Reviews are how most new patients decide between you and the practice down the road. But a front desk that asks the wrong way can create three problems at once: a Google policy violation, an FTC problem, and a HIPAA problem.
This guide covers how to ask, what to say, and how to reply. It's general information, not legal advice, so have your compliance officer or healthcare attorney sign off on your final process.
The three rulebooks you're playing under
Most trades only worry about Google. A medical or wellness practice has to satisfy all three at once.
| Rulebook | What it covers | What it means at your front desk |
|---|---|---|
| Incentives, selective asking, biased or fake reviews | No rewards for reviews, and no filtering who gets asked | |
| FTC | Fake reviews, paid reviews, review suppression | No buying sentiment, no threats to get reviews removed |
| HIPAA | What you disclose about patients | No health information in asks, replies or marketing without authorization |
Google's rules
Google does not allow offering incentives such as payment, discounts or free goods and services in exchange for posting a review, or for changing or removing a negative one. That includes the "free whitening with your 5-star review" idea. Read Google's own policy page before you build anything.
The other trap is review gating. Sending review requests only to patients you expect to be happy, and skipping those who had a poor experience, is gating. Filtering by expected sentiment, transaction size or staff recommendation all count.
As of 2026, Google's policy page also lists merchants requesting that staff solicit a certain number of reviews as a violation. Secondary sources covering the April 2026 update report that asking patients to name an employee in a review, on-site pressure and shared review kiosks are also banned. That matters for practices where patients naturally want to name their doctor. Let them do it on their own, but don't script it.
The FTC's rules
The FTC's final rule banning fake reviews and testimonials took effect on October 21, 2024. It prohibits compensation or incentives conditioned on reviews expressing a particular sentiment, positive or negative. It also bars using groundless legal threats, intimidation or certain false public accusations to prevent or remove a negative review. Details are in the FTC announcement.
Making things right is still allowed. The rule does not prevent a company from trying to make it right with a customer who posted a negative review. Just don't pay for a rewrite, because Google prohibits that.
Where healthcare is different: HIPAA
A roofer can reply to any review however he likes. You can't.
The ask itself. One compliance guide says a review request is fine when it contains no protected health information, goes through consented channels, and reaches patients consistently rather than selectively. "How was your therapy session with Dr. Lee?" already says too much. Keep it generic.
Your replies. HIPAA doesn't prohibit responding to online reviews, but you have to protect the patient's PHI even if the patient already revealed it. HHS announced a settlement with a New Jersey psychiatric practice after it answered a negative review with patient information. The practice paid $30,000 and agreed to a corrective action plan. Per the HHS resolution page, the problem was disclosures in review responses. Even confirming facts a patient posted online may raise compliance issues. The AMA's guidance covers the same ground for physicians.
Reusing reviews in your marketing. This is where practices slip. Several healthcare marketing compliance guides say using a patient's name, photo or story in marketing requires specific written HIPAA authorization, and a generic intake form isn't enough. One adds that reposting a public review with the patient's identity attached can be a violation. Treat this as a question for your attorney before you put patient names next to quotes on your site.
A review-ask workflow that stays inside the lines
Here's a process you can run with a spreadsheet and a texting tool, or with a CRM.
- Get your real review link. From your Business Profile on Google, click "Read Reviews," then "Get More Reviews," and share the link or QR code.
- Capture messaging consent at intake. Add a clear checkbox for text messages, with a log of who agreed and when. Our post on online patient intake forms covers where this fits.
- Trigger the ask automatically. Every completed visit gets the same message after a set delay, say two hours. Staff don't pick who gets it, which removes the gating risk.
- Keep the message generic. Example: "Thank you for visiting [Practice Name]. If you have a minute, we'd welcome your feedback: [link]. Reply STOP to opt out." No provider name, no service type, no appointment details.
- Don't pressure anyone in the office. No tablets at checkout and no "can you do it before you leave?"
- Offer a private feedback option next to the public link, not instead of it. A "contact the practice manager" line is fine. Routing unhappy patients away from Google is not.
- Name one person to handle replies, plus a backup, and give them a short written reply policy.
Texting review requests: the consent layer
HIPAA covers what the message says. A separate federal law, the TCPA, covers whether you may send an automated text at all. The default is that an automated text needs prior express consent, and a marketing text needs prior express written consent.
It's not settled for every practice whether a review request counts as informational or promotional, so ask counsel. The conservative route is to get explicit opt-in for review texts at intake. One guide notes a satisfaction survey with a marketing element is a separate consent, a separate checkbox and a separate message stream.
Honor opt-outs fast. Since April 11, 2025, any reasonable "stop" request by any method is a valid revocation. Business texting also has carrier registration requirements, which we cover in our A2P 10DLC registration guide. Our post on HIPAA and text messaging for small practices goes deeper on the content side.
Replying to reviews without disclosing anything
Positive reviews need the same care as negative ones. Don't write "we're glad your procedure went well." That confirms a patient relationship. A safe template for either kind:
- Thank the reviewer for the feedback, without calling them a patient.
- Speak about your standards in general terms.
- Give a phone number or email and invite them to contact the office directly.
- Stop there. Don't argue, explain or correct the record in public.
For a negative review, call the person if you know who they are. One oral surgery journal article recommends speaking with the patient directly about their concerns. Then let the public reply stay short.
Sensitive specialties: sometimes the right answer is a softer ask
For therapy, fertility, addiction treatment or similar care, a public review reveals that someone is your patient. Many people will never post one, and that's their right. A low-key link at the end of an automated message is enough. Don't follow up, and don't remind patients twice.
A quick compliance checklist
- No rewards, discounts or giveaways tied to reviews
- Same ask to every patient, triggered automatically
- No health information, provider names or service types in the message
- Text consent logged before any review text goes out
- STOP replies honored right away
- No staff quotas, no scripted review content
- Replies reviewed against a written policy and handled by one person
- Written authorization on file before any patient name, photo or story appears in marketing
If you want ideas for putting reviews to work on your site without crossing these lines, see turning Google reviews into marketing.
How RGS helps
Revenue Generating Solutions is a marketing and technology company for local service businesses, including healthcare and wellness practices. Our Digital Marketing service and healthcare digital marketing page explain how we work, and our healthcare industry page covers the wider picture. We're not a law firm, so compliance sign-off stays with your counsel. You can reach us at (617) 877-5608 or through our contact page.
