How to respond to negative patient reviews: what not to say

Reply as the practice, in general terms, and never confirm that the person who wrote the review was ever a patient. Say what your standard is instead of what happened to them, put one named person on a phone number, and stop at sixty words. That is how to respond to negative patient reviews without creating a problem larger than the review, and it means giving up nearly everything an ordinary reply does: the reviewer's first name, the date, the apology for the specific thing that went wrong.

Most advice about responding to patient reviews skips that part. These seven templates do not.

None of this is legal advice, and none of it was written by a lawyer. Every rule below links to the regulator that wrote it, because which one applies to you depends on where you practise and who registers you. Read the source, and take advice before you go near the edge of one.

The one rule: you cannot confirm they were a patient

In the United States, the fact that someone was treated by you is itself protected health information. A public reply that confirms it is a disclosure, and every disclosure needs either a permitted purpose or the patient's written authorisation. Defending yourself in public is not on the list (45 CFR 164.502(a)).

This gets enforced, and the money is the cheap part. Manasa Health Center, a psychiatric practice in Kendall Park, New Jersey, paid $30,000 to the HHS Office for Civil Rights, which found it had disclosed the protected health information of four patients in replies to their negative Google reviews. The agreement was signed in March 2023 and announced by OCR that June. It also put the practice on a two-year corrective action plan: privacy policies submitted to HHS for approval, training for every workforce member including the owners, and, within 30 days, breach notices to every individual whose information it had published on Google Reviews or any other platform (HHS).

Read that last part twice. The replies were a reportable breach, and the practice had to write to the patients it had named and tell them so.

Australia catches this with a different rule, and it is an advertising one rather than a privacy one. Section 133 of the National Law prohibits advertising a regulated health service using testimonials, and since the 2022 amendments the maximum penalty is $60,000 per offence for an individual and $120,000 for a body corporate. Ahpra's guidelines then warn that "a regulated health service provider should take care if they choose to engage with reviews on a third-party site as this may be considered using a testimonial to advertise a regulated health service" (Ahpra, s4.3.3).

The rules come from different places, but the reply is the same. Write one that would be safe if the reviewer had never set foot in the building. It will be safe under both.

What a compliant reply looks like, next to one that is not

Here is a one-star review at a fictional general practice, Kingsmere Family Practice.

Waited over an hour past my appointment time and then got six minutes with the doctor. Not good enough for a $95 out-of-pocket.

This is the reply most practices would write. It is also, clause by clause, the thing OCR fined Manasa for.

Hi Marion, we are so sorry about your visit on the 14th. Dr Hale was called to an emergency that morning and ran behind all day. Please call the clinic and we will look again at your account and the charge for your knee review.

Five clauses, four disclosures, and one that ties them to a person.

The words	What they give away
"your visit on the 14th"	that she attended, and when
"Dr Hale was called to an emergency"	which clinician she saw
"we will look again at your account"	that she is a patient with a billing record
"the charge for your knee review"	the body part, the appointment type, the reason for the visit
"Hi Marion"	on its own, nothing. Attached to the four above, it ties all of it to a named person

She volunteered the wait, the money and the six minutes herself. That releases you from none of it. Her disclosure is hers. It is not your authorisation.

Here is the same complaint answered with nothing given away.

An hour past a booked time is not the standard we set, and neither is a consultation that feels rushed once you finally get in. We cannot discuss any individual's appointment or account in a public forum. Our practice manager, Dana, is on [phone] and will go through any invoice line by line. Kingsmere Family Practice

It answers both complaints, sets a standard against them, and puts a person on the phone. It confirms nothing. It would read exactly the same if the reviewer had never been near the building.

Why it's important to respond to a negative patient review

Because the reply is not for the person who wrote it. It is for the next person reading the profile, who is choosing a clinic while feeling unwell and is trying to work out what happens here when something goes wrong.

An unanswered one-star review can look like the practice agrees with it. An answered one shows a process: a complaint reaches a named person and gets looked at. That does more than a rebuttal you are not allowed to publish. In BrightLocal's Local Consumer Review Survey 2026 (published 11 February 2026, 1,002 US adults), 89% of consumers said they expect business owners to respond to reviews.

Careful replies can look templated. The only way out is to make the general parts specific: name the standard, name what changed, name the person to ring.

How to respond to negative patient reviews: seven templates

These cover seven cases a clinic will run into. Each comes from a different fictional practice. The three plainest cases, a clinical complaint, a long wait and a billing dispute, are answered in online reputation management for doctors, and the one star with nothing written under it in how to respond to a 1-star review on Google.

1. A staff member is named

The receptionist, Bec, was rude and rolled her eyes at me when I asked how much longer.

Nobody should feel talked down to at our front desk, and a complaint about one of our team is taken seriously wherever it arrives from. Those come to me, and they get handled properly, which means privately rather than here. I am on [phone] most days before four. Tomas, practice manager, Ashgrove Medical Centre

Do not confirm who was on that morning, and never publish a verdict on a staff member. Google's content policy lets a reviewer name "a public-facing professional conducting business under their name" and lists doctors first. A receptionist is not one, so naming her may breach the personal information clause on its own.

2. The review recites the patient's own health information

Diagnosed with [condition] in March, three appointments with Dr [name], and I am still waiting on the referral.

Thank you for writing this down. There is detail here we are not able to discuss publicly, even though you have raised it yourself, so we are not going to repeat any of it back to you. What we can do is look at the complaint properly. Call [phone] and ask for me. Renée, Verity Women's Health

Say why you are being brief, or the brevity reads as indifference. Then report it. Google's Maps policy prohibits "medical information" about "yourself or others", which puts a review reciting its author's own diagnosis in breach on its face.

3. The review belongs to a different clinic

Worst dentist in the city. Cracked a filling and then wanted $600 to fix their own work.

We think this may belong to a different clinic. We have no record of the appointment described here and we do not offer that treatment. We would rather say so than leave it sitting unanswered. If we have got that wrong, call [phone] and ask for me and I will find it. Sam, Coastline Physio

"No record of the appointment described", never "no record of you". Every other industry can write "we have no appointment under your name", and our review response examples do. A clinic cannot: denying that a named person is a patient is still a statement about that person. The last sentence saves you when they turn out to have booked under another name.

4. The review is abusive

[Profanity]. Absolute [profanity] and the whole [profanity] practice should be shut down.

We are not going to answer this here. If there is a problem with an appointment or an account behind it, ring me and I will sort it out. [phone], weekdays until five. Marcus, Broadwater Podiatry

One line, no repetition, then report it. Google's policy covers content "using profanity or obscenity to offend other users or emphasize criticism". Describing the abuse in your reply republishes it for everyone who did not scroll that far.

5. A family member writes for the patient

My mother was left in the waiting room for two hours and she is 84 and diabetic.

Thank you for writing. We are not able to discuss any patient's care in public, and a family member's account of it is not permission to, which we know is maddening when you are the one doing the chasing. If you have authority to act for the person involved, call [phone] and ask for me. Jo, Redgate Medical Centre

A relative is not automatically a personal representative. And a public reply discloses to everyone reading it, not to the daughter who asked.

6. A five-star review that names the clinician

Dr [name] is the best dentist I have ever had. She found what two others missed and I would not go anywhere else.

Thank you for taking the time. We cannot say anything about any individual's care here, so all we can say is that this will be read out at our next team meeting and it will mean a great deal. We are on [phone] if we can help with anything. Aiden, Marlow Dental

The glowing one is where practices often slip, because naming the clinician back confirms she treated this person. In Australia it is also where Ahpra's warning bites hardest, since engaging with a testimonial may itself count as using one to advertise.

7. A complaint you have already fixed

Two stars in June. The clinic manager rang the next day and actually fixed it. Updating to four.

We are not going to set out what happened, because it is not ours to publish. What we can say is what changed. Since July, anyone waiting more than fifteen minutes past a booked time is told why and offered a rebooking. Complaints that arrive by phone get further than complaints that arrive here. Bel, Ellerslie Skin Clinic

If a practice visibly changes something after a complaint, the next reader notices. Only write this one if the change is real.

What never goes in a reply

The reviewer's first name attached to anything specific. The date of an appointment. The name of the treating clinician. A condition, a procedure, a medication, an appointment type or a body part. Any correction of a clinical fact. Anything out of their file, including "we have no record of the treatment you describe" said about a person rather than about an appointment.

Nor an offer of anything in exchange for taking the review down. Google's content policy bars merchants from offering "payment, discounts, free goods and/or services" for the removal of a negative review, and the FTC's rule makes an "unfounded or groundless legal threat, a physical threat, intimidation, or a public false accusation" used to suppress a review an unfair or deceptive practice (16 CFR 465.7(a)). A defamation letter feels proportionate when the accusation is about clinical care. It is also the most reliable way to make that accusation bigger.

When to take it offline, and how to say so without confirming anything

Take it offline whenever the complaint is clinical, whenever money is involved, and whenever the reviewer has published detail about themselves. That is most of them.

The wording is where people slip. "Please contact us so we can resolve your issue" confirms there is an issue belonging to them, and gives the next reader nothing. Write the invitation so it stands on its own:

Anything to do with an individual's care or account is dealt with by phone rather than here. [Name] is on [phone], weekdays, and will pick it up the same day.

A named person, because "the practice" is nobody. Real hours, because a route nobody answers is worse than no route. And no "your" anywhere in it. A reply that has sat in drafts for two days usually needed a phone call instead.

Monitor all of your patient reviews, across every location

Every clinic carries its own rating and nothing averages them, so someone searching in one suburb gets that site's profile and its 3.9 while the 4.7 across your other four stays invisible.

Once you have more than one location, the hard part is not the writing. It is the queue. Reviews land on whichever clinic's profile they belong to, nobody at head office watches all of them, and the site with the fewest staff answers the fewest reviews. What works is one queue, one voice, a second pair of eyes on anything clinical, and a named owner who is never the clinician the review is about. Cloutly drafts a reply for each review and hands it to a person to edit and send. It never posts on its own, which is the part that matters in a clinic. There is more on how practices run it on our healthcare page. Home care agencies answer the family rather than the client, which changes the wording: reviews for home care agencies.

One thing to leave alone while you tidy the process up. Never put a rating question in front of the review link so only the happy patients reach Google. That is review gating, it breaches Google's policies, and a filtered rating on a clinic profile misrepresents your own patients.

When a patient review can be reported and removed

Reporting is worth a try, and clinical reviews breach the content policies more often than other industries' do. The strongest grounds are a review reciting medical or personal information about anyone, profanity used to emphasise criticism, harassment, and a review plainly about a different business.

Report it from the profile or in the Reviews Management Tool, which shows the status: decision pending, reviewed with no policy violation, or escalated. Evaluation "typically takes several days", and one appeal covers up to ten reviews at a time (Google). Only policy breaches are eligible. Disliking a review is not one.

Report and reply the same day. Removal is slow and often fails, so write the reply as though it will stay up. What evidence moves a report is in how to get a negative Google review removed.

Frequently asked questions

Can a doctor respond to a patient review? Yes, as long as the reply carries no disclosure in it. That rules out confirming the appointment, naming the clinician or the treatment, and engaging with clinical detail even where the reviewer put it there first. In the United States, having been treated by you is protected health information on its own (45 CFR 164.502(a)).

Is replying to a Google review a HIPAA violation? The reply is not. The disclosure inside it is. OCR's settlement with Manasa Health Center turned on protected health information published in replies to four negative Google reviews, and it required the practice to notify those individuals of a breach (HHS).