Google reviews for home care agencies almost always come from the family. The person who compared three providers, signed the agreement, holds the roster and rings when a carer is late is usually a son or a daughter, and they are the one who writes. So the ask goes to the contact your office already emails, it goes after the first month rather than the first visit, and the reply you write underneath never confirms who the client is or what care they receive.

That is where providers slip. Set one thing aside first: a review is not a complaint, and answering a review does not answer one. Whatever your provider does when a family raises something formally is unaffected by anything here.

Who writes a home care review, and why it is rarely the client

Some clients write their own, and those are the best reviews you will ever get. Most do not. The client may be 88 and off email, or living with dementia, or three weeks home from hospital and uninterested in rating anybody. The relationship with your office belongs to the adult child.

That makes your contact list easier than it looks. You already have a family contact on the account: the person you send the schedule to and who queries the invoice. That person is the reviewer.

Two rules follow. Ask the family contact rather than the client, unless the client has said they want to write one. And do not ask both about the same person, because two requests about one set of visits reads as pressure on a family that is already stretched.

It changes what comes back, too. A family reviews reliability and communication: whether the same face turns up, whether the office answers at 7am when a carer is stuck in traffic. They rarely review the care itself, because they were not in the room.

The mechanics of asking are the same as in any service business, and they are in how to get more Google reviews. What is different here is the timing and the recipient.

How to get Google reviews for home care agencies: ask after the first month, not the first visit

Ask after roughly a month of visits. The first visit is much too early: the family is anxious, a parent has just come out of hospital, the roster has not settled and the carer may change twice in the first fortnight. There is nothing to review yet, and asking looks like you are collecting the review before you have done the work. By week four they know whether it is working, and you get a review with something in it.

The other reason to hold the ask is sadder. Care ends. A client dies, or moves into residential care after a fall, and an automated request lands in a daughter's inbox four days later. Nothing does more damage to a home care brand than that message. Whatever you use to send the ask has to let you take a contact out and keep them out.

Then ask once. Providers who over-ask do it by accident, because a repeat booking triggers a repeat request and one family gets four messages about one parent. Cloutly treats each family contact as one contact asked once, so a second booking moves the ask rather than adding one; it skips anyone who reviewed you in the last 90 days, stops the follow-ups the moment the review lands, and never enrols a contact who has opted out. There is more on how providers run it on our home care page.

One thing never to build in. Do not put a rating question in front of the review link so that only the happy families reach Google. That is review gating, it breaches Google's policies, and in care it reads as suppression to anyone who works out what you did.

What you can say in a reply to a home care review

Reply as the provider, in general terms, and never confirm who the client is or what care they receive. Thank the person for writing rather than for the care, put one named person on a real phone number, and stop at about sixty words.

Most advice tells you the opposite: thank the reviewer by name and mention the carer they praised. In home care that is the one thing not to do, and the reason is not a legal one. The daughter who wrote the review chose to make her situation public. Her mother did not. "Thank you for having us with your mother three mornings a week since March" publishes facts about a person who never agreed to any of it, in front of her neighbours and anyone else who searches you. The reviewer waived her own privacy, not the client's.

The test is easy. Read the reply back and ask whether it would still be true and sensible if the person who wrote it had never been a client of yours.

Three replies, from three invented providers.

A five-star review that names a carer. At Ashfern Home Care, the review reads: "Nell has been coming three mornings a week since April and she has been wonderful. Mum actually looks forward to seeing her."

Thank you for writing this down. We do not discuss anyone's care arrangements here, so all we will say is that your message has gone to the person you named and to her coordinator, and it will mean a great deal to both of them. We are on [phone] if there is ever anything you need.

It gives back nothing: not the client, not the days, not the start date, not even confirmation that the carer named works those visits.

A complaint about continuity. At Kelvedge Care at Home: "Four different carers in three weeks and nobody tells us who is coming."

Four faces in three weeks is not the continuity we aim for, and not knowing who is at the door is worse than the changes themselves. We are not able to go through an individual schedule in public. Our client services manager, [name], is on [phone] on weekdays and will go through it properly.

A review you cannot match to anyone. At Sedgeholm Home Care: "Absolutely hopeless. Two missed visits in a fortnight and not one apology."

This one is more common in home care than anywhere else, because your bookings sit under the client's name and the reviewer is a daughter with a different surname. You often cannot tell whether it is yours. Do not write "we have no record of you", which is a statement about a named person, and do not write "we have no client by that name", which confirms who is and is not a client.

A missed visit with no call afterwards is not something we would leave, and I would like to find this one. We are not able to match a public review to an account, and we would not go through an account here in any case. Ring [phone] and ask for [name] and she will look today.

The same constraint applies in how to respond to negative patient reviews, and its wider version is in online reputation management for doctors.

When a review names one of your carers

Most of the time, do nothing except tell the carer. Usually the naming is praise, and the person named never hears about it unless somebody in the office bothers to say so.

When the naming comes with an accusation, it is worth reporting, and the grounds are better than most providers assume. Google's policy on personal information says "Do not distribute or post personal information without consent", and lists medical information among what is not allowed. It then names two exceptions: a name that is part of the commonly known or advertised business entity, and "An individual's name if they are a public-facing professional conducting business under their name", the examples being doctors, lawyers, realtors, financial planners and contractors (Google).

A support worker employed by your agency is neither. She is not the business entity, and she is not conducting business under her own name, so the exception written for a named GP is a poor fit for her. Where a review names a carer and also sets out somebody's care needs, the personal information clause is the ground to point at, and the health detail is the part of the report most likely to land. What a report needs, and what to do when it is refused, is in how to get a negative Google review removed.

Two things not to do. Never publish a verdict on a named carer in the reply, however sure you are of your own person, because that reply is read by every family you have. And never set up a Google Business Profile for a carer. Google reserves those for "a public-facing professional, typically with their own customer base" contactable at the verified location during stated hours, and says plainly that "support staff should not create their own Business Profiles" (Google). A carer working in a client's living room is neither.

Credit the carer the family named

A home care review usually names somebody. The carer is the only part of your service the family sees, so she is the part they write about.

There are two ways to capture that and only one is exact. Give each carer her own review link, on a card or a QR code she can leave behind, and the review arrives already attached to her. Name matching in the review text fills the gaps, but it can credit the wrong person when two carers share a first name, and it misses every review that names nobody. Personal links first, name matching as the backstop.

The credit is not a scoreboard for its own sake. It is a name read out at a Monday handover, and a coordinator who can see which of her people has not been named in three months and might be on the wrong runs.

"Cloutly has helped us shine a light on the incredible work our care team does every day. It's made recognising and celebrating our top performers simple and meaningful."

Rochelle Morrison, Head of Marketing at Dovida

Where aged care provider reviews get read

Google first, and it is not close. In BrightLocal's Local Consumer Review Survey 2026 (published 11 February 2026, 1,002 US consumers), 71% said they used Google for local business reviews, down from 83% the year before. It is the rating sitting beside your name when a family searches home care in their suburb at the end of a bad week.

Home care providers have one Google setting other businesses never think about. You visit clients; they do not visit you. Google calls that a service-area business, "a business that visits or delivers to customers directly but doesn't serve customers at their business address", and its instruction is blunt: take the address off the profile. Declare the areas you cover instead, up to 20 of them, set by city or postal code rather than a radius, and all inside about two hours' driving of where the business is based (Google). Get it wrong and your office address sits in front of families who will never go there, while the suburbs you cover go undeclared.

Caring.com is the other directory worth naming here because its rules are published and readable. It requires a reviewer to have "firsthand experience with the listed service provider within three (3) years" and not to be "an employee, former employee, or paid representative" or a competitor. Its reply process is unlike Google's: you send the response with your name, job title and a contact number, none of which is published, and it appears under the review only once Caring's reviews team approves it (Caring.com).

Read the rules of any other care directory before you point a family at it. They differ more than you would expect.

Reviews for care agencies across a network of franchise territories

A network has no shared rating. Every territory carries its own Google profile, so a family searching one suburb sees that office's 4.2 and never learns that the eleven around it average 4.8.

Two things go wrong at that scale, and neither is the wording of a reply. If only the busy offices ask, the network average head office reads is one franchisee's habit. And franchisees feel their reviews are theirs, which they are, so settle who replies before the rollout rather than after the first one-star. Both are worked through in multi-location review management.

Frequently asked questions

Can a family member leave a Google review for a home care client? Yes, and in home care it is the normal case rather than the exception. Google's contribution policies govern what a review contains, not which member of a household writes it. The clause to know is the one on personal information, which restricts posting medical and other personal information about other people without their consent.

Should each carer have their own Google Business Profile? No. Google reserves an individual profile for "a public-facing professional, typically with their own customer base" contactable at the verified location during stated hours, and states that "support staff should not create their own Business Profiles" (Google). Give the carer her own review link instead, so she gets the credit without a profile nobody can maintain.

Should our office address show on our Google Business Profile? Only if families genuinely come to the office. If your carers travel to clients, you are a service-area business: the address comes off, and you list up to 20 service areas by city or postal code instead (Google).

Doctor reputation management is the work of shaping what a patient finds when they search your name: the reviews on your Google Business Profile and the health directories, the replies sitting underneath them, and the profile details a search engine reads back. One rule separates it from every other industry. You cannot confirm in public that someone was your patient.

That changes the reply and what you do when a review is wrong about you. Everything below follows from it.

None of this is legal advice. Every regulatory statement here links to its source. Your obligations depend on where you practise and which board registers you, so read the source and take advice on anything close to the line.

Where patients look when they search for a doctor

Patients do not look in one place. Someone searching your practice name gets a Google Business Profile with a star rating, your website, and two or three directory profiles carrying medical practice reviews nobody at the clinic has ever seen. Google still dominates, though by less than it did: its share of consumers using it for local business reviews fell from 83% in 2025 to 71% in 2026, while Healthgrades and other long-standing directories picked up ground (BrightLocal, 2026). What matters is not the site. It is who controls it.

Start by finding out what is out there. In a private browser window, search the practice name plus the suburb, then each practitioner by name, and list every profile on page one, including the ones nobody has ever logged into. Most practices are surprised by the length.

And a directory rating is not always a fair summary of what patients said. In 2020 the Federal Court ordered the booking platform HealthEngine to pay $2.9 million after it admitted leaving around 17,000 patient reviews unpublished and editing about 3,000 more (ACCC).

The rule that makes healthcare different: you cannot confirm someone was a patient

Every guide to reviews tells you to reply personally and reference the visit. In healthcare that advice is wrong, and in the United States it is unlawful.

In the US, the fact that a person received care from you is itself protected health information. HIPAA's definition covers anything that "relates to the past, present, or future physical or mental health or condition of an individual; the provision of health care to an individual" (45 CFR 160.103). A covered entity "may not use or disclose protected health information, except as permitted or required by this subpart" (45 CFR 164.502(a)), and a public reply is not one of those permitted purposes. Anything more needs the patient's written authorisation (45 CFR 164.508), which is what a named testimonial on your own website would need too.

This gets enforced. In June 2023 a New Jersey health centre paid $30,000 and accepted a corrective action plan after the Office for Civil Rights found it had disclosed the health information of four patients in replies to their negative Google reviews (HHS).

So "Sorry about the wait on Tuesday, Mrs Ellis, Dr Nguyen was running late after a long consult" is a disclosure. It confirms she attended, when, and who she saw. The reviewer volunteering all of it first releases you from nothing.

In Australia the constraint is a different one, and it catches practices that assume they are safe because HIPAA does not reach them. Section 133(1)(c) of the Health Practitioner Regulation National Law prohibits advertising a regulated health service in a way that "uses testimonials or purported testimonials". Ahpra's guidelines then draw a line most clinics have never seen. Advertisers are not responsible for removing testimonials on platforms they do not control, but "a regulated health service provider should take care if they choose to engage with reviews on a third-party site as this may be considered using a testimonial to advertise a regulated health service" (Ahpra, advertising guidelines, s4.3.3). Replying to a review about your clinical work can pull that review into your own advertising.

How to reply to a negative patient review

Both sets of rules point at the same reply. Four things cover almost every case.

1. Reply as the practice, in general terms. Say what your policy is, not what happened to this person.
2. Never confirm the person attended. No thanks for coming in, no dates, no practitioner name, no condition, and no thanking anyone for describing a clinical outcome.
3. Give exactly one route offline, with a name or a role and a direct contact, and mean it.
4. Keep it under sixty words. Length reads as defensiveness, and every extra clause is another chance to say something you cannot say.

Writing this way has a cost. Generic replies make 50% of consumers less likely to choose a business, while 80% say they are more likely to use one that answers every review (BrightLocal, 2026). A healthcare reply still has to sound like a person while disclosing nothing. Each template below works whether or not the reviewer was ever a patient. That is the test.

A clinical complaint, at a GP clinic. The review: "The doctor dismissed my symptoms and I ended up in hospital a week later."

Concerns about clinical care go to our clinical governance lead and are reviewed properly, every time. We are not able to discuss any individual's care in public. If you would like this looked at, call our practice manager on [phone] or email [email] and we will open a review today.

A wait time, at a busy family practice. The review: "Waited 50 minutes past my appointment time with two kids in the waiting room."

Fifty minutes is a long wait and we are sorry when anyone has one. Consultations run over when the person in the room needs more time than the booking allowed, which is no comfort at all when you are the one in the chairs outside. If you want us to look into a particular booking, reception is on [phone].

A billing dispute, at a specialist's rooms. The review: "Charged me a gap fee I was never told about. Avoid."

Our fees and any gap are quoted at booking and published at [link], and we would far rather explain a charge than have anyone leave confused by one. Accounts are not something we can go through here. Please call [name] on [phone] and she will take you through it.

None of them thanks the person for their visit, names a clinician, or argues a clinical fact. The facts that would win the argument are the facts you may not publish, which is why the argument is never worth having in public. Replies to reviews that are not clinical complaints have more room in them: see our guides to responding to negative patient reviews and positive review responses.

When a review gives away the patient's own health information

It happens constantly. A reviewer names their condition, their surgery date and the specialist who treated them, and the practice reads that as permission to answer in kind. It is not. The patient has waived their own privacy. They have not authorised you to disclose anything, and your obligations do not switch off because the other party spoke first. Use the pattern above and let the detail sit there unanswered.

Reporting it is worth a try. Google's Maps content policy prohibits "personally identifiable information and other personal information about yourself or others including financial information, medical information or personal identification information", so a review reciting a diagnosis breaches the policy on its face. The same clause allows a reviewer to name "a public-facing professional conducting business under their name", and doctors are the first example given, so being named is not the part to complain about.

On your own website there is one real decision. You may withhold a review that carries "the personal information or likeness of another individual", so long as you apply that criterion to every review regardless of sentiment (16 CFR 465.7(b)).

How to ask patients for reviews without breaking the rules

Asking is allowed. Most clinics under-use it because someone once told them healthcare was different. Healthcare is different in what you may publish, not in whether you may ask.

The US rules are written down. The FTC's Rule on the Use of Consumer Reviews and Testimonials (16 CFR Part 465) took effect on 21 October 2024 and makes all of these unfair or deceptive practices:

• an incentive conditioned on a review "expressing a particular sentiment, whether positive or negative" (§465.4), which rules out a prize draw for five-star reviews and a gift card for a good one;
• a review that materially misrepresents the reviewer or their experience (§465.2), which covers staff posting as patients;
• a review by an officer or manager without "clear and conspicuous disclosure" of that relationship (§465.5);
• suppressing reviews on your own site by rating or sentiment while implying you show them all (§465.7).

The same rule carves out "generalized solicitations to purchasers to post reviews or testimonials about their experiences" (§465.2). Asking every patient, the same way, with nothing attached, is the safe form and the effective one: 78% of consumers were asked for a review in the last 12 months, and 65% of those asked wrote one (BrightLocal, 2026). Asking is not the hard part. Remembering to do it is.

Never put a rating step in front of the review. Asking how the visit went and then showing the review links only to the people who answered well is review gating. It breaches Google's policies, it runs into §465.7, and in a clinic it produces a public rating that misrepresents your own patients. For the wording and the follow-up schedule, see our guide to getting more Google reviews.

When to send the ask: after the appointment, not after the invoice

A practice that asks at the front desk asks whoever is standing there. A practice that asks from its own system asks everyone.

The event you want is the completed appointment, not the payment. Payment fires at the wrong moment for a bulk-billed consult, fires twice for a package, and misses the patient who settles later. An appointment marked complete means someone arrived and was seen.

That is the job the practice management system does. Cloutly connects to Nookal and triggers on "Appointment Completed", gated on the patient having arrived, then sends on the timing the practice sets, straight after the appointment or the next morning; there is more on how clinics run it on our healthcare page. What keeps the asking from becoming a nuisance matters more than the trigger: a repeat patient is one contact asked once rather than one ask per visit, a second booking moves the ask instead of adding another, anyone who reviewed you in the last 90 days is skipped, follow-ups stop the moment the review lands, and a patient who opts out is never enrolled again.

One Google Business Profile for the practice, or one per doctor?

Both, and Google is specific about how. Its guidelines define an individual practitioner as "a public-facing professional, typically with their own customer base", and doctors and dentists lead the list of examples.

Where several practitioners work at one location, "the organization should create a Business Profile for this location, separate from that of the practitioner", and the practitioner's own profile is titled with only their name. A sole practitioner representing a branded organisation gets one profile named [brand/company]: [practitioner name]. A practitioner must be contactable at the verified location during the hours the profile states, and "shouldn't have multiple Business Profiles to cover all of their specializations". Support staff get no profile at all (Google).

Think the consequence through first. Every practitioner profile is a separate review pool with its own star rating, so a patient who reviews Dr Nguyen's profile has not reviewed the clinic. Most practices are better served by one strong practice profile plus profiles only for the practitioners who genuinely carry their own patient base.

What to do about a review you think is fake

Report it properly, and do not threaten anyone. Google's Reviews Management Tool takes the report and shows its status. Evaluation "typically takes several days", and a result of "Report reviewed - no policy violation" buys you one appeal, up to ten reviews at a time (Google). Cite fake and misleading content, impersonation, off-topic, or personal information. The full escalation path is in our guide to removing negative reviews from Google.

What you must not do is send a legal threat you cannot back. Using an "unfounded or groundless legal threat, a physical threat, intimidation, or a public false accusation" to get a review removed is itself an unfair or deceptive practice (16 CFR 465.7(a)). Clinics get this wrong more than most, because a defamation letter feels proportionate to a public accusation about clinical care. It is also the response most likely to make that accusation bigger.

Healthcare reputation management across several clinics

There is no group rating. A patient searching in Cheltenham sees the Cheltenham profile and its 4.2, and the fact that the other four sites average 4.8 is invisible to them. The weakest site is the one that gets found.

Three things change at that scale. Each location needs its own ask firing from its own appointment data, or the busy sites drown out the quiet ones. Reviews from every site have to land somewhere one person reads and clears, because a review left unanswered at your smallest clinic is as public as one at your largest. And each site's website and social accounts are separately your responsibility, so a compliance decision made at head office has to actually reach the Facebook page in Cheltenham.

Credit breaks at scale too. Most patient reviews name a person, and the exact way to capture that is the practice management system reading the practitioner off the completed appointment, or a review link and QR code per practitioner. Matching names in the review text fills the gaps, but can credit the wrong person when two people share a first name. The workflow changes by setting, so we have separate guides for physiotherapy clinics and home care agencies.

Doctor reputation management FAQ

Can I reply to a patient review without breaching HIPAA? Yes, as long as the reply discloses nothing. Do not confirm the person attended, do not name a practitioner or a treatment, and do not respond to clinical detail even when the reviewer raised it first. The fact that someone received care from you is itself protected health information (45 CFR 160.103).

Can an Australian practice ask patients for Google reviews? Asking and publishing are different questions. The National Law restricts advertising a regulated health service by using testimonials, and Ahpra's guidelines warn that engaging with reviews on a third-party site may itself count as advertising with one (Ahpra). Read them before you put a patient review on your own site.

Can I offer patients a discount for leaving a review? Not on Google, whose policy bars merchants from offering "payment, discounts, free goods and/or services" in exchange for posting any review. The FTC rule is narrower: it bans an incentive conditioned on the review expressing a particular sentiment, and FTC staff say an unconditional incentive is not prohibited by the rule itself, though failing to disclose one can breach the FTC Act (FTC). For a clinic, ask with nothing attached.

Should every doctor in the practice have their own Google Business Profile? Only the ones who are public-facing, contactable at the location, and carrying their own patient base. Google requires the practice profile and the practitioner profile to be separate, and every extra profile splits your reviews into another pool.

A physiotherapy clinic usually does not need more marketing channels. It needs the few channels patients already use to tell the same convincing story: the clinic is nearby, the right practitioner is available, booking is straightforward and other patients felt looked after.

That makes the order of work important. Fix the local listing and booking path first. Ask for feedback after a real appointment. Read what patients say. Only then spend money sending more people into the system.

Start where a patient starts

Someone with a sore shoulder is not studying your brand platform. They are searching for a clinic close enough to visit, checking whether you treat the problem, looking at the next available appointment and reading a few recent reviews.

Test that path on a phone:

1. Search for a physiotherapist in your suburb without using the clinic name.
2. Open your Google Business Profile.
3. Check the category, address, hours, phone, booking link and practitioner information.
4. Follow the booking link all the way to an available appointment.
5. Read the first five reviews a new patient sees.

Write down every hesitation. A wrong holiday hour or a booking page that hides prices can waste more demand than a month without posting on Instagram.

If the profile needs work, start with editing your Google Business Profile and keeping your name, address and phone consistent.

Give each service a page with a real job

One clinic page that lists “sports, rehabilitation, pain and mobility” gives search engines and patients little to work with. Build a useful page for each major service you genuinely provide. Explain who it is for, what an initial appointment involves, who delivers it, where it is available and how to book.

Do the same for locations. A clinic with two practices needs two honest location pages, not one page copied twice with the suburb changed. Show the actual team, parking or public transport notes, accessibility information and location-specific hours.

This is less glamorous than a campaign. It also keeps working after the campaign ends.

Ask for feedback at a moment that makes sense

The best moment is usually after the patient has had enough contact to form an opinion, not five minutes after they book. That might be after a completed appointment, a milestone in a treatment plan or discharge. The right trigger depends on the clinic and its patient-management system.

Keep the request simple:

Hi Sam, thanks for visiting Coastline Physio. If you have a moment, you can share an honest review here: [link]. Your feedback helps our team and people looking for a local physio.

Ask every eligible patient under the same rule. Do not ask only the people who sound happy, and do not send unhappy patients to a private form while everyone else gets the public link. That is review gating, and it produces biased feedback even before platform rules enter the picture.

Google allows businesses to share a review link or QR code, but prohibits incentives and attempts to manipulate ratings. Its Business Profile review guidance is a sensible baseline: invite honest feedback without telling the patient what score to leave.

Australian clinics need to treat testimonials carefully

If the clinic is in Australia, health advertising has an extra constraint. Ahpra's advertising guidelines say advertising for a regulated health service must not use testimonials about clinical aspects such as symptoms, diagnosis, treatment or outcomes.

A patient independently reviewing a clinic on a third-party site is not automatically an advertisement controlled by the clinic. The risk changes when the clinic republishes, promotes, edits or otherwise uses that review in its own marketing.

That means a review praising reception, punctuality or communication may raise different issues from one claiming a treatment cured an injury. Do not assume a public review is safe to paste onto the clinic website. Have the clinic's advertising reviewed against the current National Law and guidance. This is a marketing workflow, not legal advice.

For negative public feedback, the response also needs to protect patient privacy. The guide to responding to negative patient reviews covers the line between being helpful and confirming someone is a patient.

Reviews and surveys answer different questions

Public reviews tell you what a patient chose to say where future patients can see it. A private survey can ask about a specific part of the visit and hear from people who would never post publicly.

Use both, but do not make one a gate for the other.

If surveys repeatedly mention parking, explain parking before the appointment. If reviews praise one practitioner for explaining things clearly, share the recognition internally and work out what the rest of the team can learn from it. Reading reviews at scale is useful once the clinic has too much feedback to hold in one person's head.

Make rebooking part of the experience

Retention is not a clever message sent three months later. It starts before the patient leaves.

• Make the next step clear at the end of the appointment.
• Give the patient a written plan they can understand.
• Send reminders through the channel they chose.
• Make rescheduling easier than missing the appointment.
• Follow up when the treatment plan says you will, not when a promotion is due.

Some patients should finish care and not return. Good retention is not keeping everyone forever. It is reducing avoidable drop-off among people who still need or want the service.

Where paid ads fit

Paid search can help a new clinic, fill a new practitioner's diary or test demand for a service. It cannot rescue a confusing offer or a broken booking path.

Before spending, choose one service, one location and one action. Send the ad to the matching service page, not the homepage. Measure completed bookings and attended appointments, not clicks alone. Read the search terms weekly and exclude queries the clinic cannot serve.

Paid social is better suited to education and retargeting than capturing urgent local intent. A useful exercise video may introduce the clinic, but take care that the creative does not promise a clinical outcome or turn a patient's story into a prohibited testimonial.

The rule is simple: fix the path before buying traffic to it.

A sensible first 90 days

Weeks 1 and 2: correct the Google profile, website details, booking path and measurement.

Weeks 3 and 4: create or improve the two service pages with the strongest patient demand.

Month 2: introduce a consistent, ungated review request after a suitable completed appointment. Reply to new reviews without disclosing patient information.

Month 3: group feedback into recurring themes, fix one operational issue and test one acquisition channel. If paid search is the test, keep the campaign narrow enough to learn from.

That is a small plan by design. A clinic that gets these basics right looks more trustworthy, learns faster and wastes less money than one publishing every day with nowhere useful for the attention to go.

Reply as the practice, in general terms, and never confirm that the person who wrote the review was ever a patient. Say what your standard is instead of what happened to them, put one named person on a phone number, and stop at sixty words. That is how to respond to negative patient reviews without creating a problem larger than the review, and it means giving up nearly everything an ordinary reply does: the reviewer's first name, the date, the apology for the specific thing that went wrong.

Most advice about responding to patient reviews skips that part. These seven templates do not.

None of this is legal advice, and none of it was written by a lawyer. Every rule below links to the regulator that wrote it, because which one applies to you depends on where you practise and who registers you. Read the source, and take advice before you go near the edge of one.

The one rule: you cannot confirm they were a patient

In the United States, the fact that someone was treated by you is itself protected health information. A public reply that confirms it is a disclosure, and every disclosure needs either a permitted purpose or the patient's written authorisation. Defending yourself in public is not on the list (45 CFR 164.502(a)).

This gets enforced, and the money is the cheap part. Manasa Health Center, a psychiatric practice in Kendall Park, New Jersey, paid $30,000 to the HHS Office for Civil Rights, which found it had disclosed the protected health information of four patients in replies to their negative Google reviews. The agreement was signed in March 2023 and announced by OCR that June. It also put the practice on a two-year corrective action plan: privacy policies submitted to HHS for approval, training for every workforce member including the owners, and, within 30 days, breach notices to every individual whose information it had published on Google Reviews or any other platform (HHS).

Read that last part twice. The replies were a reportable breach, and the practice had to write to the patients it had named and tell them so.

Australia catches this with a different rule, and it is an advertising one rather than a privacy one. Section 133 of the National Law prohibits advertising a regulated health service using testimonials, and since the 2022 amendments the maximum penalty is $60,000 per offence for an individual and $120,000 for a body corporate. Ahpra's guidelines then warn that "a regulated health service provider should take care if they choose to engage with reviews on a third-party site as this may be considered using a testimonial to advertise a regulated health service" (Ahpra, s4.3.3).

The rules come from different places, but the reply is the same. Write one that would be safe if the reviewer had never set foot in the building. It will be safe under both.

What a compliant reply looks like, next to one that is not

Here is a one-star review at a fictional general practice, Kingsmere Family Practice.

Waited over an hour past my appointment time and then got six minutes with the doctor. Not good enough for a $95 out-of-pocket.

This is the reply most practices would write. It is also, clause by clause, the thing OCR fined Manasa for.

Hi Marion, we are so sorry about your visit on the 14th. Dr Hale was called to an emergency that morning and ran behind all day. Please call the clinic and we will look again at your account and the charge for your knee review.

Five clauses, four disclosures, and one that ties them to a person.

She volunteered the wait, the money and the six minutes herself. That releases you from none of it. Her disclosure is hers. It is not your authorisation.

Here is the same complaint answered with nothing given away.

An hour past a booked time is not the standard we set, and neither is a consultation that feels rushed once you finally get in. We cannot discuss any individual's appointment or account in a public forum. Our practice manager, Dana, is on [phone] and will go through any invoice line by line. Kingsmere Family Practice

It answers both complaints, sets a standard against them, and puts a person on the phone. It confirms nothing. It would read exactly the same if the reviewer had never been near the building.

Why it's important to respond to a negative patient review

Because the reply is not for the person who wrote it. It is for the next person reading the profile, who is choosing a clinic while feeling unwell and is trying to work out what happens here when something goes wrong.

An unanswered one-star review can look like the practice agrees with it. An answered one shows a process: a complaint reaches a named person and gets looked at. That does more than a rebuttal you are not allowed to publish. In BrightLocal's Local Consumer Review Survey 2026 (published 11 February 2026, 1,002 US adults), 89% of consumers said they expect business owners to respond to reviews.

Careful replies can look templated. The only way out is to make the general parts specific: name the standard, name what changed, name the person to ring.

How to respond to negative patient reviews: seven templates

These cover seven cases a clinic will run into. Each comes from a different fictional practice. The three plainest cases, a clinical complaint, a long wait and a billing dispute, are answered in online reputation management for doctors, and the one star with nothing written under it in how to respond to a 1-star review on Google.

1. A staff member is named

The receptionist, Bec, was rude and rolled her eyes at me when I asked how much longer.

Nobody should feel talked down to at our front desk, and a complaint about one of our team is taken seriously wherever it arrives from. Those come to me, and they get handled properly, which means privately rather than here. I am on [phone] most days before four. Tomas, practice manager, Ashgrove Medical Centre

Do not confirm who was on that morning, and never publish a verdict on a staff member. Google's content policy lets a reviewer name "a public-facing professional conducting business under their name" and lists doctors first. A receptionist is not one, so naming her may breach the personal information clause on its own.

2. The review recites the patient's own health information

Diagnosed with [condition] in March, three appointments with Dr [name], and I am still waiting on the referral.

Thank you for writing this down. There is detail here we are not able to discuss publicly, even though you have raised it yourself, so we are not going to repeat any of it back to you. What we can do is look at the complaint properly. Call [phone] and ask for me. Renée, Verity Women's Health

Say why you are being brief, or the brevity reads as indifference. Then report it. Google's Maps policy prohibits "medical information" about "yourself or others", which puts a review reciting its author's own diagnosis in breach on its face.

3. The review belongs to a different clinic

Worst dentist in the city. Cracked a filling and then wanted $600 to fix their own work.

We think this may belong to a different clinic. We have no record of the appointment described here and we do not offer that treatment. We would rather say so than leave it sitting unanswered. If we have got that wrong, call [phone] and ask for me and I will find it. Sam, Coastline Physio

"No record of the appointment described", never "no record of you". Every other industry can write "we have no appointment under your name", and our review response examples do. A clinic cannot: denying that a named person is a patient is still a statement about that person. The last sentence saves you when they turn out to have booked under another name.

4. The review is abusive

[Profanity]. Absolute [profanity] and the whole [profanity] practice should be shut down.

We are not going to answer this here. If there is a problem with an appointment or an account behind it, ring me and I will sort it out. [phone], weekdays until five. Marcus, Broadwater Podiatry

One line, no repetition, then report it. Google's policy covers content "using profanity or obscenity to offend other users or emphasize criticism". Describing the abuse in your reply republishes it for everyone who did not scroll that far.

5. A family member writes for the patient

My mother was left in the waiting room for two hours and she is 84 and diabetic.

Thank you for writing. We are not able to discuss any patient's care in public, and a family member's account of it is not permission to, which we know is maddening when you are the one doing the chasing. If you have authority to act for the person involved, call [phone] and ask for me. Jo, Redgate Medical Centre

A relative is not automatically a personal representative. And a public reply discloses to everyone reading it, not to the daughter who asked.

6. A five-star review that names the clinician

Dr [name] is the best dentist I have ever had. She found what two others missed and I would not go anywhere else.

Thank you for taking the time. We cannot say anything about any individual's care here, so all we can say is that this will be read out at our next team meeting and it will mean a great deal. We are on [phone] if we can help with anything. Aiden, Marlow Dental

The glowing one is where practices often slip, because naming the clinician back confirms she treated this person. In Australia it is also where Ahpra's warning bites hardest, since engaging with a testimonial may itself count as using one to advertise.

7. A complaint you have already fixed

Two stars in June. The clinic manager rang the next day and actually fixed it. Updating to four.

We are not going to set out what happened, because it is not ours to publish. What we can say is what changed. Since July, anyone waiting more than fifteen minutes past a booked time is told why and offered a rebooking. Complaints that arrive by phone get further than complaints that arrive here. Bel, Ellerslie Skin Clinic

If a practice visibly changes something after a complaint, the next reader notices. Only write this one if the change is real.

What never goes in a reply

The reviewer's first name attached to anything specific. The date of an appointment. The name of the treating clinician. A condition, a procedure, a medication, an appointment type or a body part. Any correction of a clinical fact. Anything out of their file, including "we have no record of the treatment you describe" said about a person rather than about an appointment.

Nor an offer of anything in exchange for taking the review down. Google's content policy bars merchants from offering "payment, discounts, free goods and/or services" for the removal of a negative review, and the FTC's rule makes an "unfounded or groundless legal threat, a physical threat, intimidation, or a public false accusation" used to suppress a review an unfair or deceptive practice (16 CFR 465.7(a)). A defamation letter feels proportionate when the accusation is about clinical care. It is also the most reliable way to make that accusation bigger.

When to take it offline, and how to say so without confirming anything

Take it offline whenever the complaint is clinical, whenever money is involved, and whenever the reviewer has published detail about themselves. That is most of them.

The wording is where people slip. "Please contact us so we can resolve your issue" confirms there is an issue belonging to them, and gives the next reader nothing. Write the invitation so it stands on its own:

Anything to do with an individual's care or account is dealt with by phone rather than here. [Name] is on [phone], weekdays, and will pick it up the same day.

A named person, because "the practice" is nobody. Real hours, because a route nobody answers is worse than no route. And no "your" anywhere in it. A reply that has sat in drafts for two days usually needed a phone call instead.

Monitor all of your patient reviews, across every location

Every clinic carries its own rating and nothing averages them, so someone searching in one suburb gets that site's profile and its 3.9 while the 4.7 across your other four stays invisible.

Once you have more than one location, the hard part is not the writing. It is the queue. Reviews land on whichever clinic's profile they belong to, nobody at head office watches all of them, and the site with the fewest staff answers the fewest reviews. What works is one queue, one voice, a second pair of eyes on anything clinical, and a named owner who is never the clinician the review is about. Cloutly drafts a reply for each review and hands it to a person to edit and send. It never posts on its own, which is the part that matters in a clinic. There is more on how practices run it on our healthcare page. Home care agencies answer the family rather than the client, which changes the wording: reviews for home care agencies.

One thing to leave alone while you tidy the process up. Never put a rating question in front of the review link so only the happy patients reach Google. That is review gating, it breaches Google's policies, and a filtered rating on a clinic profile misrepresents your own patients.

When a patient review can be reported and removed

Reporting is worth a try, and clinical reviews breach the content policies more often than other industries' do. The strongest grounds are a review reciting medical or personal information about anyone, profanity used to emphasise criticism, harassment, and a review plainly about a different business.

Report it from the profile or in the Reviews Management Tool, which shows the status: decision pending, reviewed with no policy violation, or escalated. Evaluation "typically takes several days", and one appeal covers up to ten reviews at a time (Google). Only policy breaches are eligible. Disliking a review is not one.

Report and reply the same day. Removal is slow and often fails, so write the reply as though it will stay up. What evidence moves a report is in how to get a negative Google review removed.

Frequently asked questions

Can a doctor respond to a patient review? Yes, as long as the reply carries no disclosure in it. That rules out confirming the appointment, naming the clinician or the treatment, and engaging with clinical detail even where the reviewer put it there first. In the United States, having been treated by you is protected health information on its own (45 CFR 164.502(a)).

Is replying to a Google review a HIPAA violation? The reply is not. The disclosure inside it is. OCR's settlement with Manasa Health Center turned on protected health information published in replies to four negative Google reviews, and it required the practice to notify those individuals of a breach (HHS).