined the x-rays we recommended, and the crown fee was disclosed in writing before treatment.
That reply discloses that the person is a patient, the date of service, a treatment recommendation, a refusal, and a procedure. Every one of those is PHI. OCR has settled enforcement actions with dental practices over exactly this pattern of disclosure in responses to online reviews.
Things you must not do in a public reply:
Do not, in any public reply
- Confirm or deny that the reviewer is or was a patient
- Reference any date of service, appointment, or visit
- Mention any diagnosis, treatment, recommendation, or refusal of treatment
- Discuss fees, balances, insurance, or payment history
- Reference the chart or quote from it
- Mention that the patient was dismissed, discharged, or asked not to return
- Correct factual errors in the review by supplying clinical detail
- Respond to a family member's review with information about the actual patient
- Use a reviewer's name or initials in a way that identifies them further than they did
A patient posting their own information publicly does not authorize you to discuss it. This is the most common misunderstanding. The patient can say whatever they want about their own care; that is their right and HIPAA does not apply to them. It does not create an authorization for you to disclose. If you want to discuss specifics publicly, you would need a valid written HIPAA authorization from the patient, and there is almost never a good reason to pursue one for a review dispute.
What a safe reply looks like
The template that works in nearly every case has four parts and about four sentences.
- Thank them for the feedback in general terms.
- State a value without confirming anything about them specifically.
- Offer a direct, offline channel with a named person and a phone number.
- Stop.
Response templates
Negative review with clinical or billing specifics:
Thank you for taking the time to share this. Because of patient privacy rules we cannot discuss any individual's care in a public forum, but we take concerns like this seriously and want the chance to understand what happened. Please call our office manager, [Name], at [number], and she will make sure it gets looked into personally.
Negative review about the front office, wait time, or communication:
We are sorry to hear about this experience. A long wait or a confusing conversation is not the standard we hold ourselves to, and we would genuinely like to hear the details. Please reach [Name] at [number] so we can address it directly.
Negative review that may not be from a patient at all (wrong practice, competitor, spam):
We were not able to match this review to any experience at our office. If you have been in our care and something went wrong, please call [Name] at [number] so we can help. If this was intended for a different practice, we would appreciate you letting the platform know.
Note that this does not assert the person is not a patient, which would itself be a disclosure. It says you could not match it, which is a statement about your own records process, and it is worth having counsel review your standard version of this one.
Positive review:
Thank you, we really appreciate you taking the time to write this. It means a lot to the whole team.
Do not add "we are so glad your implant is healing well." A thank-you that confirms treatment is still a disclosure. Keep positive replies short and content-free.
Your internal review response process
Review response workflow
- One named person monitors reviews on Google and any other platform you care about, at least weekly
- Negative reviews are routed to the owner or office manager within 24 hours, not published-to and forgotten
- All public replies are drafted from approved templates; anything outside a template gets owner approval
- No clinical staff member replies from a personal account
- When a patient is identified internally, the chart gets a note that a complaint was received and how it was handled (document the service recovery, not the public exchange)
- If the review alleges a clinical injury or a potential claim, notify your malpractice carrier before responding publicly. See malpractice insurance for dentists
- If the review suggests a possible privacy breach on your end, run your breach assessment process. See HIPAA breach response
- Keep a log of reviews received, replies posted, and outcomes, so patterns are visible
Getting a review removed
Platforms will remove reviews that violate their policies, and a review can qualify for removal without being untrue. Legitimate grounds usually include: it is not about an actual experience with your business, it names an employee in a way that violates policy, it contains profanity or hate speech, it is spam, it is from a competitor with a conflict of interest, or it was posted for the wrong business.
What does not work: reporting a review because it is unfair, or because you disagree with the patient's characterization. Platforms do not adjudicate accuracy.
Flag it through the platform's process, document the policy ground you are relying on, and be patient. If it is genuinely defamatory and causing real harm, that is a conversation with an attorney, not a self-help project.
Do not send a threatening letter. The FTC rule specifically prohibits using unfounded legal threats or intimidation to get a review removed or altered, and a demand letter to an unhappy patient has an extraordinary tendency to become a screenshot on social media. It also may be characterized as retaliation. If you believe you have a genuine defamation claim, have counsel evaluate it and handle it. Never send it yourself in anger.
Never tie care to reviews
Do not dismiss a patient, withhold care, refuse to release records, add fees, or send a balance to collections because of a review. Beyond the obvious ethical problem, it can be characterized as retaliation, may implicate the FTC rule's suppression provisions, and may raise issues under your state board's rules and under the HIPAA right of access, which entitles patients to their records regardless of any dispute. Records requests get honored. See dental records retention.
Similarly, do not use a non-disparagement clause in patient paperwork to prevent negative reviews. Federal law protecting consumers' ability to post honest reviews restricts form-contract provisions that bar or penalize reviews, and the FTC has pursued businesses over them. If your patient forms contain one, have counsel remove it.
What reviews are actually worth
Hypothetical example. Illustrative numbers only.
Suppose a practice sits at 3.9 stars with 46 reviews, while two nearby practices sit at 4.7 and 4.8 with over 200 each. The practice receives about 1,000 profile views a month and converts about 2% into calls, roughly 20 calls.
Suppose a consistent ask process produces 12 to 15 new reviews a month for a year, moving the practice to 4.6 stars with roughly 200 reviews, and profile conversion rises from 2% to 3%. That is 30 calls instead of 20. At a 60% booking rate, about six additional new patients a month, or 72 a year.
If the practice's first-year value per new patient is, say, $700, that is roughly $50,000 of additional production from a process change that costs nothing but consistency at the checkout desk. Whether your numbers behave this way depends on your market and your conversion rate, so measure your own. See the KPIs worth tracking and how much to spend on marketing.
The point of the example is the priority ordering: for most practices, a review process is a higher-return project than additional advertising spend, because it improves the conversion of traffic you already have.
Where reviews fit alongside everything else
Reviews are one input to local search visibility and a large input to whether someone who already found you decides to call. They work with your Google Business Profile and your website, not instead of them. A profile with 200 reviews pointing at a site that takes eight seconds to load on a phone wastes the reviews.
It is also worth saying plainly: the durable way to get good reviews is to run a practice patients like. Wait times, clear cost conversations, and a front desk that handles problems well generate more reviews than any request system. See scheduling strategy, giving accurate treatment estimates, and case presentation. Several of the most common negative-review themes in dentistry are about surprise bills and waiting, both of which are operational problems with operational fixes.
The short version
Ask every patient for an honest review, the same way, in person at checkout, followed by a text with a direct link. Offer nothing. Do not screen anyone out. Assign one person to own it and count the asks.
When a bad review arrives, reply within a day using a template that confirms nothing, apologizes for the experience described, and names a person and a phone number. Never discuss care, dates, fees, or the chart in public. Route anything that smells like a claim to your carrier before you post.
Audit two things this week: any incentive or gating feature in your review request tool, and any testimonial on your own website you cannot document. Both are cheap to fix now and expensive to explain later.
Confirm your specific obligations with a healthcare attorney, and check your state dental board's advertising and testimonial rules, which vary and sometimes add requirements beyond federal law.
Related reading on ChairsideSource: Google Business Profile for dentists, what a dental practice website actually needs, front desk scripts, and the compliance chapter.
Educational content only. It is not legal, financial, tax, or clinical advice. Prices and ranges are approximate and vary by region, condition, and year. Verify current rules with your state dental board and qualified professionals. ChairsideSource is not affiliated with any manufacturer, the ADA, or the DAT.