Local & AI visibility, in plain English
Reviews under HIPAA

Responding without confirming treatment

A response pattern that is warm, useful and discloses nothing.

September 9, 2026 4 min read By PsychLocal Editorial Team

The previous lesson established what you cannot say. This one gives you something you can actually use: a pattern that works for positive and negative reviews, keeps you clear of disclosure, and does not read like a legal document.

The pattern

Four parts, in order:

  • Thank them for the feedback. Feedback, not their visit. This is the whole trick, and it is invisible to readers.
  • State a general standard. What your practice aims to do for everyone, in the present tense.
  • Offer an offline route. A named contact and a phone number or email.
  • Stop. No detail, no explanation, no defence.

Notice what is absent: any reference to an appointment, a treatment, a diagnosis, or a specific interaction. Nothing in the reply confirms this person ever walked through your door.

Why generic is correct

Every marketing instinct says to personalise. In healthcare that instinct is wrong, and it helps to know that patients reading reviews understand this. A consistent, professional, slightly generic response pattern reads as discretion, not indifference, and future patients notice that you protect privacy.

What actively damages you is the opposite: a reply that engages with clinical specifics, which tells every prospective patient that you will discuss their care in public.

Negative reviews

The riskiest case. Apply the pattern strictly:

  • Do not correct the facts, however wrong they are.
  • Do not explain what happened.
  • Do not mention scheduling, billing specifics, or clinical detail.
  • Do not imply the person is difficult, non-compliant, or mistaken.
  • Do not say you have no record of them, which is itself a disclosure and reads badly.
  • Do not apologise for their treatment, which confirms treatment. Acknowledge the feedback instead.

Keep it short. Two or three sentences. Every additional sentence adds risk without adding persuasion.

Positive reviews

The same rules apply and practices routinely forget it, because the reply feels harmless. Thanking someone for trusting your clinic with their care confirms the relationship just as surely as an apology does.

Respond warmly but generically: thank them for the kind words, mention that your team aims to make care straightforward and comfortable, and leave it there. Do not name the treatment they mentioned, and do not reference their experience.

Reviews from non-patients

You will get reviews from people who were never patients: a family member, someone who could not get an appointment, someone who confused you with another practice, occasionally a competitor.

Handle these carefully, because the temptation to say this person is not a patient is strong and it is a disclosure about your records either way. Use the same generic pattern, and pursue removal through the platform on policy grounds if the review breaches its rules. Let the platform adjudicate rather than arguing publicly.

Operational discipline

  • One owner. A single named person responds; everyone else escalates.
  • Pre-approved templates for positive, negative, and non-patient cases, so nobody drafts under stress.
  • A cooling-off rule. Never respond within an hour of reading a bad review.
  • Escalate the serious ones. Reviews alleging harm, a licensing issue, or a privacy breach go to your privacy officer or counsel before any reply.
  • Respond to everything, positive and negative, on a consistent rhythm.
  • Log it, so you know what was said and when.

Resolving the underlying problem

The public reply is not where problems get solved. The offline route is. When someone contacts you privately, you can verify identity and discuss their care properly through your normal channels, which is both safer and more likely to satisfy them.

That is the real purpose of the third part of the pattern: it moves the conversation somewhere it can actually happen. Asking for reviews is next.

Share this lesson

Disclaimer: This material is provided for marketing and visibility education purposes only, not as clinical, legal, or compliance advice. Practices should consult their own legal counsel or compliance officer to confirm that their marketing and operational strategies adhere to HIPAA, state regulations, payer directory rules, and professional board guidelines.

See this in your own data

Run a free scan of your practice's listings across our 90+ network destinations and see which of the things this lesson describes might need attention.

Keep going