Online reputation management for doctors: what you can say

Doctor reputation management is the work of shaping what a patient finds when they search your name: the reviews on your Google Business Profile and the health directories, the replies sitting underneath them, and the profile details a search engine reads back. One rule separates it from every other industry. You cannot confirm in public that someone was your patient.

That changes the reply and what you do when a review is wrong about you. Everything below follows from it.

None of this is legal advice. Every regulatory statement here links to its source. Your obligations depend on where you practise and which board registers you, so read the source and take advice on anything close to the line.

Where patients look when they search for a doctor

Patients do not look in one place. Someone searching your practice name gets a Google Business Profile with a star rating, your website, and two or three directory profiles carrying medical practice reviews nobody at the clinic has ever seen. Google still dominates, though by less than it did: its share of consumers using it for local business reviews fell from 83% in 2025 to 71% in 2026, while Healthgrades and other long-standing directories picked up ground (BrightLocal, 2026). What matters is not the site. It is who controls it.

Surface	Who controls it	What you can do	The rule that bites
Google Business Profile	Google, with you as the verified owner	Edit details, reply to every review, report a review for removal	Google's content policies apply to your replies too
Your website, Facebook page or Instagram	You	Publish, edit, remove, or turn the reviews function off	Republish a patient review and you are the advertiser, so the compliance is yours
A health directory profile	The directory	Usually claim the profile, and reply where it allows replies	You cannot make them take a review down

Start by finding out what is out there. In a private browser window, search the practice name plus the suburb, then each practitioner by name, and list every profile on page one, including the ones nobody has ever logged into. Most practices are surprised by the length.

And a directory rating is not always a fair summary of what patients said. In 2020 the Federal Court ordered the booking platform HealthEngine to pay $2.9 million after it admitted leaving around 17,000 patient reviews unpublished and editing about 3,000 more (ACCC).

The rule that makes healthcare different: you cannot confirm someone was a patient

Every guide to reviews tells you to reply personally and reference the visit. In healthcare that advice is wrong, and in the United States it is unlawful.

In the US, the fact that a person received care from you is itself protected health information. HIPAA's definition covers anything that "relates to the past, present, or future physical or mental health or condition of an individual; the provision of health care to an individual" (45 CFR 160.103). A covered entity "may not use or disclose protected health information, except as permitted or required by this subpart" (45 CFR 164.502(a)), and a public reply is not one of those permitted purposes. Anything more needs the patient's written authorisation (45 CFR 164.508), which is what a named testimonial on your own website would need too.

This gets enforced. In June 2023 a New Jersey health centre paid $30,000 and accepted a corrective action plan after the Office for Civil Rights found it had disclosed the health information of four patients in replies to their negative Google reviews (HHS).

So "Sorry about the wait on Tuesday, Mrs Ellis, Dr Nguyen was running late after a long consult" is a disclosure. It confirms she attended, when, and who she saw. The reviewer volunteering all of it first releases you from nothing.

In Australia the constraint is a different one, and it catches practices that assume they are safe because HIPAA does not reach them. Section 133(1)(c) of the Health Practitioner Regulation National Law prohibits advertising a regulated health service in a way that "uses testimonials or purported testimonials". Ahpra's guidelines then draw a line most clinics have never seen. Advertisers are not responsible for removing testimonials on platforms they do not control, but "a regulated health service provider should take care if they choose to engage with reviews on a third-party site as this may be considered using a testimonial to advertise a regulated health service" (Ahpra, advertising guidelines, s4.3.3). Replying to a review about your clinical work can pull that review into your own advertising.

How to reply to a negative patient review

Both sets of rules point at the same reply. Four things cover almost every case.

1. Reply as the practice, in general terms. Say what your policy is, not what happened to this person.
2. Never confirm the person attended. No thanks for coming in, no dates, no practitioner name, no condition, and no thanking anyone for describing a clinical outcome.
3. Give exactly one route offline, with a name or a role and a direct contact, and mean it.
4. Keep it under sixty words. Length reads as defensiveness, and every extra clause is another chance to say something you cannot say.

Writing this way has a cost. Generic replies make 50% of consumers less likely to choose a business, while 80% say they are more likely to use one that answers every review (BrightLocal, 2026). A healthcare reply still has to sound like a person while disclosing nothing. Each template below works whether or not the reviewer was ever a patient. That is the test.

A clinical complaint, at a GP clinic. The review: "The doctor dismissed my symptoms and I ended up in hospital a week later."

Concerns about clinical care go to our clinical governance lead and are reviewed properly, every time. We are not able to discuss any individual's care in public. If you would like this looked at, call our practice manager on [phone] or email [email] and we will open a review today.

A wait time, at a busy family practice. The review: "Waited 50 minutes past my appointment time with two kids in the waiting room."

Fifty minutes is a long wait and we are sorry when anyone has one. Consultations run over when the person in the room needs more time than the booking allowed, which is no comfort at all when you are the one in the chairs outside. If you want us to look into a particular booking, reception is on [phone].

A billing dispute, at a specialist's rooms. The review: "Charged me a gap fee I was never told about. Avoid."

Our fees and any gap are quoted at booking and published at [link], and we would far rather explain a charge than have anyone leave confused by one. Accounts are not something we can go through here. Please call [name] on [phone] and she will take you through it.

None of them thanks the person for their visit, names a clinician, or argues a clinical fact. The facts that would win the argument are the facts you may not publish, which is why the argument is never worth having in public. Replies to reviews that are not clinical complaints have more room in them: see our guides to responding to negative patient reviews and positive review responses.

When a review gives away the patient's own health information

It happens constantly. A reviewer names their condition, their surgery date and the specialist who treated them, and the practice reads that as permission to answer in kind. It is not. The patient has waived their own privacy. They have not authorised you to disclose anything, and your obligations do not switch off because the other party spoke first. Use the pattern above and let the detail sit there unanswered.

Reporting it is worth a try. Google's Maps content policy prohibits "personally identifiable information and other personal information about yourself or others including financial information, medical information or personal identification information", so a review reciting a diagnosis breaches the policy on its face. The same clause allows a reviewer to name "a public-facing professional conducting business under their name", and doctors are the first example given, so being named is not the part to complain about.

On your own website there is one real decision. You may withhold a review that carries "the personal information or likeness of another individual", so long as you apply that criterion to every review regardless of sentiment (16 CFR 465.7(b)).

How to ask patients for reviews without breaking the rules

Asking is allowed. Most clinics under-use it because someone once told them healthcare was different. Healthcare is different in what you may publish, not in whether you may ask.

The US rules are written down. The FTC's Rule on the Use of Consumer Reviews and Testimonials (16 CFR Part 465) took effect on 21 October 2024 and makes all of these unfair or deceptive practices:

• an incentive conditioned on a review "expressing a particular sentiment, whether positive or negative" (§465.4), which rules out a prize draw for five-star reviews and a gift card for a good one;
• a review that materially misrepresents the reviewer or their experience (§465.2), which covers staff posting as patients;
• a review by an officer or manager without "clear and conspicuous disclosure" of that relationship (§465.5);
• suppressing reviews on your own site by rating or sentiment while implying you show them all (§465.7).

The same rule carves out "generalized solicitations to purchasers to post reviews or testimonials about their experiences" (§465.2). Asking every patient, the same way, with nothing attached, is the safe form and the effective one: 78% of consumers were asked for a review in the last 12 months, and 65% of those asked wrote one (BrightLocal, 2026). Asking is not the hard part. Remembering to do it is.

Never put a rating step in front of the review. Asking how the visit went and then showing the review links only to the people who answered well is review gating. It breaches Google's policies, it runs into §465.7, and in a clinic it produces a public rating that misrepresents your own patients. For the wording and the follow-up schedule, see our guide to getting more Google reviews.

When to send the ask: after the appointment, not after the invoice

A practice that asks at the front desk asks whoever is standing there. A practice that asks from its own system asks everyone.

The event you want is the completed appointment, not the payment. Payment fires at the wrong moment for a bulk-billed consult, fires twice for a package, and misses the patient who settles later. An appointment marked complete means someone arrived and was seen.

That is the job the practice management system does. Cloutly connects to Nookal and triggers on "Appointment Completed", gated on the patient having arrived, then sends on the timing the practice sets, straight after the appointment or the next morning; there is more on how clinics run it on our healthcare page. What keeps the asking from becoming a nuisance matters more than the trigger: a repeat patient is one contact asked once rather than one ask per visit, a second booking moves the ask instead of adding another, anyone who reviewed you in the last 90 days is skipped, follow-ups stop the moment the review lands, and a patient who opts out is never enrolled again.

One Google Business Profile for the practice, or one per doctor?

Both, and Google is specific about how. Its guidelines define an individual practitioner as "a public-facing professional, typically with their own customer base", and doctors and dentists lead the list of examples.

Where several practitioners work at one location, "the organization should create a Business Profile for this location, separate from that of the practitioner", and the practitioner's own profile is titled with only their name. A sole practitioner representing a branded organisation gets one profile named [brand/company]: [practitioner name]. A practitioner must be contactable at the verified location during the hours the profile states, and "shouldn't have multiple Business Profiles to cover all of their specializations". Support staff get no profile at all (Google).

Think the consequence through first. Every practitioner profile is a separate review pool with its own star rating, so a patient who reviews Dr Nguyen's profile has not reviewed the clinic. Most practices are better served by one strong practice profile plus profiles only for the practitioners who genuinely carry their own patient base.

What to do about a review you think is fake

Report it properly, and do not threaten anyone. Google's Reviews Management Tool takes the report and shows its status. Evaluation "typically takes several days", and a result of "Report reviewed - no policy violation" buys you one appeal, up to ten reviews at a time (Google). Cite fake and misleading content, impersonation, off-topic, or personal information. The full escalation path is in our guide to removing negative reviews from Google.

What you must not do is send a legal threat you cannot back. Using an "unfounded or groundless legal threat, a physical threat, intimidation, or a public false accusation" to get a review removed is itself an unfair or deceptive practice (16 CFR 465.7(a)). Clinics get this wrong more than most, because a defamation letter feels proportionate to a public accusation about clinical care. It is also the response most likely to make that accusation bigger.

Healthcare reputation management across several clinics

There is no group rating. A patient searching in Cheltenham sees the Cheltenham profile and its 4.2, and the fact that the other four sites average 4.8 is invisible to them. The weakest site is the one that gets found.

Three things change at that scale. Each location needs its own ask firing from its own appointment data, or the busy sites drown out the quiet ones. Reviews from every site have to land somewhere one person reads and clears, because a review left unanswered at your smallest clinic is as public as one at your largest. And each site's website and social accounts are separately your responsibility, so a compliance decision made at head office has to actually reach the Facebook page in Cheltenham.

Credit breaks at scale too. Most patient reviews name a person, and the exact way to capture that is the practice management system reading the practitioner off the completed appointment, or a review link and QR code per practitioner. Matching names in the review text fills the gaps, but can credit the wrong person when two people share a first name. The workflow changes by setting, so we have separate guides for physiotherapy clinics and home care agencies.

Doctor reputation management FAQ

Can I reply to a patient review without breaching HIPAA? Yes, as long as the reply discloses nothing. Do not confirm the person attended, do not name a practitioner or a treatment, and do not respond to clinical detail even when the reviewer raised it first. The fact that someone received care from you is itself protected health information (45 CFR 160.103).

Can an Australian practice ask patients for Google reviews? Asking and publishing are different questions. The National Law restricts advertising a regulated health service by using testimonials, and Ahpra's guidelines warn that engaging with reviews on a third-party site may itself count as advertising with one (Ahpra). Read them before you put a patient review on your own site.

Can I offer patients a discount for leaving a review? Not on Google, whose policy bars merchants from offering "payment, discounts, free goods and/or services" in exchange for posting any review. The FTC rule is narrower: it bans an incentive conditioned on the review expressing a particular sentiment, and FTC staff say an unconditional incentive is not prohibited by the rule itself, though failing to disclose one can breach the FTC Act (FTC). For a clinic, ask with nothing attached.

Should every doctor in the practice have their own Google Business Profile? Only the ones who are public-facing, contactable at the location, and carrying their own patient base. Google requires the practice profile and the practitioner profile to be separate, and every extra profile splits your reviews into another pool.