Reputation Management for Dentists: HIPAA-Safe Review Responses, Profiles That Convert, and What to Do About the One-Star Rant
Reputation management for dentists is review management with a legal constraint on top. The HIPAA Privacy Rule treats the fact that someone is your patient as protected health information, so a public reply that confirms a visit, a procedure, a bill or an insurance detail is an impermissible disclosure, even when the reviewer posted those details first. The Office for Civil Rights has settled with dental practices over exactly this, for $10,000 in 2019 and $23,000 in 2022, and has said plainly that disclosing patient information in response to negative reviews “is not allowed.” Working within that rule, a dental practice has four jobs: keep its Google Business Profile, Healthgrades and Zocdoc listings complete and consistent; ask every patient for a review in a way that complies with Google’s policy and the FTC’s rule on reviews; answer every review with a short, generic reply that invites the person to call; and build the local coverage and owned content that make one angry review a small part of what a prospective patient sees. Removal is possible only when a review breaks a platform rule, and legal action is almost never worth it.
Key takeaways
- HIPAA bars confirming that a reviewer is a patient. The ADA’s 2025 guidance: “Don’t acknowledge that a reviewer was a patient,” positive or negative.
- OCR has enforced this against dentists: Elite Dental Associates paid $10,000 in 2019 and New Vision Dental paid $23,000 in 2022, each with a corrective action plan, over review replies that disclosed PHI.
- An ADA survey found 39 percent of dentists said HIPAA prevented them from responding to reviews. A safe template solves that without silence.
- Google allows review requests but prohibits incentives, selective solicitation and discouraging negative reviews; the FTC’s 2024 rule bans buying reviews and suppressing them with baseless threats.
- Zocdoc posts only reviews from patients who booked and attended through Zocdoc, and Healthgrades flags only guideline violations, so each platform needs its own approach.
What does HIPAA allow a dentist to say in a review response?
Less than most practices assume, and the boundary is the fact of the relationship, not the clinical detail. The HHS summary of the HIPAA Privacy Rule defines protected health information as individually identifiable information, “including demographic data,” that relates to a person’s health, “the provision of health care to the individual,” or payment for that care, when it identifies the person or gives “a reasonable basis to believe it can be used to identify the individual.” A reply that says “we’re sorry your crown appointment ran late” identifies the reviewer as a patient and describes care. That is PHI, and the Privacy Rule’s default is that a covered entity “may not use or disclose protected health information” except as the Rule permits or the patient authorizes in writing. Responding to a review is not a permitted purpose.
The patient’s own disclosure does not change this. Shane Ricci, D.D.S., chair of the ADA Council on Dental Practice, told ADA News in March 2025 that even if a patient publicly shares treatment details, “health care providers cannot acknowledge or respond in a way that reveals any identifiable information about them.” The ADA’s five practices are short enough to post by the front desk:
- Keep it simple, keep it anonymous: “Don’t acknowledge that a reviewer was a patient.”
- Never reference a specific person or incident.
- Take complaints offline: respond in general terms and invite a call.
- Remain professional, prompt and private.
- Treat legal action as a last resort; the ADA says it “is generally not recommended.”
This is general information, not legal advice; your HIPAA privacy officer or healthcare counsel should approve the templates you use. The constraint is real but workable, and it is the same one lawyers face with client confidentiality, as covered in reputation management for lawyers.
What has OCR actually done to dental practices over reviews?
The enforcement record is specific to dentistry, which is unusual for HIPAA. Three cases set the pattern.
| Practice | What happened | Outcome | Source |
|---|---|---|---|
| Elite Dental Associates, Dallas (2019) | Social media disclosures of patients’ PHI in response to reviews | $10,000 settlement and a corrective action plan | HHS resolution agreement page, October 2, 2019 |
| New Vision Dental, California (2022) | Owner’s Yelp replies revealed full names of patients who had posted under a moniker, plus visit, treatment and insurance details the patients had not made public; practice also lacked social media PHI policies | $23,000 settlement, corrective action plan, two years of OCR monitoring | HHS, December 14, 2022; details via HIPAA Journal |
| Manasa Health Center, New Jersey (2023, psychiatry) | Replies to negative reviews disclosed four patients’ PHI, including one patient’s diagnosis and treatment | $30,000 settlement, two-year corrective action plan | HHS press release, June 2023 |
The HHS page on New Vision Dental states the rule in one line: using social media to respond to reviews in a way that discloses PHI “is illegal under HIPAA.” In the Manasa announcement, OCR Director Melanie Fontes Rainer said: “OCR continues to receive complaints about health care providers disclosing their patients’ protected health information on social media or on the internet in response to negative reviews. Simply put, this is not allowed,” adding that OCR “will investigate and take action when we learn of such impermissible disclosures, no matter how large or small the organization.”
Two details matter for a practice owner. In New Vision, OCR also cited the absence of policies on releasing PHI on social media, so the fix is a written policy and training, not just restraint. And these cases began with a patient complaint, which means the person you argued with online is the person who can start the investigation.
Which profiles matter for a dental practice, and how do you manage each?
Patients compare dentists on three surfaces, and each has its own review rules.
Google Business Profile
The profile that shows in Maps and in the local pack is where most patients decide. Google’s contributed content policy permits asking for reviews “without offering incentives to do so or attempting to influence the rating or the contents of the review,” prohibits reviews from a conflict of interest such as “current or former employment,” and bars merchants from any attempt to “discourage or prohibit negative reviews, or selectively solicit positive reviews.” Replies are published after a policy check that Google says usually takes about 10 minutes but can take up to 30 days, per its reply guidance. Reviews that break policy are reported through the profile or the Reviews Management Tool; Google says “Review evaluation typically takes several days,” and offers a one-time appeal, as described on its reporting page. The full policy map is in our Google review removal guide.
Healthgrades
Healthgrades’ review guidelines allow reviews from anyone who, or whose family member, has had contact with the practice, and prohibit libelous, harassing or inflammatory content, obscenity, misleading or fraudulent content, personal information and impersonation. Anyone who suspects a violation can flag it, and the site “may reject or remove” content at its discretion. Negativity is not a violation. Claim the provider profile so that the practice details, photos and insurance lists are current; a stale Healthgrades listing with an old address is a common, avoidable loss.
Zocdoc
Zocdoc’s model is different: per its verified reviews page, reviews come only from patients who booked an appointment the provider marked as attended, feedback is accepted “up to 120 days after your appointment date,” every review is moderated by a person, and providers are “prohibited from unduly influencing reviews” or retaliating. Zocdoc removes reviews only for guideline violations and says “mere suspicion usually isn’t enough for removal.” The practical upshot: your Zocdoc rating is a near-pure measure of attended visits, so the lever is the experience and the follow-up, not solicitation.
| Platform | Who can review | Can you ask? | Removal basis | Your reply |
|---|---|---|---|---|
| Anyone with an account | Yes, neutrally, no incentives, no gating | Content policy violation; several days; one appeal | Public, policy-checked, generic | |
| Healthgrades | Anyone with contact, including family | Yes, via survey links | Guideline violation, flagged for review | Available on claimed profiles; keep generic |
| Zocdoc | Verified attended bookings only | Zocdoc sends the survey; do not influence | Guideline violation only | Keep to the practice’s standards, no patient details |
How do you generate reviews without breaking the rules?
Volume is the quiet solution to almost every dental review problem. A practice with 400 reviews absorbs a one-star rant; a practice with 23 does not. The constraint is that the asking has to be compliant on three fronts. Whether a practice runs that asking through a tool or hands it to a team is the question we answer in reputation management software vs an agency.
- Google’s policy: ask everyone, offer nothing, never steer. “Selectively solicit positive reviews” is a listed violation, so the pre-screen that routes happy patients to Google and unhappy ones to a private form is out.
- The FTC’s rule: the FTC’s final rule on fake reviews, announced August 14, 2024, bans incentives tied to a review’s sentiment, undisclosed insider reviews, and suppressing reviews through “unfounded or groundless legal threats,” with civil penalties for knowing violators.
- HIPAA: the request itself must not disclose PHI to anyone else. A text from the practice that says “thanks for coming in today, we would value your feedback” sent to the patient’s own number is a communication with the patient; a public post tagging patients is not.
A compliant flow that works in most practices:
- Ask at checkout, verbally, every patient. Front-desk staff say the same sentence every time.
- Send one follow-up text or email the same day with a direct link to the Google review form. One reminder a week later, then stop.
- Put the same link on the practice site, appointment reminders and the receipt footer.
- Rotate the ask across Google, Healthgrades and the practice site so no single platform shows a suspicious spike.
- Track the ask-to-review rate monthly. When it collapses, the ask has stopped being made at the desk.
Expect the ask to work: BrightLocal’s 2026 Local Consumer Review Survey of 1,002 US adults found 97 percent read reviews for local businesses, 89 percent expect owners to respond to reviews, and 80 percent say they are likely to use a business that responds to all of its reviews. Responding to the five-star reviews, generically, is part of the generation program.
How do you handle the one-star rant?
The rant is the review that names the dentist, describes a procedure in detail, alleges pain, overbilling or rudeness, and often ends with a threat to report the practice. The instinct is to correct the record. HIPAA forbids it, and the ADA’s survey found 39 percent of dentists said they were unable to respond because of it, per ADA News, January 2023. The answer is not silence; it is a reply that says nothing about the person.
The safe reply
“Thank you for your feedback. We take every comment about our practice seriously and we are committed to patient comfort, clear communication about treatment and costs, and respectful care. We cannot discuss any individual’s experience here, but we would welcome the chance to talk. Please call our office at [number] and ask for [office manager].”
It does not confirm a visit, does not reference the procedure, does not argue, and tells the next reader what the practice stands for. Variations for different situations are in our negative review response templates; for dental practices, strip any sentence that acknowledges the reviewer’s visit.
When to report instead of reply
- The reviewer was never a patient and the review is about a billing dispute with an insurer, a job application, or another business. Report it as off-topic or conflict of interest under Google’s policy; Google bars “general, political, or social commentary or personal rants” unrelated to an experience at the location.
- The review contains a threat, a slur or someone’s private information. Report under harassment or hate speech.
- A cluster of one-stars arrives from new accounts after a staff departure or a dispute. Report each, note the pattern, and keep the evidence off the public page.
Do not report a review because it is unfair. Google tells businesses, “Do not report a review just because you disagree with it or dislike it,” and the review will stay. What a legitimate removal service can and cannot do for a Google review is set out in what a legitimate Google review removal service looks like.
When legal action is the answer
Almost never. The ADA calls it a last resort that “can create backlash worse than the original review.” The exception is a specific, provably false factual claim (a fabricated injury, a false accusation of a crime) that is damaging the practice, where counsel advises that the claim is winnable; even then, HIPAA limits what you can say in a public filing, and a lawsuit by a dentist against a patient is itself a story. This is general information, not legal advice.
What should the practice website and local press do?
A dental practice’s search results for its name should be mostly its own. The practice site needs a page per service, a page per clinician with credentials and a plain-language bio, a reviews page, and a page on how the practice handles concerns with a direct line to the office manager. That last page ranks for “[practice] complaints” and intercepts the patient who was about to post.
Local coverage does what no profile can: it puts the dentist’s name in a trusted outlet, in context, where both patients and Google see it. A community paper story on a free screening day, a regional business journal piece on a new location, a clinician quoted in a local TV segment on a dental health topic, and an interview on a local podcast each produce a result that outranks a review aggregator for the dentist’s name. The pitch mechanics are in how to get your story in local news. Editorial features in recognized publications belong in the same stack: they rank for the dentist’s name, they signal credibility to a prospect comparing three practices, and they are what AI assistants cite when someone asks “is Dr. [name] a good dentist.”
Put all of it on a monthly review: new reviews on each platform, reply turnaround, the ask-to-review rate, the first page of results for the practice name and each clinician, and any new directory listings that have gone stale. A practical checklist is in what doctors should fix before their online reputation slips.
Where Viral Spike fits
Viral Spike’s reputation management service for dental practices starts with two written documents: an audit of your Google, Healthgrades and Zocdoc profiles against what patients and search engines need to see, and a review-by-review assessment of every negative review against the platform’s policy, saying which are reportable and on what basis. We file reports through the official channels, promise no deletions, and scope and price removal work upfront. We draft the HIPAA-safe reply set with your privacy officer, set up the compliant review request flow, and build the coverage layer: local press outreach and guaranteed editorial placements in recognized outlets, where you approve the draft, the article is published and indexed on Google, and the engagement is refunded in full if it never runs. If a review problem is what brought you here, start with our review removal service, which begins with the assessment. Or contact us with the practice name and we will run the first search ourselves.
Write the safe reply this week, then make the review count small
Draft the generic response above with your privacy officer, approve it, and reply to every unanswered review on Google and Healthgrades with it, positive and negative. Claim or update the Healthgrades and Zocdoc profiles. Write the one sentence your front desk will say at checkout and start saying it tomorrow. Then search your practice name and each dentist’s name and note what sits in the top five. Everything that is not yours, or not favorable, is the next quarter’s work.
Frequently asked questions
Can a dentist respond to a negative Google review under HIPAA?
Yes, as long as the reply does not confirm the reviewer is a patient or reference any visit, treatment, billing or insurance detail, even details the reviewer posted. The HIPAA Privacy Rule treats information about the provision of care to an identifiable person as protected health information. Use a generic reply that states the practice’s standards and invites the person to call the office. The ADA’s guidance is explicit: do not acknowledge that a reviewer was a patient.
What happens if a dentist discloses patient information in a review reply?
The HHS Office for Civil Rights can investigate, usually after a patient complaint, and resolve the matter with a settlement and corrective action plan. Elite Dental Associates paid $10,000 in 2019 and New Vision Dental paid $23,000 in 2022 over review responses that disclosed PHI; New Vision was also cited for lacking a social media PHI policy and placed under two years of monitoring. OCR has said this kind of disclosure is not allowed regardless of the organization’s size.
Can dentists ask patients for Google reviews?
Yes. Google permits merchants to ask for reviews as long as they offer no incentive, do not try to influence the rating or content, and do not discourage negative reviews or selectively solicit positive ones. Ask every patient the same way, send one follow-up with a direct link, and never gate the ask by expected sentiment. The FTC’s 2024 rule separately bans paying for reviews conditioned on sentiment and undisclosed reviews from staff or relatives.
How do I remove a fake review of my dental practice?
Report it to the platform under the specific rule it breaks. On Google, report from the Business Profile or the Reviews Management Tool; evaluation typically takes several days and a one-time appeal is available. Healthgrades and Zocdoc remove reviews only for guideline violations such as harassment, personal information or fraud. Reviews that are merely negative, or that you believe are inaccurate, are generally not removed, and the reply should stay generic while the report is pending.
Does Zocdoc let dentists remove or hide reviews?
Zocdoc posts only reviews from patients who booked through Zocdoc and attended an appointment the provider marked as attended, moderates each review by hand, and removes reviews only when they violate its guidelines; it says mere suspicion usually is not enough. Providers are prohibited from unduly influencing reviews or retaliating against reviewers. Zocdoc notes that some providers have chosen not to display their reviews at all, which is a decision about the profile, not a removal of individual reviews.
Is it worth suing a patient over a false review?
Rarely. The ADA calls legal action a last resort that can create backlash worse than the review, HIPAA constrains what the practice can say in any public filing, and the FTC’s rule treats baseless legal threats as review suppression. The exception is a specific, provably false statement of fact that is causing measurable harm, where healthcare counsel advises the claim is strong. For everything else, a generic reply, more reviews and stronger search results do more at lower cost. This is general information, not legal advice.
Sources
Primary sources referenced in this article, in order of first use.
- HHS summary of the HIPAA Privacy Rule (hhs.gov)
- ADA News (adanews.ada.org)
- HHS resolution agreement page (hhs.gov)
- HHS (hhs.gov)
- HIPAA Journal (hipaajournal.com)
- HHS press release (hhs.gov)
- contributed content policy (support.google.com)
- reply guidance (support.google.com)
- reporting page (support.google.com)
- review guidelines (healthgrades.com)
- verified reviews page (zocdoc.com)
- final rule on fake reviews (ftc.gov)
- Local Consumer Review Survey (brightlocal.com)
- ADA News (adanews.ada.org)
More in Online Reputation
Related services