A healthcare practice can respond to online reviews and use patient testimonials, but HIPAA, FTC rules, and state rules limit how. A review reply should not confirm that someone is a patient or discuss their care, and a testimonial that uses a patient's health information for marketing generally needs that patient's written authorization. Every review and testimonial the practice publishes also has to be genuine and fairly presented.
Reviews feel like marketing, and most industries treat them that way. In healthcare, a reply to a one-star review can be a disclosure of protected health information, and a glowing patient story can raise questions about authorization and substantiation.
This article is about content and marketing decisions for practice owners and marketing leads. It is not legal advice. Bring specific situations to your privacy officer, compliance lead, or counsel, and check your state's rules, which vary.
Responding to a review is a disclosure decision
The HHS Office for Civil Rights has acted against a practice that replied to reviews by discussing patients. Announcing a settlement with a California dental practice, HHS described "inappropriate use of social media to respond to patient reviews, disclosing protected health information," and the OCR Director said: "Providers cannot disclose protected health information of their patients when responding to negative online reviews."
A workable reply pattern starts from that limit. Thanking someone for feedback is not the same as discussing their visit. A reply can acknowledge the comment in general terms, describe the practice's general approach, and invite the person to contact the office directly, without confirming they were ever seen there. Write a few approved templates with your privacy officer, and decide who is allowed to post them.
The same caution applies to replies that seem harmless. Correcting a reviewer's account of their appointment, mentioning when they were last seen, or noting that they missed a follow-up all reveal that the person is a patient and something about their care. If a review contains a claim the practice disputes, the dispute belongs in a private conversation or with the platform, not in a public reply.
Patient stories need written authorization
HHS guidance on marketing explains that the Privacy Rule "requires an individual's written authorization before a use or disclosure" of protected health information for marketing, with limited exceptions. A patient's enthusiasm in the waiting room is a starting point for a conversation, not that authorization. The Privacy Rule applies to covered entities, and CMS guidance says "Providers who submit HIPAA transactions, like claims, electronically are covered." A cash-only wellness business should confirm its own status with counsel, since the FTC rules below apply either way.
More broadly, 45 CFR 164.508 says a covered entity "may not use or disclose protected health information without an authorization that is valid under this section," except where the Privacy Rule otherwise permits or requires it. A valid authorization includes core elements such as "A description of the information to be used or disclosed," "A description of each purpose of the requested use or disclosure," an expiration date or event, and the individual's signature and date. It also has to tell the individual of "The individual's right to revoke the authorization in writing." Your privacy officer should own the form; marketing should own the habit of asking for it.
Stories also get reused. A quote approved for a brochure can end up in an ad or on a landing page months later. Before any of those uses, ask the team: "Where is the signed authorization for this story, and does it cover this use, on this channel, for this long?" If nobody can answer, the story waits.
What does the FTC's review rule prohibit?
The FTC's Rule on the Use of Consumer Reviews and Testimonials, at 16 CFR Part 465, applies to businesses generally. Among other things, it addresses:
- Fake or false reviews and testimonials, including writing, creating, or selling them (section 465.2).
- Incentives "conditioned expressly or by implication on, the writing or creation of consumer reviews expressing a particular sentiment" (section 465.4).
- Reviews or testimonials by officers or managers without "a clear and conspicuous disclosure" of their relationship to the business (section 465.5).
- Presenting a website the business controls as a source of independent reviews (section 465.6).
- Review suppression through groundless legal threats, intimidation, or public false accusations, and suggesting that displayed reviews represent all or most reviews when negative ones are hidden by rating or sentiment (section 465.7).
For a practice, that rules out a few habits that can creep in: owners or managers posting reviews without disclosing the relationship, offering an incentive only for positive reviews, or showing only the positive ones while implying they are the full set. Ask counsel how the rule applies to your review requests and displays.
Asking for reviews is still possible. A practice can invite patients to leave honest feedback, and inviting everyone, rather than only the patients who seem happiest, keeps the displayed reviews closer to the real picture. How requests are sent, by text, email, or a card at checkout, and how they fit your privacy practices, is worth settling with your privacy officer before the first message goes out.
Testimonials cannot stand in for evidence
The FTC's Endorsement Guides, at 16 CFR Part 255, say endorsements "must reflect the honest opinions, findings, beliefs, or experience of the endorser." They also state: "Consumer endorsements themselves are not competent and reliable scientific evidence." If a testimonial implies a result, the advertiser needs support for that result, and when the advertiser cannot substantiate that an endorser's experience is representative of what people will generally achieve, the guides say the ad should clearly disclose the generally expected performance.
The FTC's Health Products Compliance Guidance puts it in plainer words: "Individual experiences aren't a substitute for scientific research." That guidance is written around health products, so whether and how its reasoning applies to a particular service is a question for counsel. It is still a sensible benchmark for any testimonial that mentions an outcome, and the same caution shapes how a practice describes care, covered in treatment pages that do not promise outcomes.
A fictional review workflow
Here is a hypothetical workflow for a fictional chiropractic office in Oregon. It shows who decides what, not what any real office does.
| Situation | What the office does | Who approves |
|---|---|---|
| A negative review mentions a specific visit | Posts an approved general reply inviting contact offline, without confirming the person was a patient | Privacy officer |
| A positive review praises a named provider | Thanks the reviewer in general terms and adds no details about care | Practice manager |
| A patient offers to share their story | Provides the authorization form and records what it covers and when it expires | Privacy officer |
| Marketing wants a patient quote for an ad | Checks that the authorization covers ads and that the quote implies no outcome the office cannot support | Compliance lead |
| A review appears to be fake | Reports it through the platform's own process, with no public accusation | Practice manager with counsel |
Each row is a policy the office writes once and then follows. The person replying at nine at night should not have to decide privacy questions on the spot.
Put reviews where they help
Reviews and approved stories support a decision; they rarely make the case alone. Place a relevant, authorized quote near the explanation it supports, such as beside a provider's bio, which our guide to provider bio pages covers. The broader principle is in the proof your website needs to help buyers choose.
The record behind each story matters as much as the story. A marketing writer should not be left to reconstruct what a patient meant or which permissions exist. The Authority Asset step in our process gathers approved business knowledge and evidence, which for a practice includes the authorized testimonials and the record of what each authorization allows.
This post is part of our guide to how healthcare practices show up when patients ask AI.
See how your reviews and pages compare
On a free 30-minute call, Hudson South walks you through the gaps between your website and the practices patients weigh against yours.
Get your free competitor analysisSources
- The dental practice responded to reviews on social media by disclosing patient health information in violation of the law; OCR warns others against this practice. U.S. Department of Health and Human Services. Read 2026-10-15.
- Marketing (HIPAA Privacy Rule guidance). U.S. Department of Health and Human Services. Read 2026-10-15.
- Are You a Covered Entity?. Centers for Medicare & Medicaid Services, on HHS.gov. Read 2026-10-15.
- 45 CFR 164.508, Uses and disclosures for which an authorization is required. Electronic Code of Federal Regulations. Read 2026-10-15.
- 16 CFR Part 465, Rule on the Use of Consumer Reviews and Testimonials. Electronic Code of Federal Regulations. Read 2026-10-15.
- 16 CFR Part 255, Guides Concerning Use of Endorsements and Testimonials in Advertising. Electronic Code of Federal Regulations. Read 2026-10-15.
- Health Products Compliance Guidance. Federal Trade Commission. Read 2026-10-15.