Every other business responding to a fake review starts with some version of 'we have no record of you as a customer.' Healthcare providers cannot. Under HIPAA's Privacy Rule (45 CFR § 164.502), a covered entity acknowledging that a specific person is or is not a patient — even to refute a false accusation — is itself a disclosure of protected health information and subject to enforcement penalties. OCR has issued settlement letters against dental practices, dermatology clinics, and physical therapy groups for exactly this response pattern, with settlements in the $10,000-$125,000 range in the 2022-2025 window. The removal workflow has to route around this constraint. This post is the workflow we use for healthcare clients inside our Google review removal service.
What HIPAA actually blocks in a review response
- Confirming the reviewer is or was a patient of the practice.
- Denying the reviewer is or was a patient (the flipside of confirmation — same disclosure).
- Referring to specific treatments, appointments, dates of service, or any clinical detail from the reviewer's chart.
- Correcting a factual claim in the review by referencing the actual record ('you were actually seen for X, not Y').
- Discussing the reviewer's condition, insurance, billing, or family members' care in any specific way.
What HIPAA does NOT block: general statements about the practice's policies, general clinical standards of care, the availability of the practice's grievance process, and invitations for the reviewer to contact the practice directly through a HIPAA-compliant channel. Every compliant response is built out of these four categories.
The HIPAA-safe response template
Thank you for taking the time to share your feedback. Because of federal patient-privacy law, we cannot discuss the specifics of any individual's care in a public forum. If you would like to discuss any concern with our practice, please contact our patient-services line at [number] and ask for our patient-experience coordinator, or submit our grievance form at [URL]. We take every concern seriously and address them through our formal review process.
This template does four things: (a) acknowledges the reviewer without confirming they're a patient, (b) explains publicly that the practice is bound by law — signaling to future readers that silence is not agreement, (c) provides a compliant channel for actual resolution, (d) documents the practice's grievance process (which becomes evidence in removal submissions later). Post this same response verbatim on every review you can't otherwise remove. Do not vary it per reviewer — variation reads as engagement with the specific complaint and can drift into disclosure.
The four removal paths that still work under HIPAA
Path 1: Off-Topic (fastest, HIPAA-neutral)
The reviewer describes something that is not a clinical interaction — parking, waiting room aesthetics, staff attitude, a billing dispute unrelated to a specific claim. Off-Topic submissions require no disclosure of patient status. Cover letter: 'This review does not describe a clinical experience with our practice. Requesting Off-Topic removal.' First-pass removal 76% in our healthcare log — highest of the four paths. See Off-Topic Reviews playbook.
Path 2: Wrong-Provider Confusion
The reviewer describes a provider or specialty that is not offered at the location (a review for a chiropractor filed on a dental practice's listing; a review for a specialist filed on a primary care practice). Removal path uses the Wrong Company Confusion pattern. Evidence: screenshot of the practice's GBP showing services offered, screenshot of the review referencing services not offered. No patient disclosure required — the evidence is about the practice's service menu, not the reviewer's chart. First-pass removal 68%.
Path 3: Impersonation / Named-Staff Attack
The reviewer names a specific staff member with defamatory claims (calls a doctor 'unqualified,' 'a fraud,' or accuses them of specific misconduct). This routes through the Named Employee Defamation playbook as a defamation removal request, not a patient-relationship dispute. HIPAA does not block a practice from defending a named staff member's professional reputation because the removal argument is about defamation of the staff member, not the reviewer's clinical history. Removal rate 61%.
Path 4: Third-Party Attestation
Reserved for the hardest cases — reviews that appear to be from a patient (they reference plausible clinical details) but which the practice believes are fabricated or from a competitor. The practice cannot personally attest that the person is or isn't a patient. Path: the practice's compliance officer files an affidavit stating that a records search was conducted under the practice's normal audit process and no matching encounter was found for the reviewer's stated identity or date. The affidavit is filed with Google as evidence without disclosing the reviewer's health status — the affidavit itself is the covered disclosure and the practice's own records-audit action, not a HIPAA-protected patient interaction. Removal rate 42% — lower, but this is the only path that works when the review looks superficially clinical.
Removal rate comparison: healthcare vs general business
Healthcare removal rates run 6-10 points below general business benchmarks on comparable paths because Google's reviewers apply extra scrutiny to healthcare listings — awareness of HIPAA sensitivity actually makes them more conservative about removal, not less. The workflow compensates by front-loading evidence quality on every submission.
What NOT to do
- Do not have a staff member post their own response confirming details — the practice is the covered entity regardless of who does the typing.
- Do not respond privately through Google Messages with clinical detail — the messaging channel is not a HIPAA-compliant communication.
- Do not ask patients to leave reviews confirming they had a good experience with the specific provider named in a bad review — patient-solicitation for reputation management around a specific dispute crosses into inducement and can itself become an OCR issue.
- Do not use a review-management platform that auto-generates responses referencing appointment data. Several major platforms have had HIPAA settlements for this exact integration pattern.
FAQ
Q.Does HIPAA apply if the reviewer identifies themselves as a patient first?
Yes. The reviewer's own disclosure of their patient status does not waive the practice's obligation. The practice must still respond as if patient status were confidential — otherwise the practice is confirming the disclosure, which is itself a covered disclosure.
Q.Can we get the review removed as a HIPAA violation by the reviewer?
No — HIPAA binds covered entities (providers, health plans, clearinghouses), not patients. A patient publicly discussing their own care violates no law. Removal has to route through Google's policy channels (the four paths above), not through HIPAA enforcement.
Q.What about state laws that add extra restrictions?
Several states (CA, TX, NY, WA) layer additional patient-privacy statutes on top of HIPAA with higher penalties. The response template above is drafted to comply with the strictest of these; use it uniformly rather than tailoring per state.
