PRACTICE DECISION TOOLS
FOR Doctors, Specialists, NPs, PAs
Physician-Patient Archetype Test • Marketing • CMT Patient Study • See all tools
RESEARCH & PROOF
National Stats, Industry Research
CMT Research Briefs • Polls • Visuals • Legal Op • Natl Stats • Contact
Reviews and Reputation: What Patients Read, and How to Reply Safely
Almost every prospective patient reads reviews. Practices are tempted either to ignore them or to fire back. Both are mistakes, and one of them has cost practices real money in HIPAA settlements. Here is how to ask for reviews, respond safely and stay within the FTC's new rule.
Start here: the questions this brief answers
Tap a question for the short answer, then jump to the evidence.
Reviews are part of your reputation whether you manage them or not. In BrightLocal's 2025 survey, only 4% of consumers said they never read online business reviews, and most expect businesses to respond. But responding is where practices get into trouble: HHS has settled with dental practices that disclosed patient information while replying to reviews, including a $10,000 settlement in 2019 and a $23,000 settlement in 2022. The FTC's rule on consumer reviews, effective October 21, 2024, bars fake reviews, incentives conditioned on positive sentiment and undisclosed insider reviews, with civil penalties per violation. Ask every happy patient, respond to every review without confirming anyone is a patient, and never buy praise.
“The internet is a coward's canvas sometimes, and a bad review stings. But your reply isn't for the reviewer. It's for the next hundred people reading it. Be gracious, be brief, protect privacy, and take it offline.”
Do patients really read reviews?
Yes. In BrightLocal's 2025 survey of 1,026 U.S. adults, only 4% said they never read online business reviews.
Go to the full answer ↓Can I reply to a negative review?
Yes, carefully. Never confirm the person is a patient or mention any details of their care. HHS has fined practices that did.
Go to the full answer ↓Can I offer a reward for a review?
Not one conditioned on a positive review. The FTC's 2024 rule bars incentives tied to a particular sentiment, and federal kickback rules may also apply to rewards for patients.
Go to the full answer ↓Can my staff post reviews?
Not without clearly disclosing their relationship to the practice. The FTC rule covers undisclosed insider reviews by officers and managers.
Go to the full answer ↓What should a reply say?
Thank them, take it offline, and say nothing that confirms they are a patient. Part 4 has templates.
Go to the full answer ↓Almost everyone reads them
You can ignore online reviews. Your prospective patients won’t.
In BrightLocal’s 2025 survey of 1,026 U.S. adults, only 4% said they never read online business reviews. Trust is softening, though: 42% said they trust reviews as much as personal recommendations, down from 79% in 2020. Most expect businesses to respond, and 63% expect a reply within two days to a week.1 Industry Research
So reviews aren’t a substitute for word of mouth (Brief No. 58). They’re the place people go to check it.
Remark-ology’s advice is refreshingly direct: don’t be bashful. Make it easy for happy patients to share, with a QR code or a simple card at checkout.2
The reply that cost a practice $23,000
Here’s where good intentions go wrong. A patient leaves an unfair review. You want to set the record straight. So you explain what really happened in their visit.
That is a HIPAA disclosure.
In 2019, a Dallas dental practice paid $10,000 and agreed to a corrective action plan after it disclosed a patient’s last name, treatment plan, and insurance and cost information in response to a social media review. HHS also found it had no policies for protecting patient information on social media.3 Policy and Law
In December 2022, a California dental practice paid $23,000 after HHS found it had disclosed patients’ protected health information in responses to online reviews. HHS was blunt: “This practice is illegal under HIPAA.”4
Never confirm that a reviewer is your patient. Never mention a visit, a diagnosis, a treatment, a bill or a date. Even a reply that seems harmless can confirm a patient relationship. Ask your compliance adviser to approve your reply templates.
What the FTC's 2024 review rule bans
The FTC’s rule on consumer reviews and testimonials took effect on October 21, 2024, and allows civil penalties of up to $51,744 per violation, according to a law firm summary.5 Policy and Law Practices should know four parts of it:
Fake reviews
Creating, buying or spreading reviews that misrepresent who wrote them or what they experienced.
Incentives tied to sentiment
Offering anything in exchange for, or conditioned on, a review with a particular position, such as positive reviews only.
Undisclosed insider reviews
Officers or managers reviewing their own business without clearly disclosing the relationship.
Review suppression
Groundless legal threats or intimidation to remove negative reviews, or presenting filtered reviews as if they were all reviews.
And remember Brief No. 51: rewards for patients can raise separate federal and state kickback issues. Asking is free and legal. Paying for praise isn’t worth the risk.
Reply templates that protect privacy
| Review | A safe reply (no patient details) |
|---|---|
| Positive | “Thank you for taking the time to share this. It means a lot to our whole team.” |
| Negative, about service | “Thank you for the feedback. We take every concern seriously and would welcome the chance to talk. Please call our practice manager at [number].” |
| Negative, about care or a bill | “We’re sorry to hear about this experience. Privacy rules prevent us from discussing any individual’s care here. Please contact [name] at [number] so we can help.” |
| Clearly false or not a patient | Report it to the platform under its policies; don't argue publicly. |
CMT original templates; have your compliance adviser approve them before use. Evidence type: Policy and Law (applied).
Remark-ology offers one more piece of advice for the sting of a harsh review: print it out and read it aloud to your family. It’s surprisingly freeing, and it keeps you from replying in anger.2
A review routine
Ask every happy patient
At checkout or in a follow-up message a few days later, with a QR code or link. Ask everyone, not just people you expect to be positive.
Reply within a week
Use approved templates. Thank, take it offline, protect privacy.
Learn from the pattern
Add review themes to your complaint log (Brief No. 65). Fix the system, not just the reply.
Write a policy
A one-page social media and review policy for your team, approved by your compliance adviser.
- Read your last ten reviews out loud in a huddle. What patterns do you hear?
- Create a QR code card for checkout that links to your review page.
- Draft your three reply templates and send them to your compliance adviser.
Reviews confirm what your community already says about you. Plan how you'll earn more of those conversations.
Free. No sign-up. Your answers stay in your browser. Step 3 of CMT's Learn, Build, Lead tools. It helps you pick the patient segments that fit your practice, find where they are, plan conversations with local physicians, check that your message sounds like care rather than a pitch, and leave with a 90-day plan.
This brief is educational and is not legal advice. HIPAA, FTC rules, state laws and platform policies change; consult a qualified attorney before adopting review or reply policies.
They read
Only 4% never read reviews.
Reply safely
Never confirm a patient relationship.
Never buy praise
The FTC rule bans incentives tied to positive reviews.
How this brief was built
This brief draws on BrightLocal's 2025 Local Consumer Review Survey, HHS Office for Civil Rights enforcement records and summaries, a law firm summary of the FTC's Trade Regulation Rule on the Use of Consumer Reviews and Testimonials, and CMT's books. BrightLocal is a marketing software company and its survey is labeled Industry Research. Legal summaries are general and are not legal advice.
How to read the evidence types
Every key finding is labeled by evidence type. Labels describe the type of evidence, not its value. Each type answers different questions. Funding is disclosed on every source.
Randomized trials and systematic reviews.Best for cause and effect.
Large observational studies and government data.Best for trends at scale.
Surveys, smaller studies and expert consensus.Best for real-world experience.
Company-sponsored or company-reported data that is not peer-reviewed.Best for early signals and operating data.
Statutes, regulation and official guidance.Best for what is required.
What we don't know
- How strongly reviews affect the choice of a concierge physician compared with personal referrals.
- How platforms' review policies, which change often, apply to practice review requests.
How to cite this brief
External review: this brief has not yet been reviewed by an outside expert. When review is complete, the reviewer is credited by name above with any conflicts of interest, and the version number is updated. Reviewers check accuracy and fairness; CMT is responsible for the final content.
Corrections policy: when an error is identified, CMT corrects it in the open and updates the version number above. Send corrections to the editor through conciergemedicinetoday.net.
Related CMT Research Briefs
References
- BrightLocal. Local Consumer Review Survey 2025 (1,026 U.S. adults). January 29, 2025. www.brightlocal.comFunding: industry (BrightLocal, a local marketing software company)
- Tetreault M. Remark-ology: Creating a Remarkable Patient Experience Worth Remarking About to Others. Concierge Medicine Today, LLC; 2025.Funding: Concierge Medicine Today (self-published; no outside funder) CMT original
- Thomson Reuters. Covered entity pays $10,000 HIPAA settlement after disclosing PHI in response to social media review (HHS OCR resolution agreement with Elite Dental Associates, Dallas, September 30, 2019). tax.thomsonreuters.comFunding: not stated (publisher summary of an HHS enforcement action)
- U.S. Department of Health and Human Services, Office for Civil Rights. Resolution agreement: B. Brandon Au, DDS, Inc., doing business as New Vision Dental ($23,000; disclosures of patient information in responses to online reviews). December 14, 2022. www.hhs.govFunding: federal (U.S. Department of Health and Human Services publication)
- Perkins Coie. FTC finalizes rule banning fake reviews and testimonials (16 CFR Part 465; effective October 21, 2024). 2024. perkinscoie.comFunding: not stated (law firm analysis)
Educational and informational only. This CMT Research Brief does not constitute medical, legal, tax, financial, accounting or other professional advice, and it does not create a professional relationship of any kind. Statements about laws, regulations, tax rules and payer policies are general, may not reflect the rules in your state, and can change after publication. Consult a qualified attorney, accountant, tax adviser, compliance professional or licensed clinician before acting on anything here.
Independence. Concierge Medicine Today is an independent publication. It does not accept payment for favorable coverage, and it does not favor one practice model over another. Company names and products are mentioned for context only and are not endorsements. Funding is disclosed for every source in the reference list.
Accuracy. CMT verifies figures against their original or best available sources at the time of publication. Where a figure is an estimate, an inference or a company-reported number, the brief says so. This content is not without possible error or omission.
© 2007-2026 Concierge Medicine Today, LLC. All rights reserved.