A one-star review is sitting on your practice's Google profile, or on Healthgrades or Zocdoc, and you know the other side of it. You know what happened at the visit, what the bill said and what was explained at the front desk. You also know you cannot put any of that in a reply. Meanwhile, reputation companies are emailing to say they can fix it. Reputation management for doctors and dentists starts with a narrower question than the pitches suggest: what can your practice say in public without disclosing patient information? The answer is short, and it protects you more than a detailed defense would. After that come the review sites that matter, what practice-focused services charge, and a check your office can run in fifteen minutes. This post is general information, not legal advice; for a specific reply or incident, talk to your privacy officer or a healthcare attorney.
Key Takeaways
A safe public reply thanks the reviewer, says you cannot discuss individual matters in public, and invites private contact. It never confirms the person is a patient or mentions a visit, treatment, bill or staff member.
HHS Office for Civil Rights settled with New Vision Dental for $23,000 in December 2022 and with Manasa Health Center for $30,000 in June 2023 over patient information disclosed in review replies.
One trained staff member, one approved reply, a neutral review request sent to every eligible patient, and policy-based flagging cover the basics before any monthly fee.
You can reply to a bad review, as long as the reply confirms nothing
Your practice can respond to an online review. What the reply must not do is confirm that the reviewer is or was a patient, or mention anything about their care. That rules out the visit, the date, the treatment, the diagnosis, the appointment, the balance, the insurance and the staff member they saw. It also rules out any detail that could identify the person.
The patient's own post does not change this. A reviewer can describe their visit in full, and your reply still cannot confirm or add to it. HHS Office for Civil Rights treats a provider's public reply as a possible disclosure of protected health information, and a patient talking about their own care does not authorize the practice to do the same.
A reply that stays inside those lines can be as short as this:
> "Thank you for sharing your feedback. We take concerns seriously, but we cannot discuss individual matters in a public forum. Please contact our office directly at [phone] so we can route your concern appropriately."
Each line has a job. The thanks shows readers that the practice is listening. "Individual matters" refers to no one in particular, so it confirms nothing. The phone invitation moves the conversation somewhere private, where your office can actually look into the complaint. Prospective patients reading the exchange see a calm, reachable practice, which is the real audience for any reply.
Two tempting variations cause trouble. Saying "this person was never our patient" discloses something about the person's relationship with your practice, so do not use it as a routine response. Adding "we take privacy seriously" to a reply that goes on to explain what happened does not fix the explanation. For the general principles of replying to criticism, our post on how to respond to negative reviews covers tone and timing; the privacy limits above sit on top of that for any practice covered by HIPAA.
You also do not have to reply at all. A neutral reply, or no public reply, can carry less risk than a factual defense. The complaint still deserves attention, just not in public.
Two OCR settlements show what a revealing reply costs
OCR has no single rule written just for review replies. The clearest guidance comes from OCR's enforcement actions, which you can read on its HIPAA compliance and enforcement pages. Two settlements deal directly with replies to online reviews.
| Practice | Announced | Where the replies ran | Settlement | What else was required |
|---|---|---|---|---|
| New Vision Dental, California | December 14, 2022 | Yelp | $23,000 | Corrective action plan with two years of monitoring |
| Manasa Health Center, New Jersey | June 5, 2023 | Google reviews | $30,000 | Corrective action plan: written policies, workforce training, breach notification letters |
In the New Vision Dental resolution agreement, OCR described an "impermissible disclosure of patient protected health information" in responses to online reviews. The replies included patient names, treatment and insurance information. In the Manasa Health Center settlement, OCR found that replies to negative Google reviews disclosed information about four patients, including diagnoses and mental health conditions, and that the practice lacked required policies and procedures.
Read the corrective action plans as closely as the dollar amounts. Both practices had to put written rules and training in place. That is the same work a careful practice can do before any complaint arrives: one approved reply, one person who posts it, and a written rule that nobody confirms patient status in public.
Each review site sets its own rules for replies and removal
Reputation management for physicians and dentists covers more sites than a typical business has to watch. Google is usually the broadest public channel, because reviews show up in Search and Maps. Healthcare directories add their own profiles, their own verification and their own removal process. None of them removes a review just because it is negative, so it helps to know what each one says it will act on.
| Site | Can the practice reply? | What the site says about removal |
|---|---|---|
| Yes | Its user-generated content policy prohibits personal and medical information, fake engagement and incentives; reports lead to removal only for policy violations | |
| Healthgrades | Yes | Reviews are verified and moderated; providers can flag a review for audit, and Healthgrades makes the final call under its community review guidelines |
| Zocdoc | Removal requests allowed | Its reviews FAQ (updated March 31, 2026) says verified reviews can be positive or negative and providers may not influence reviews or retaliate against reviewers |
| Vitals | Not stated in its guidelines | Its review guidelines prohibit personally identifiable information and health-condition details |
| Yelp | Yes | Businesses can respond and report, but Yelp's moderation page makes clear a report does not guarantee removal |
| RateMDs | Yes | Providers can reply and flag; its removal article (updated July 16, 2026) says providers cannot pay to remove or manipulate ratings |
Which of these deserve your time depends on your specialty, your market and where your appointments actually come from. Google, the healthcare directories you are listed on, and any platform that books patients for you come first. A site that sends you no one can wait.
Flag a review when it breaks the site's written rules, not when it is unfair. A review that looks like fake engagement, or that posts personal or medical information, may qualify. A review that is harsh but describes the reviewer's own experience usually will not. Compare the review with the policy, then file the flag with the specific rule it breaks.
Asking for reviews is allowed when every patient gets the same request
A steady flow of recent reviews makes a single bad one less prominent, and you are allowed to ask for them. The rules sit in how you ask. Google's policy prohibits offering incentives, selectively soliciting positive reviews, and asking for specific review content. Zocdoc prohibits providers from influencing reviews.
In practice, that means a neutral invitation sent to every eligible patient, through the same channel, whether or not you expect a good review. No discounts, no gift cards, no "only send this to the happy ones" instruction to the front desk, and no suggested wording. Screening patients first and only sending the review link to satisfied ones is known as review gating, and Google's rules prohibit it.
The request itself carries no patient details, so it raises none of the reply issues above. Keep the wording plain: a thank you for choosing the practice, and a link to leave a review if they would like to.
Practice-focused services often run $300 to $600 or more per location each month
Online reputation management for doctors is sold as software, as a managed service, or as both, and published pricing is thin. The figures below are what vendors advertise or say about their own market at the time of writing. They are vendor claims, not an industry rate card. For how reputation management is priced across other kinds of businesses, see our breakdown of what reputation management costs; the healthcare numbers are these.
| Vendor | How it prices | What it advertises |
|---|---|---|
| Birdeye | Custom, by locations and products | Its own doctor reputation article says healthcare platforms typically range from about $300 to $600 or more per location per month; its pricing page is custom |
| RepuMD | Per location | A $395 managed plan for one location on its pricing page, covering reputation growth, Google Business Profile posts, content and strategy |
| RepuGen | Per provider, per month | The rate sits behind a form on its pricing page; plans list review requests, dashboards, response tools, listings, patient feedback and reporting |
What moves the price is the size of the job: the number of providers and locations, how many reviews come in, which systems it connects to, whether someone writes replies for you, whether listings and patient surveys are included, and whether a person manages the account. Some vendors price per provider and others per location, so a four-doctor, one-location office can get very different quotes for the same work.
Before you sign, ask each vendor the same questions. Which sites does it cover? Who approves a reply before it is posted? Is pricing per provider, per location or custom? What does it not guarantee? Removal authority stays with the review site, so a promise to delete accurate negative reviews is a promise no vendor can keep. A "HIPAA-compliant" label on software does not approve every reply it drafts either; your practice is still responsible for what gets posted, and auto-publishing should stay off.
A single-location practice can often run the basics without a platform
A single-location practice with a modest number of reviews may not need a monthly platform right away. One trained staff member can check the main profiles weekly, post the approved reply, send the neutral review request to every eligible patient, and flag reviews that break a site's rules. That covers the core work for the cost of a few hours a month.
Paid help earns its cost when the workload outgrows that person. Signs include several providers or locations, a steady stream of new reviews, replies posted inconsistently by different staff, listings with wrong names or phone numbers across several directories, or nobody who clearly owns monitoring. At that point, what you are buying is a repeatable system: monitoring, profile ownership, policy-based flagging, a reply workflow with human approval, a compliant review request, and monthly reporting on rating, review count, response time and recurring complaints.
What you are not buying is a guarantee. No system promises a higher rating or the removal of a review that follows the site's rules. Reputation management for dentists and doctors done well shows up as fewer risky replies, faster notice of real service problems, and less time spent improvising after hours.
A fifteen-minute check shows where your practice stands
You can learn most of what a vendor audit would tell you in about fifteen minutes. The goal is a dated baseline: your ratings, your recent reviews, every reply your practice has posted, and whether your office has a rule for the next one. Take screenshots and save the links as you go. The four checks below cover the ground.
Search your names while logged out
Open a private browser window and search the practice name and each provider's name. Note the rating and the latest ten reviews on Google, then the profiles on Healthgrades, Zocdoc, Vitals, Yelp and RateMDs. Record which ones you can log in to and which you have never claimed.
Read every reply your practice has posted
Look for any reply that confirms the reviewer was seen, or mentions treatment, an appointment, a diagnosis, a bill, a date or a staff member. Screenshot anything that does. Do not edit or delete it in a hurry; see the next section first.
Confirm who replies and what they say
Ask who is allowed to post replies, whether the office has one approved template, and who reviews unusual cases such as clinical, billing or safety complaints. If the answer is "whoever sees it first," that is the first thing to fix.
Check listings and review requests
Look for wrong provider names, phone numbers, specialties or locations on old listings. Then check how review requests go out: to every eligible patient through a neutral process, or only to people staff expect to be happy.
When the check is done, you will have a page of screenshots and a short list. Keep it with the date on it, because it becomes the baseline you measure every later change against.
If a past reply said too much, pause and get privacy advice first
Finding a reply that mentions a patient's care is unsettling, but the next steps are orderly. Stop any further discussion of the matter in public. Preserve screenshots of the review and the reply. Bring in your privacy officer or legal counsel, who can assess whether the reply should be corrected or removed and whether anything else is required. Then put a written reply policy in place so it does not happen again.
The other fixes are smaller. If nobody owns monitoring, assign one person and a weekly check. If replies are inconsistent, adopt one template and one approver. If review requests only go to satisfied patients, switch to a neutral invitation for everyone. If software posts replies automatically, turn that off and require a person to approve each one.
Can your practice reply to reviews safely?
Pick an answer to begin.
1. A reviewer describes their own visit in detail. What can your reply confirm?
2. Which review request fits Google's rules?
3. A vendor promises to remove your accurate negative reviews. What should you know?
Frequently Asked Questions About reputation management for doctors
Can a doctor respond to a negative Google review?
Yes. Keep the reply neutral: thank the reviewer, say you cannot discuss individual matters in public, and invite them to contact the office. Do not confirm they are a patient or mention any part of their care.
Can the practice say the reviewer was never a patient?
That statement discloses something about the person's relationship with your practice. Do not use it as a routine reply; if you believe a review is fake, flag it with the site instead.
Does a patient's own review give the practice permission to discuss their care?
No. A patient describing their own visit does not authorize the practice to confirm or add to it in public.
Can a practice ask patients for reviews?
Yes, if the request is neutral, goes to every eligible patient, and offers no incentive or suggested wording.
Can a bad review on Healthgrades or Zocdoc be removed?
Only if it breaks the site's rules. Healthgrades lets providers flag a review for audit and makes the final decision; Zocdoc accepts removal requests but says verified reviews can be negative.
How much does reputation management for doctors cost?
Published pricing ranges from custom quotes to Birdeye's stated $300 to $600 or more per location per month, with RepuMD advertising a $395 managed plan for one location. These are vendor figures, and pricing may be per provider or per location.
Final Thoughts
A bad review on a practice profile feels urgent because you cannot answer it with the facts. You do not need to. A short reply that confirms nothing, the same review request for every patient, and flags filed only for real policy violations protect both your patients' privacy and your practice. The New Vision Dental and Manasa settlements show what happens when replies go further, and the fix both practices were required to adopt was a written policy and training.
Once that routine is in place, reviews become something your office handles on a schedule instead of late at night. You will know what your profiles say, who answers, and what to ask any vendor who calls.
If you want a second set of eyes, Web Leveling can run that baseline check with you and set up a monitoring and reply routine your staff can follow. Our online reputation management work covers review monitoring, neutral review requests and reply workflows with a person approving every post, and we will tell you if one trained staff member is all your office needs. We work with small and medium businesses across the country and overseas. Tell us which review sites are worrying you, and we will start there.
Terms
Practice reputation words in this post
Tap a term to see what it means.
PHI. Protected health information, meaning health details that can be tied to a specific person, which HIPAA limits a practice from disclosing.
HHS Office for Civil Rights (OCR). The federal office that enforces the HIPAA Privacy Rule and announces settlements with practices.
Corrective action plan. The set of steps, such as written policies and staff training, a practice agrees to carry out as part of an OCR settlement.
Review gating. Screening patients and sending review requests only to those expected to leave a positive review, which Google's rules prohibit.
Flagging. Reporting a review to the site for a specific rule it breaks, so the site can decide whether to remove it.
Per-provider pricing. A monthly fee charged for each doctor or dentist, as opposed to per-location pricing charged for each office.
