How to Respond to a Bad Google Review Without a HIPAA Fine

You can reply to a negative Google review, and usually you should. What you can never do is confirm the reviewer was ever your patient, describe any interaction with them, or correct a single clinical detail, because each of those is a HIPAA disclosure even when the patient has already told the whole story themselves. The compliant reply is generic by design: acknowledge the feedback, state your practice policy in general terms, and invite the writer to contact you privately. A New Jersey psychiatric practice that did it the other way paid the federal government $30,000.

This is practice-operations guidance, not legal advice. If a review alleges harm or you are weighing any legal response, involve your attorney and malpractice carrier before you type anything.

What happens when a practice argues with its reviews?

The government fines you, names your practice in a press release, and supervises your compliance afterward. Manasa Health Center, a psychiatric practice in Kendall Park, New Jersey, replied to negative Google reviews with the reviewers' own diagnoses and treatment details. A patient complained to the HHS Office for Civil Rights in April 2020; OCR found the practice had disclosed the protected health information of four patients and, in June 2023, settled for $30,000 plus a corrective action plan: written privacy policies, workforce training, breach letters to the affected patients, and a breach report to OCR. OCR Director Melanie Fontes Rainer's statement on the case ended with "Simply put, this is not allowed."

Manasa was the fourth enforcement action of its kind, all against small practices:

The dollar figures understate the damage. For a psychiatric practice, the press release is worse than the check: every prospective patient who searches your name now finds a federal settlement about exposing mental-health records.

Why is "that person was never my patient" also off limits?

Because the existence of a treatment relationship is itself protected health information. HIPAA covers the fact that someone is under your care, so "we treated this differently at the visit" and "I have never seen this person in my life" both fail, the first by disclosing and the second by implying you checked, and by making your silence on other reviews readable as confirmation. Reviewers can say whatever they want about you; HIPAA binds only you.

The stakes run higher in psychiatry than in most specialties. For a dermatology patient, being confirmed as a patient is a shrug. For yours, it discloses mental-health care, the same category of exposure mapped in how patient data actually leaks to insurers. That asymmetry is why every template below refuses to confirm patienthood at all.

1. Give it 24 hours

Write nothing the day the review lands. A one-star review of your clinical judgment reads as an attack on the work itself, and clinicians draft their angriest, most specific replies in the first hour, which is exactly the hour that produced the Manasa settlement. Screenshot the review, close the tab, and come back tomorrow. A single bad review on an otherwise healthy profile costs you far less than a bad reply, which becomes a permanent public exhibit written by you.

2. Check whether Google will remove it

Google removes reviews that violate its content policies and leaves negative-but-compliant reviews alone; its own guidance states that it "doesn't get involved in conflict between businesses and customers." As of August 2026, the prohibited-content categories include fake or misleading content, conflicts of interest, harassment and doxxing, hate speech, profanity, personal information about someone else, and off-topic content unrelated to your practice.

Three patterns worth flagging from your Business Profile: a review from someone you can identify as a disgruntled ex-employee or a competitor (conflict of interest), a review that names and attacks a third party (personal information, harassment), and review-bombing after a public dispute (fake engagement). An honest patient saying your fees are too high is none of these. If the review survives the appeal, move to step 3.

3. Reply once, with a script that confirms nothing

The reply is for the next hundred people who read the review, none of whom know the backstory. A calm, generic response signals a practice that handles conflict like an adult; a detailed rebuttal signals the opposite and may be a federal violation. David Cohen, CPA, JD, who reviews this handbook's legal content, puts the rule this way: "Write every reply for the future patient reading it, never for the reviewer. The moment you argue facts, you have confirmed a treatment relationship, and the argument itself is the violation."

Default template for any negative review, real or fake:

We take all feedback about the practice seriously. Privacy law does not
allow us to confirm whether any individual is or was a patient, or to
discuss anyone's care. Anyone with a concern about their experience is
welcome to contact us directly at [phone] or [email], and we respond
within [two] business days.

When the review makes a factual claim about how you operate, correct the record at the policy level only:

We cannot comment on any individual's experience or confirm that any
reviewer is a patient. As a general matter, our policy is [one sentence,
e.g. "refill requests are answered within two business days" or "all
fees are published on our website before booking"]. Questions about how
the practice works are always welcome at [phone] or [email].

For positive reviews, gratitude with no confirmation:

Thank you for taking the time to write this. Feedback like this means
a great deal to a small practice.

The patient waives nothing by posting first. If the review lists their diagnosis, their medication, and three visit dates, your reply still references none of it.

4. Move the real conversation off Google

If you recognize the reviewer as a current patient, post the standard reply anyway, then handle the substance privately like any other care complaint: call, listen, fix what is fixable, and document the conversation in the chart. Patients who feel heard sometimes edit or delete reviews on their own. Never ask them to, and never trade anything for removal; conditioning a refund or a fee waiver on deleting a review violates Google's rating-manipulation policy and looks disqualifying to a licensing board. If the same complaint keeps appearing from patients who were wrong for the practice from day one, the fix is upstream in your screening process, and no reply template will patch it.

5. Ask every patient for reviews, so one bad one stops mattering

Volume is the durable defense: a profile with thirty reviews absorbs a one-star outlier, and a profile with three is defined by it. HIPAA does not prohibit asking your own patient for a review, because the ask discloses nothing to anyone. Two constraints shape how you ask. Ask everyone with the same wording, since Google's policy prohibits selectively soliciting positive reviews or discouraging negative ones. And never offer incentives, for the same reason.

Psychiatry adds a third constraint the other specialties skip: a public review discloses the patient's own mental-health care, so the ask should say so out loud.

If you ever feel comfortable doing it, a Google review helps other
people find the practice. Reviews are public, so please share only
what you would want public, and there is truly no pressure either way.

Use the same wording for every patient, at the end of a visit or in a follow-up email. And republishing a patient's review on your practice website as a testimonial is a marketing use of PHI and requires the patient's written HIPAA authorization first, even though the review sits in public on Google.

6. Put monitoring on a monthly schedule

Fifteen minutes a month covers it: claim your Google Business Profile and turn on new-review email alerts, then sweep your Psychology Today profile, Yelp, and Healthgrades on a recurring calendar block. Screenshot anything that alleges clinical harm or threatens legal action, since dated screenshots are what your attorney and carrier will ask for. Then stop checking. Reviews are one channel in a broader plan for getting patients, and daily refreshing changes nothing except your mood.

Why suing the reviewer usually backfires

A defamation suit against a patient-reviewer is almost always a worse outcome than the review. Truth is a complete defense, opinions like "I felt dismissed" are protected speech, and filing puts the review into a public court record that reaches far more people than your Google profile ever did. Discovery can force the treatment relationship, and sometimes the chart, into the open. Many states have anti-SLAPP statutes that let the reviewer end a weak suit early and bill you for their legal fees. The narrow case worth pursuing, a provably false and damaging review from an identifiable non-patient, still starts with your carrier's risk hotline and an attorney letter, never with a complaint you drafted angry.

The checklist

• Wait 24 hours before touching the keyboard.
• Flag the review only if it breaks a Google content policy; negativity alone never qualifies.
• Post one generic reply that confirms no treatment relationship and offers offline contact.
• Handle recognized patients privately, and trade nothing for removal.
• Ask every patient for reviews with identical wording and a privacy reminder.
• Monitor all profiles monthly, screenshot anything legal-adjacent, and call your carrier before an attorney letter goes out.