Trust, Ethics & Regulation · established evidence
The HIPAA and FTC Line: What a Chiropractic or PT Clinic Can (and Cannot) Say When Responding to a Patient Review
HIPAA does not prohibit a chiropractic or PT practice from replying to a public review, but it strictly limits what can be said. Acknowledging that a reviewer is even a patient, or referencing any detail of their visit, is a disclosure of protected health information. The Office for Civil Rights fined a dental practice $50,000 for exactly this in a review response, and HIPAA's own penalty tiers run from $137 per violation for unknowing infractions up to over $2 million for willful, uncorrected neglect. On top of HIPAA, the FTC's Rule on the Use of Consumer Reviews and Testimonials (16 CFR Part 465, effective October 2024) separately bans fake, incentivized, gated or suppressed reviews for every business, healthcare included, with penalties up to $51,744 per violation. A chiropractic or PT practice's review system has to satisfy both bodies of law at once, and most generic reputation-management advice addresses neither. This is general information based on published federal guidance and enforcement precedent, not legal advice for your specific practice.
The exact rule most practice owners do not know
Most business owners treat review replies as a purely reputational exercise: thank the happy ones, apologize to the unhappy ones, move on. Licensed healthcare practices cannot operate that way. The HIPAA Privacy Rule restricts a covered entity, the practice, from disclosing protected health information, and confirming that a named reviewer was a patient, or elaborating on the treatment, condition or cost they mentioned, is a disclosure the practice itself makes, regardless of what the patient chose to say publicly first.
This is the same standard the American Dental Association's own guidance states plainly for its members, and it applies with equal force to chiropractic and PT: a patient posting their own review and naming their own treatment is the patient's own choice to disclose. The practice replying and confirming or expanding on that same information is a separate act, and it is the one HIPAA restricts.
The $50,000 precedent, and the penalty ladder behind it
This is not a theoretical risk. The Office for Civil Rights fined a dental practice $50,000 specifically for disclosing patient information in a public review response, a directly on-point enforcement precedent for any licensed healthcare practice managing its own reviews. HIPAA's broader penalty structure runs on a tiered scale: as low as $137 per violation for an infraction the practice did not know about and could not reasonably have avoided, rising past $2 million for willful neglect left uncorrected.
The tiers matter because they show the exposure scales with pattern, not just a single mistake. A front-desk staff member replying warmly and specifically to one review under time pressure is a real, recurring risk if there is no defined process, not a one-time decision to get right and move past.
The FTC layer sits alongside HIPAA, not instead of it
HIPAA governs what a practice can say in a reply. A separate federal rule governs what reviews can exist in the first place. The FTC's Rule on the Use of Consumer Reviews and Testimonials, 16 CFR Part 465, effective October 21, 2024, makes fake, incentivized-for-positivity, insider, and suppressed or gated reviews federal violations for every business, healthcare included, with penalties up to $51,744 per violation.
The two rules compound rather than substitute for each other. A compliant chiropractic or PT review system has to clear both floors simultaneously: every review has to come from a real patient, requested without incentive or gating, and every reply has to stay inside the HIPAA privacy boundary, regardless of what the original review disclosed.
What a compliant reply actually looks like
The operating principle is simple to state and requires discipline to apply consistently: a reply should never confirm that the reviewer was a patient, never reference a specific treatment, condition, or cost, and never add any identifying detail the patient did not already choose to disclose themselves, even if it seems harmless.
In practice, a positive review gets a general thank-you for the kind words and an invitation to reach out directly with any questions, without repeating back what the review described. A negative review gets an acknowledgment that the practice takes all feedback seriously and an invitation to continue the conversation by phone or a private message, without confirming or disputing any clinical detail publicly. The private channel is where the specific, patient-identifying conversation belongs, never the public review thread.
Silence is not the safe alternative either
Faced with that exposure, many practices simply stop replying to reviews altogether. That avoids the HIPAA risk but creates a different, measurable cost: a pattern of unanswered reviews, especially unanswered negative ones, reads as neglect to a prospective patient scanning the page, and it forgoes the documented effect where businesses that respond to reviews see subsequent rating gains and a chilling effect on future negative reviews from guests with poor experiences.
The answer is not a choice between compliant and responsive. It is a defined reply framework, reviewed once and applied consistently to every new review as it lands, so compliance does not depend on whoever happens to be answering that week remembering the rule correctly under pressure.
The evidence
Key findings, with their sources
-
A public review reply that confirms someone was a patient, or references their treatment, condition or cost, can constitute a HIPAA violation.
established Bass, Berry & Sims PLC, HIPAA review-response guidance, 2026, citing OCR guidance and the American Dental Association's parallel member guidance.
-
A HIPAA enforcement action fined a dental practice $50,000 for disclosing patient information in a single review response.
established Bass, Berry & Sims PLC, HIPAA review-response guidance, citing the OCR dental-practice enforcement action, 2026.
-
HIPAA penalty tiers run from $137 per violation for unknowing infractions up to over $2 million for willful, uncorrected neglect.
established US Department of Health and Human Services, HIPAA Privacy Rule enforcement structure, 45 CFR Parts 160 and 164.
-
Fake, incentivized, insider and suppressed reviews are federal violations under FTC 16 CFR Part 465, effective October 21, 2024, with penalties up to $51,744 per violation.
established US Federal Trade Commission, Rule on the Use of Consumer Reviews and Testimonials, 2024.
Reference
Glossary
- Protected health information (PHI)
- Individually identifiable health information a covered entity, such as a chiropractic or PT practice, is restricted from disclosing under HIPAA's Privacy Rule, including confirming that a named person was a patient.
- Review gating
- Screening patients before inviting a review so only likely-positive ones are asked, or routing negative feedback to a private form instead of the public review platform. Prohibited under FTC 16 CFR Part 465.
- 16 CFR Part 465
- The FTC's federal rule, effective October 21, 2024, banning fake, incentivized, insider and suppressed consumer reviews and testimonials, with penalties up to $51,744 per violation.
Straight answers
Frequently asked questions
Can I thank a patient by name in a reply to their review?
A general thank-you that does not confirm the person was a patient or reference their treatment is the safer pattern most practices use, phrased broadly rather than specifically. Because the exact line depends on wording and context, a practice handling this at scale should have its reply framework reviewed by qualified counsel, not rely on a single article for legal certainty.
What should I do about a negative review that names a specific condition or treatment?
Acknowledge the feedback in general terms and invite the reviewer to continue the conversation privately, by phone or direct message, without confirming or disputing the clinical details in the public reply. The private channel is where any patient-specific discussion belongs.
Does the HIPAA reply risk apply to multi-location or multi-provider clinics too?
Yes. HIPAA's Privacy Rule applies to the covered entity making the disclosure, the practice or provider replying, not to its ownership or organizational structure. Multi-location groups need the same reply discipline applied consistently across every clinic and every provider.
Can I still ask happy patients for a review?
Yes, and you should. Requesting reviews from real patients is not restricted by HIPAA. What is restricted is what the practice discloses in a public reply. Review requests are governed instead by the FTC's rules against gating and incentivizing, meaning every real patient should be invited, not just the ones expected to leave a positive review.
Provenance
Sources
- Bass, Berry & Sims PLC, "How Can Healthcare Providers Respond to Online Patient Reviews Without Violating HIPAA?", legal-industry publication, 2026 (established)
- US Department of Health and Human Services, HIPAA Privacy Rule, 45 CFR Parts 160 and 164 (established, federal regulation)hhs.gov
- US Federal Trade Commission, Rule on the Use of Consumer Reviews and Testimonials, 16 CFR Part 465, 2024 (established, federal regulation)ecfr.gov
- Proserpio & Zervas, "Online Reputation Management," Marketing Science, 2017 (established, peer-reviewed)
Every figure above is attributed to a real, dated source and tagged with its evidence tier. Where a claim could not be verified to a primary source, it is not stated as fact.