How to Respond to Google Reviews for Dental Practices (Without a HIPAA Problem)

Most review reply advice works fine for a plumber or a restaurant. For a dental practice, some of it will get your client fined.

Dental practices are covered by HIPAA, and the federal privacy rules apply to review replies the same way they apply to a patient's chart. A reply that feels friendly and specific can be a federal privacy violation.

If you manage Google reviews for dental clients, this is the one thing to get right.

This has actually been enforced

It's easy to assume this is theoretical. It isn't.

The HHS Office for Civil Rights has taken action against several dental practices over review replies specifically:

• A Dallas practice settled for $10,000 in 2019 after disclosing patient information while responding to Yelp reviews.
• A North Carolina practice was hit with a $50,000 civil penalty in 2022 after responding to a negative Google review with patient-identifying information.
• A California practice settled for $23,000 in 2022. Its replies had included patients' full names, visit details, and insurance information that the patients hadn't mentioned themselves.

The OCR's director put it plainly after that last case: providers cannot disclose protected health information of their patients when responding to negative online reviews.

These are small practices, the kind your clients probably are. Size didn't protect them.

The rule that trips people up

Here's the part most people get wrong. Your reply can't confirm the reviewer is a patient, even if they already said so.

If someone writes "I've been coming here for three years and my cleaning today was rushed," it feels natural to reply as though you know them. But the reviewer disclosing their own information is not the same as the practice disclosing it. The practice's reply is a separate disclosure, and it's the practice's obligation.

So a reply can't mention:

• That the person is or was a patient
• Any treatment, procedure, or visit
• Appointment history, including missed appointments
• Insurance, billing, or payment details
• Anything from their records

That rules out most of what makes a reply feel personal. Which is the point.

Why AI drafting makes this worse

This is the risk nobody talks about.

Most AI reply tools work by reading the review and writing something that responds to it. That usually means echoing details back. A review that says "my root canal was painful" can easily produce a draft that says "we're sorry your root canal was uncomfortable." That sentence confirms the person is a patient and names their treatment.

It reads as empathetic. It's also exactly the kind of disclosure OCR has penalized.

If you use AI to draft replies for dental clients, read every single one before it posts, specifically checking for anything that restates what the patient wrote. Don't let dental replies auto-publish.

Positive reviews: what's safe

Keep it about the practice, not the person.

Risky:

Thanks so much, Sarah! We're thrilled your new crown turned out great and that the numbing worked better this time.

Names the treatment, references a previous visit, confirms she's a patient.

Safe:

Thank you for the kind words. Our whole team works hard to make every visit comfortable, and it means a lot to hear that.

Speaks about "every visit" in general. Warm, and says nothing about this person.

Positive replies are low risk if you stay general, and they're the bulk of your volume, so this pattern covers most of the work.

Negative reviews: where the real risk is

Negative reviews are where practices get into trouble, because the instinct is to explain or defend. And explaining almost always means referencing the patient's visit.

Risky:

We're sorry you're unhappy, but our records show you missed two appointments and your insurance didn't cover the procedure you requested.

This is close to what the California practice actually did. It confirms a patient relationship, discloses appointment history, and reveals insurance details.

Safe:

Thank you for sharing this. We take all feedback seriously and would like the chance to understand what happened. Please call our office manager directly at [number] so we can talk it through.

Doesn't confirm anything, doesn't dispute anything, moves the conversation somewhere private. That's the whole job of a negative reply for a dental practice.

For how to handle negative reviews more generally, see our guide to responding to negative reviews.

The three topics that cause the most trouble

Billing and insurance. The most common dental complaint and the most tempting to explain, because the practice often feels it was in the right. Always take these offline. There is no safe public way to discuss someone's bill.

Pain and discomfort. Replying to "it hurt" with anything about the procedure confirms treatment. Speak about the practice's general approach to comfort instead, then invite a call.

Complaints about a specific dentist or hygienist. Don't discuss what happened in the chair. Acknowledge the feedback and move it to a private conversation.

Setting this up for each dental client

In the voice note you keep for each client, add a clear line for dental practices: No confirming patient status, no treatment, no appointments, no billing. Negative reviews go to the practice before posting.

Two more habits worth keeping.

Don't collect patient details. You don't need them to write a safe reply, and having them only creates risk. If a practice ever wants to share patient information with you so you can respond, that's a question for their compliance contact, not something to accept by default.

Get approval on anything negative. The practice knows context you don't, and they're the ones legally responsible for what gets published.

This is one piece of a broader workflow for managing reviews across many clients, covered in how to manage Google reviews for multiple clients.

Frequently asked

Can a dental practice reply to Google reviews at all? Yes. Replying is fine. The rule is that the reply can't disclose protected health information, including confirming the reviewer is a patient.

What if the patient already mentioned their treatment in the review? The reply still can't reference it. The patient's own disclosure doesn't give the practice permission to disclose the same information.

Is a simple "thank you" safe? Generally, yes, as long as it doesn't reference the person's visit or treatment. Keep it about the practice.

Should dental replies be automated? No. Drafting with AI can save time, but every reply for a healthcare client should be read before it posts, specifically checking that it doesn't restate anything from the review.

Does this apply to other healthcare clients? Yes. Medical practices, chiropractors, physical therapists, and mental health providers are generally covered too. One of OCR's enforcement actions involved a psychiatric practice replying to Google reviews.

This is general guidance, not legal advice. Practices with specific questions should check with their own compliance or legal contact.