A practice should reply to a negative review in a way that would read the same whether or not the reviewer was ever a patient: thank them, state the practice's general standard, and offer a private route to talk, with no detail about any visit. The reply library, the person allowed to post, and the rules for reporting a review to the platform should all be settled before the next one-star review arrives. A reply written at night under pressure is where a disclosure mistake is easiest to make.
Our page on patient reviews and testimonials covers the federal enforcement record, authorization for patient stories, and the FTC review rule. This page is narrower: how to draft, approve, and post the reply itself, and what the platform lets you do.
This is a content and operations question for practice owners and marketing leads, not legal advice. Your privacy officer or counsel should approve the reply library before anyone uses it.
Why confirming a visit is already a disclosure
The instinct when a review is unfair is to correct the record. In healthcare, correcting the record usually means confirming that the person was seen, and often when and by whom. Under 45 CFR 160.103, individually identifiable health information includes information that relates to "the provision of health care to an individual" and "identifies the individual." HHS's de-identification guidance gives "an indication that the individual was treated at a certain clinic" as an example of information that "would be PHI" when it is listed with identifying details. A reply that says "we reviewed your visit" connects a named reviewer to care at your practice.
That is why the safest replies are written so they could appear under a review from a stranger. A polite reply is not a private one. Kindness in tone does not change what the reply reveals, so read every draft for facts, not warmth. Your privacy officer can confirm where your practice draws the line.
Build a reply library by review type
Negative reviews in healthcare tend to fall into a handful of patterns, and each can have an approved reply that the person on duty adapts lightly. Write the library once with your privacy officer, then use it.
| Review type | Reply pattern | Never include |
|---|---|---|
| Long wait or rushed visit | Thanks, the practice's general approach to scheduling, an invitation to call the office manager | Appointment times, the provider's name, the day's circumstances |
| Billing complaint | Thanks, how billing questions are handled in general, the billing line | Amounts, insurer, account status |
| Staff courtesy | Thanks, the standard the practice holds staff to, an offer to talk privately | Which staff member, what was said |
| Disagreement about care | Thanks, a statement that the practice takes care concerns seriously, a private route | Diagnosis, treatment, test results, any clinical detail |
| Review that seems to describe another practice | No reply, or a general reply; consider reporting through the platform | "We have no record of you" |
The last row catches many practices. "We have no record of you as a patient" seems harmless, yet it tells readers something about who is and is not a patient. Before any reply goes live, the person posting should ask one question: "Could this exact reply sit under a review from someone we have never seen?" If the answer is no, it needs rewriting.
What Google's tools let you do
Google's help pages set out how replies work on a Business Profile. The business must be verified before replying, an approved reply "will be publicly posted under the customer's review," and "The person who wrote the review is notified when you reply." Replies can be edited or deleted later, which is useful when a template improves, but the reviewer may already have read the first version.
Reporting is a separate decision. Google says, "Do not report a review just because you disagree with it or dislike it," and that "Google doesn't get involved in conflict between businesses and customers." Reports go through the profile or the Reviews Management Tool, and a review that does not qualify for removal can receive "a one-time appeal." Decide in advance which kinds of reviews the practice reports (those that appear to break the platform's policies) and which it simply answers. Our page on what a practice's Business Profile should say covers the rest of the profile.
Who posts, how fast, and what happens offline
Name one or two people who may post replies, and give them the library and a short escalation list. Any review that mentions clinical care, a legal threat, or a staff member by name goes to the privacy officer before a reply is posted. Speed matters less than accuracy; a reply a day later that discloses nothing is better than a reply in an hour that does. Review the library itself once a year with the privacy officer, and sooner if a reply ever causes a problem, so the approved wording keeps pace with what the practice has learned.
The private route offered in the reply must be real. If the reply says "please call our office manager," the office manager needs to know these calls may come, how to verify the caller, and how to log the conversation in the practice's normal complaint process rather than in a marketing file. The person replying should not have to invent the practice's standards on wait times or billing; the library already states them, in wording the practice has approved.
A fictional reply, before and after
Here is an invented example from a fictional pediatric urgent care in Wisconsin. The review complains about a long Saturday wait and a dismissive provider.
Draft reply: "We're sorry about your son's wait on Saturday. That afternoon we had two emergencies, and Dr. Lee spent extra time with each patient." The draft confirms the child was a patient, the day of the visit, and the provider. It also hints at other patients' care.
Approved reply: "Thank you for taking the time to write. We try to keep families updated about wait times, and we want to hear about any visit that fell short. Please call our office manager at our main number so we can talk privately." Nothing in it depends on the reviewer having been a patient, and every sentence came from the library.
In Hudson South's process, the Authority Asset gathers the practice's approved knowledge and evidence, which can include the reply library and the standards it states. Hudson Twenty-One records how the practice communicates across 21 dimensions so replies sound like the practice, Market Intelligence researches the questions patients ask and the market around the practice, and AEO Creation turns those inputs into answer-first content. See our overview of content for medical, dental and wellness practices for the rest.
See how your reviews read next to competitors
On a free 30-minute call, Hudson South walks you through how your profile and pages compare with the practices patients weigh against yours.
Get your free competitor analysisSources
- 45 CFR 160.103: Definitions. Electronic Code of Federal Regulations. Read 2026-10-16.
- Methods for De-identification of PHI. U.S. Department of Health and Human Services. Read 2026-10-16.
- Manage customer reviews. Google Business Profile Help. Read 2026-10-16.
- Report inappropriate reviews on your Business Profile. Google Business Profile Help. Read 2026-10-16.