DentistDiscoverable field guide
Replying to Dental Reviews Without Violating HIPAA: The One-Line Test
A dental practice gets a one-star review, replies to defend itself, and writes that the patient missed three appointments and declined the treatment plan. The reply is honest, specific, and a HIPAA violation. The reviewer is a patient, the practice confirmed it in public, and the confirmation is the violation. New Vision Dental learned the price in 2022: a 50,000 dollar civil money penalty for a reply written in 2015.
The rule is one line long. Say nothing that is only true if the reviewer were a patient. Everything else is safe. Everything that fails the test is a violation, even when the reviewer posted first.
The replies that cost practices money
New Vision Dental's 50,000 dollar penalty came from a reply that disclosed protected health information about a patient who had left a review. Elite Dental Associates settled with the Office for Civil Rights in 2019 for a similar reply. The settlements in this category run 10,000, 23,000, and 50,000 dollars, and they all start the same way: a practice replies to a review as if the review were a private conversation, and the public reply confirms the reviewer was a patient.
A 2026 study of 80,300 review replies found that 26.3 percent disclosed or confirmed patient information. The most common disclosure was not a diagnosis. It was the confirmation itself: thanking the reviewer for coming in, referencing the visit, or disputing the reviewer's account of what happened at the appointment. Any of those confirms the reviewer was a patient, and that confirmation is protected health information.
The one-line test, applied
Read the reply and ask whether every sentence in it would still be true if the reviewer had never set foot in the practice. Thank you for your feedback is true either way. We take patient concerns seriously is true either way. We are sorry you had a bad experience at your cleaning last Tuesday is only true if the reviewer was a patient, and it fails the test.
The safe reply is short, warm, and generic, and it moves the conversation offline. Thank you for sharing your feedback. We take all feedback seriously and would welcome the chance to discuss your experience. Please contact our office directly. That reply says nothing about the reviewer, confirms nothing, and gives the practice a private channel to resolve the complaint. The American Dental Association's guidance says the same thing in longer words: professional, prompt, and private.
The workflow that prevents the violation
The violation usually happens because the reply is written by the person who took the review personally, often the dentist or the office manager, in the moment, without a second reader. The fix is a workflow, not a training session: every reply is drafted by one person, reviewed by a second, and checked against the one-line test before it is posted. No reply goes live the same day the review arrives.
Keep a file of approved replies for the common cases: a one-star review with no detail, a complaint about wait time, a complaint about cost, a positive review. The approved reply is the safe reply, and the team uses it instead of writing from scratch. The practice that replies from a template never confirms a patient in public, because the template was written to say nothing that is only true if the reviewer were a patient.
Keep reading: The Website Link on Your Dental Profile Points at the Wrong Page, Dental Review Velocity: How Fast Is Too Fast After a Review Push, The Dentist's GBP Q&A Is Gone: What to Do With the Questions Patients Still Ask cover the nearby cases in this series.
Frequently asked questions
Can a dentist confirm a reviewer was a patient in a reply?
No. Confirming the reviewer was a patient discloses protected health information, even when the reviewer posted first. New Vision Dental paid a 50,000 dollar civil money penalty in 2022 for a reply that did exactly that.
What is the one-line test for a HIPAA-safe review reply?
Say nothing that is only true if the reviewer were a patient. If every sentence in the reply would still be true if the reviewer had never visited the practice, the reply is safe. If any sentence depends on the reviewer being a patient, it fails.
What should a dental practice reply to a negative review?
A short, warm, generic reply that moves the conversation offline: thank you for sharing your feedback, we take all feedback seriously, please contact our office directly. It confirms nothing, disputes nothing, and gives the practice a private channel.
How common are HIPAA violations in review replies?
A 2026 study of 80,300 review replies found 26.3 percent disclosed or confirmed patient information, usually by thanking the reviewer for coming in or referencing the visit. The fix is a two-person review workflow and a file of approved replies.