Healthcare reputation management: a practical, HIPAA-safe guide

What is healthcare reputation management?

Healthcare reputation management is the ongoing work of shaping what prospective patients find when they search for your practice or your providers. In practice it comes down to a steady flow of honest reviews, accurate listings on the sites patients check, and calm, privacy-safe replies to what patients write about you.

It is not about hiding criticism. Federal rules push the other way. The FTC's rule on fake reviews and testimonials bans fake reviews, buying reviews conditioned on a positive or negative sentiment, and using groundless legal threats or intimidation to get a negative review taken down. The Consumer Review Fairness Act also makes it illegal to put clauses in form contracts, such as new-patient paperwork, that bar or penalize honest reviews.

So the honest version of the job is simple: earn reviews, ask for them fairly, and respond well.

Reputation management for medical practices: where patients leave reviews

Patients do not only look at Google. Depending on your specialty, they may check several sites before booking. These are the ones worth claiming and keeping current:

You do not need to push patients to all six. Pick the one or two that matter most for your specialty and town (Google is usually one of them) and focus requests there. A full list of review sites can help you decide.

HIPAA rules for responding to patient reviews

HIPAA does not stop you from replying to reviews, but it does stop you from disclosing protected health information (PHI) in the reply. That includes confirming the reviewer was your patient, mentioning their visit, diagnosis, treatment or bill, or "correcting" their story with details from their chart. Patients can share their own story. You cannot add to it.

The reason is the definition itself. According to the HHS summary of the HIPAA Privacy Rule, PHI covers information that relates to a person's health condition, the provision of health care to them, or payment for that care, and that identifies them. A public reply that ties a named reviewer to care at your practice can fit that description.

HHS's Office for Civil Rights (OCR) has enforced this several times:

• Elite Dental Associates (Dallas, 2019): paid $10,000 and adopted a corrective action plan. HHS later described the case as disclosing the PHI of multiple patients in response to reviews on the practice's Yelp page.
• Dr. U. Phillip Igbinadolor, D.M.D. & Associates (North Carolina, 2022): disclosed a patient's PHI on a webpage in response to a negative online review. OCR imposed a $50,000 civil money penalty after the practice did not respond to OCR.
• New Vision Dental (California, 2022): paid $23,000 and agreed to a corrective action plan over disclosing PHI in response to online reviews. HHS called the practice "illegal under HIPAA."
• Manasa Health Center (New Jersey, 2023): a psychiatric practice that paid $30,000 and agreed to a corrective action plan after disclosing PHI in replies to negative online reviews.

Notice that most of these are small practices, not hospital systems. Size does not protect you.

Medical reputation management: HIPAA-safe reply templates

A safe reply is short, polite, speaks in general terms about your policies, and invites the person to contact the office privately. Google's own Business Profile tips also recommend keeping replies short, professional and personal, and protecting the reviewer's privacy.

Positive review

Thank you for taking the time to share this. Our team works hard to make every visit easy, and we appreciate the kind words.

Do not write "We're glad your knee is healing" or "Thanks for coming in, Maria." Both confirm a patient relationship.

Negative review

We're sorry to read this. We take every concern seriously, but privacy laws prevent us from discussing anyone's care online. Please call our practice manager at [office phone] so we can listen and help.

Review with factual errors (billing, wait times)

We understand how frustrating billing questions can be. Our office reviews every billing concern individually. Please contact our billing office at [phone] so we can look into this privately.

Two rules for the whole team: only trained staff post replies, and nobody replies while upset. Write down a simple review response policy. In the Manasa case, the potential violations HHS listed included a failure to implement policies and procedures for protected health information, not only the replies themselves.

For more reply wording, see our guides on how to respond to negative reviews and how to respond to Google reviews. Use them with the HIPAA limits above.

How to get more patient reviews (without breaking the rules)

The most reliable way to get more patient reviews is to ask every patient, the same way, soon after their visit, with a direct link to the review page. A short, consistent request makes it easy for patients who had a good visit to say so, without pressuring anyone.

Three rules to follow:

• Ask everyone, not just happy patients. Google's prohibited content policy says businesses may not discourage negative reviews or selectively solicit positive ones. This is called review gating.
• No incentives. Google prohibits offering payment, discounts or free services for reviews. A free whitening session or gift card for a review is out.
• No pressure in the office. The same Google policy says businesses should not require or pressure people to leave reviews while on the premises.

Google gives every business a review link and QR code. Its help page suggests putting it on receipts, in thank-you emails, and on a printed QR code in your office.

Keep the request itself free of clinical details. "Thanks for visiting Lakeside Family Medicine" is fine. "Thanks for coming in for your colonoscopy" is not. If you use an outside tool to send requests, talk to your compliance lead about whether that vendor needs a business associate agreement before you upload a patient list.

A note on Yelp: Yelp's own support guidance tells businesses not to ask anyone for reviews, and says its software may not recommend reviews that seem to have been requested. Point requests to Google or a medical review site instead.

Reputation management for doctors: a simple weekly plan

Reputation management for doctors does not need a big budget. A weekly routine covers most of it:

The last row matters most. Reviews are free operational feedback. If several patients mention hold times, the fix is in the phone system, not the reply box.

Where ReviewUsToday fits

ReviewUsToday handles one part of medical reputation management: asking. It emails each patient you upload a one-tap rating request from your practice's name, sends up to two reminders to people who have not rated, and directs 4 and 5 star ratings to the review sites you choose, including Google, Healthgrades, Zocdoc, WebMD, Vitals and RateMDs. Patients who pick 1 to 3 stars get a private feedback form that emails you right away, and they still see the public review links, so nobody is gated.

It does not monitor review sites, reply to reviews or remove reviews. You still own the replies, and the HIPAA rules above still apply. See how automated review request software works.

Frequently asked questions