Vertical Playbooks · established evidence

The HIPAA-Safe Way to Ask for and Respond to Patient Reviews

Last reviewed 2026-07-20. Written by Chandranshu Kumar, Founder, Raveneye Global. · 10 min read

Reviews are close to the whole decision in medicine: most patients report checking them before booking, and nearly half of consumers generally will not consider a business under 20 reviews. That makes reviews the highest-leverage reputation lever a medical practice has, and also the one most likely to trip an owner into two specific, well-defined violations. Screening patients before asking for a review, so only likely-positive ones get invited, is review gating, banned by the FTC. Confirming a patient relationship or referencing treatment in a public reply, even to a bad review, can itself be a HIPAA violation, because HIPAA privacy protections extend to the fact that someone is a patient, not just to clinical detail. Neither mistake is necessary to grow a strong review base. This is the compliant design for both the ask and the reply.

Reviews are close to the whole decision here, and the two shortcuts feel obvious

A 2025 patient-choice survey found 84 percent of patients check online reviews before booking care, with more than half reading at least six reviews first, and other surveys in the same window report figures from 70 to 90 percent depending on framing. No single authoritative government source settles the exact number, but the direction is not in dispute: reviews are close to the whole local medical decision.

That stakes level is exactly why the two instinctive shortcuts are so tempting. Ask only the patients you are confident are happy, and skip the risk of a bad review. Reply to a harsh public review by explaining what actually happened, correcting the record. Both moves feel like ordinary customer-service instinct. In medicine specifically, both are also the exact behaviors two different federal and professional rules exist to stop.

Mistake one: screening who gets asked

Review gating, screening customers by likely sentiment before inviting them to leave a public review, is banned by Google policy and by the Federal Trade Commission. The FTC's rule on consumer reviews and testimonials, 16 CFR Part 465, took effect October 21, 2024, and prohibits fake, incentivized, insider and selectively suppressed reviews, with civil penalties up to $51,744 to $53,088 per violation.

This is not a theoretical rule. The FTC settled a review-suppression case against Fashion Nova for $4.2 million in 2022, before the current rule even took effect, establishing that hiding negative feedback while surfacing positive feedback is an enforcement target, not a growth tactic. A patient-review process that asks every patient the same neutral question, rather than pre-screening for sentiment, cannot violate this rule, because it never sees sentiment before the invitation goes out.

Mistake two: confirming a patient relationship in a public reply

The second shortcut carries a risk most other local businesses never have to think about. HIPAA privacy protections extend to the fact that someone is a patient at all, not just to clinical detail, which means a physician replying to a negative review by writing this person was never actually my patient, or by describing what really happened during their visit, can create a real HIPAA exposure regardless of whether the reply is accurate.

The American Medical Association is explicit on this point: there is no federal law barring physicians from responding to online patient reviews at all, but a response must stay generic and must never confirm or deny that the reviewer was a patient. That guidance is corroborated by health-law counsel, and it draws a specific, workable line: respond, but never identify.

What patients actually check before they decide

The bar for what counts as a credible review profile keeps rising, and it is not specific to medicine. BrightLocal's established, cross-vertical survey found 47 percent of consumers will not consider a business with fewer than 20 reviews, and 74 percent specifically weight only reviews from the last three months. A medical practice with 15 reviews from two years ago is functionally invisible to a meaningful share of the patients evaluating it, independent of the quality of care behind those reviews.

Medicine also faces a harder version of the volume problem than most local categories. A satisfied patient is less likely to think to leave a review unprompted than a happy customer of most other local businesses, which is exactly why the compliant, systematic ask matters more here, not less.

The compliant design: how to ask and how to reply without either mistake

The reliable way to stay inside both rules is not to memorize them and hope no one on staff slips. It is to design the process so the prohibited behaviors are structurally impossible to perform. The ask goes out to every patient the practice served, worded neutrally, with no sentiment check first, so there is nothing to gate. The reply, whatever the review says, stays in broad, all-patient language: it thanks the reviewer for feedback, states the practice takes all concerns seriously, and invites the person to continue the conversation privately, off the public thread, without ever confirming they were seen at the practice or referencing what for.

Handled this way, the two rules stop being a source of legal anxiety and become a design constraint that is easy to build once and hard to violate by accident. The practice still grows a real, current, honest review base. It simply never has to gamble a compliance exposure to do it.

The evidence

Key findings, with their sources

The FTC rule on consumer reviews and testimonials (16 CFR Part 465) took effect October 21, 2024, with civil penalties of up to $51,744 to $53,088 per violation for prohibited practices, including review gating, fake, incentivized and selectively suppressed reviews.

established US Federal Trade Commission, Rule on the Use of Consumer Reviews and Testimonials, 16 CFR Part 465, 2024.
The FTC settled a review-suppression enforcement action against Fashion Nova for $4.2 million in 2022, establishing enforcement precedent for hiding negative reviews while surfacing positive ones.

established US Federal Trade Commission v. Fashion Nova, 2022 settlement.
A public reply confirming someone was a patient, or referencing their treatment or cost, can constitute a HIPAA violation, though no federal law bars physicians from responding to reviews at all.

established American Medical Association guidance, corroborated by Bass, Berry & Sims health-law analysis.
47% of consumers will not consider a business with fewer than 20 reviews, and 74% weight reviews from the last three months most heavily.

established BrightLocal, Local Consumer Review Survey, 2026.
84% of patients report checking online reviews before booking care, with more than half reading at least six reviews first.

emerging rater8, How Patients Choose Their Doctors, 2025 (vendor-sponsored survey, directionally corroborated across 70 to 90% range).

Reference

Glossary

16 CFR 465: The FTC's Trade Regulation Rule on the Use of Consumer Reviews and Testimonials, effective October 21, 2024, which makes fake, insider, incentivized, and selectively suppressed reviews federal violations with civil penalties.
Review gating: Screening customers by likely sentiment before inviting them to leave a public review, so only likely-positive customers are asked. Banned by Google policy and the FTC.
Protected health information (PHI): Information HIPAA protects, which includes the fact that a specific person is a patient, not only clinical detail such as a diagnosis or treatment.
HIPAA-aware response: A public review reply written to stay generic, thank the reviewer and invite private follow-up, without ever confirming or denying that the reviewer was a patient at the practice.

Straight answers

Frequently asked questions

Is it legal to ask patients for reviews?

Yes. Asking for an honest review is not only legal, it is the compliant path. What 16 CFR 465 prohibits is not the request itself but conditioning it: screening for likely-positive patients before asking, or offering a reward tied to a positive rating. A neutral invitation sent to every patient, asking for an honest review with no strings, is fully compliant.

Can I offer a discount in exchange for a review?

Be careful. The rule prohibits compensation or incentives conditioned on the review expressing a particular sentiment, so leave us five stars and get a discount is the prohibited pattern. An incentive offered for leaving any honest review, disclosed clearly, is a narrower and different case. The safest design is no incentive at all, since compliant volume comes from process, not payment.

What are the penalties under 16 CFR 465?

The FTC rule carries civil penalties of up to $51,744 to $53,088 per violation for prohibited practices, which include fake or non-experience reviews, bought or sold reviews, undisclosed insider reviews, positivity-conditioned incentives, and selective suppression of negative reviews.

Can I delete or hide a bad review of my practice?

Selectively suppressing or blocking negative reviews while displaying positive ones is prohibited under the FTC rule. The compliant response to a negative review is to answer it in generic terms, never confirming the reviewer was a patient, rather than hiding it.

How do I reply to a negative review without breaking HIPAA?

Never confirm or deny that the reviewer was a patient, and never reference their treatment, diagnosis or cost, even to correct the record. The American Medical Association's own guidance allows a generic, professional reply that thanks the reviewer and invites them to continue the conversation privately. What it does not allow is any reply that identifies them as a patient.

Provenance

Sources

US Federal Trade Commission, Rule on the Use of Consumer Reviews and Testimonials, 16 CFR Part 465, effective October 21, 2024 (established, federal regulation)ecfr.gov
US Federal Trade Commission v. Fashion Nova, 2022 settlement (established, enforcement precedent)
American Medical Association, Are physicians prohibited from responding to online patient reviews? (established, primary regulatory guidance)
Bass, Berry & Sims, How Can Healthcare Providers Respond to Online Patient Reviews Without Violating HIPAA? (established, health-law analysis)
BrightLocal, Local Consumer Review Survey, 2026 (established, industry-consensus survey)brightlocal.com
rater8, How Patients Choose Their Doctors, 2025 (emerging, vendor-sponsored survey)

Every figure above is attributed to a real, dated source and tagged with its evidence tier. Where a claim could not be verified to a primary source, it is not stated as fact.