Google Review Requests and HIPAA-Safe Replies for Dental Practices

By Blake Hickey, founder of Double Jaw Marketing. For practice owners and office managers. Updated October 17, 2026.

Ask every patient for a review the same way. Google's rules don't allow asking only the happy ones. The replies are where practices get into trouble. A reply that confirms someone is a patient, or mentions their treatment, is a HIPAA problem, even if the reviewer posted the details first.

This resource gives you the ask in four formats, Google's rules in a short list, reply templates that stay general, and the HHS cases that show what happens when a reply goes too far.

How to ask

Ask in person at checkout, then follow up once by text or email with the link. Use the same words for every patient so nobody is screened in or out.

Send the text only to patients who agreed to get texts from you, and include "Reply STOP to opt out." Promotional email needs your postal address and a working unsubscribe link under CAN-SPAM.

Google's rules and the federal review rule

Google's prohibited and restricted content policy for Maps reviews says merchants may not offer incentives such as payment, discounts, or free goods or services for reviews. It also says merchants may not "discourage or prohibit negative reviews, or selectively solicit positive reviews from customers." That second line is what rules out review gating: asking "Were you happy?" first and sending only the yes answers to Google. Content based on a conflict of interest, such as reviews from employees, is also prohibited.

The FTC's rule on consumer reviews, 16 CFR Part 465, adds a federal layer. Section 465.4 bars offering compensation conditioned on a review expressing a particular sentiment, positive or negative. Section 465.7 covers review suppression, including threats and intimidation to stop or remove a review.

Replying without breaking HIPAA

The safe reply thanks the person, says nothing about whether they're a patient, and moves anything specific to a phone call. In announcing its settlement with New Vision Dental, HHS called responding to reviews in a way that reveals patients' information illegal under HIPAA.

Notice what's missing: "your visit," "your treatment," "we're sorry you waited for your cleaning." Each of those confirms the person was there. For a fake or abusive review, Google lets you report it from your Business Profile instead of arguing in a reply. Keep a copy of every review and reply, and talk to your attorney before you respond to anything that threatens legal action.

HHS cases over dental review replies

• Elite Dental Associates, Dallas, Texas. Paid $10,000 and agreed to a corrective action plan in 2019 to settle potential HIPAA Privacy Rule violations over social media disclosures of patients' information.
• Dr. U. Phillip Igbinadolor, D.M.D. & Associates, North Carolina. A $50,000 civil money penalty announced in 2022. OCR's notice says the practice posted a reply to a patient's negative Google review that revealed his name and details of his treatment.
• New Vision Dental, California. Paid $23,000 in a December 2022 settlement. OCR found Yelp replies included patients' full names and details about their visits and insurance that the reviewers hadn't posted.

Florida: reusing reviews in your ads

Posting a review on your website, social media or ads makes it advertising. Fla. Stat. 466.019 defines an advertisement to include websites and social media, and bars statements that are laudatory, that are likely to create unjustified expectations of favorable results, or that compare the quality of your services to other dentists. The statute doesn't use the word "testimonial," but a five-star quote can easily cross those lines.

The Board of Dentistry's advertising rule, Rule 64B5-4.002, also applies. Ask your attorney how it treats patient testimonials before you reuse a review. Separately, HHS's marketing guidance explains when using patient information to promote your services needs the patient's written authorization.

[Your logo here]
**[Practice name]** | [Phone] | [Website]

# Asking for Google reviews, and replying without breaking HIPAA

For the office manager. Ask every patient the same way, and never confirm in a reply that someone is a patient.

> Never pay or gift anything for a review. Ask every patient, not just the happy ones.

## The ask, in person

"Thanks for coming in today. We ask every patient for an honest review on Google. Here's a card with the link, if you'd like to leave one."

## Text version

"Hi [first name], thanks for visiting [Practice name]. We ask every patient for an honest Google review: [review link]. Reply STOP to opt out." Only to patients who agreed to texts.

## Email version

**Subject:** How was your visit? "Hi [first name], thanks for visiting [Practice name]. We ask every patient for an honest Google review: [review link]. [Practice address] [Unsubscribe link]"

## Card version

"Tell others about your visit. Scan to leave an honest review of [Practice name] on Google." [QR code to your review link]

## Google's rules, and the FTC's

- [ ] No incentives: no payment, discounts, free goods or services for a review
- [ ] No review gating: don't screen for happy patients first or ask only them
- [ ] Don't discourage or block negative reviews
- [ ] No reviews from owners, staff or anyone with a conflict of interest
- [ ] Federal rule: no incentive tied to a positive or negative review (16 CFR 465.4)
- [ ] Never write a review yourself or buy one (16 CFR 465.2)

## Reply templates

| Review | Reply |
|---|---|
| Positive | "Thank you for taking the time to share this. We appreciate it. [Practice name] team" |
| Negative | "We take every concern seriously. To protect everyone's privacy, we don't discuss anyone's care online. Please call our office manager, [name], at [Phone] so we can talk directly." |
| Neutral | "Thank you for the feedback. If you'd like to talk more, please call [name] at [Phone]." |
| Fake or abusive | Don't argue in the reply. Report it through your Google Business Profile, and keep a copy. |

## Never put in a reply

- [ ] Their name, if the review doesn't show it
- [ ] Visit dates, treatment, insurance or billing
- [ ] "We checked your chart" or "as your dentist"
- [ ] Anything the reviewer didn't post, and nothing that confirms they're a patient, even if they did

## Reusing reviews in your ads (Florida)

- Fla. Stat. 466.019 bars laudatory statements, unjustified expectations of results and quality comparisons in dental ads.
- Rule 64B5-4.002 also governs dental advertising. Ask your attorney how it treats testimonials.
- Get a signed HIPAA authorization before using a patient's review, name or photo in marketing.

HHS OCR dental cases over review replies: Elite Dental Associates (TX, 2019, $10,000); Igbinadolor, D.M.D. & Associates (NC, 2022, $50,000 penalty); New Vision Dental (CA, 2022, $23,000).

---
Sources: Google Maps content policy; 16 CFR 465; HHS OCR; Fla. Stat. 466.019; Rule 64B5-4.002. I'm not a lawyer or a doctor. This is what I've learned helping practices, shared to help you. It's general information for Florida practices as of October 2026, not legal or medical advice. Rules differ by state and change, so have your attorney review it before you use it. Template from Double Jaw Marketing, doublejawmarketing.com/resources.

Common questions

Can a dental practice offer a discount for a Google review?

No. Google's policy for Maps reviews prohibits incentives such as payment, discounts, or free goods or services for reviews.

What is review gating?

Asking patients whether they were happy and sending only the happy ones to Google. Google's policy says merchants may not selectively solicit positive reviews.

Can we reply to a negative review if the patient already shared their treatment?

Don't confirm they're a patient or add any details. HHS has taken action against dental practices whose replies disclosed patient information. Thank them and invite them to call.

Can we put patient reviews on our website in Florida?

Ask your attorney first. Fla. Stat. 466.019 bars laudatory statements and unjustified expectations in dental ads, Rule 64B5-4.002 also applies, and HIPAA marketing rules may require the patient's authorization.

Claims and sources

Checked October 17, 2026. Rules and platform settings change, so check the source before you rely on it.

1. Google bans incentives, selective solicitation and conflict-of-interest reviews: Google: Prohibited and restricted content, Maps user-generated content policy
2. Federal rule on consumer reviews, 16 CFR 465.4 and 465.7: eCFR 16 CFR Part 465
3. Elite Dental Associates, $10,000, 2019: HHS OCR: Elite Dental Associates
4. Igbinadolor, $50,000 civil money penalty: HHS OCR: Dr. U. Phillip Igbinadolor, D.M.D. & Associates
5. Igbinadolor reply on Google disclosed name and treatment: HHS OCR: Notice of Proposed Determination (PDF)
6. New Vision Dental, $23,000, December 14, 2022: HHS OCR: New Vision Dental settlement
7. New Vision Dental Yelp replies disclosed names, visits and insurance: HHS OCR: New Vision Dental resolution agreement
8. Florida dental advertising rules: Fla. Stat. 466.019
9. Board of Dentistry advertising rule: Rule 64B5-4.002, Florida Administrative Code
10. HIPAA marketing and authorization: HHS: Marketing guidance
11. Email postal address and unsubscribe: FTC: CAN-SPAM Act compliance guide
12. Reporting inappropriate reviews: Google Business Profile Help: Report inappropriate reviews