When you operate a medical or dental practice, hospital, medical spa, or any other healthcare clinic — or support one as a marketing agency — you understand the importance of adhering to HIPAA regulations and keeping patient information private. But one area where healthcare providers need to be especially careful is when responding to patient reviews. 

Customer reviews are critical to business success these days, regardless of the industry, and they can show up anywhere — on third-party review sites, Google, in social media posts, even on the business’s website. 

Although it’s a best practice to respond publicly to every review that comes in — not to mention good for your brand — businesses in the healthcare space have a few more rules to follow and more at stake. Bottom line: the personalized, detailed responses that are recommended and even expected for other industries need to be avoided in healthcare and won’t work for HIPAA-compliant review responses.

In this article, we’ll cover what the rules are, the consequences of not following them, and give examples of HIPAA-compliant review responses and non-compliant responses. You can use this information to confidently move forward with your review strategy at your practice or clinic, or for the healthcare clients you support.

What are the rules for HIPAA-compliant review responses?

Because HIPAA is first and foremost concerned with patient privacy, a HIPAA-compliant review response has to be the same — whether the review is positive, negative, or neutral. 

Though you can’t control what a patient might include in their review, you do have to control what you include in your response, and that means leaving out any protected health information (PHI) or other identifying information. Here’s a summary list of PHI covered under HIPAA that you cannot post publicly in a review response:

• Personal identifiers such as name, address, age, gender, and Social Security Number
• Electronic identifiers such as telephone, fax number, email, and website URLs
• Biometric identifiers such as fingerprints and full-face photos
• Medical record numbers, account numbers, insurance claims, and eligibility approvals
• Diagnoses, medical conditions, medical advice, treatment plans, dates of diagnoses or treatment, and payment for treatment
• Names of doctors, nurses, or other medical personnel who may have assisted the patient

The main rule of thumb to follow is this: In their review, even if the patient discloses or mentions their own name, condition, diagnosis, treatment, a specific doctor they saw, any medical advice they were given, or the fact that they are a patient at your clinic or hospital, you cannot respond publicly to those details without breaching confidentiality. Instead, to ensure a HIPAA-compliant review response, you need to keep it as generic as possible and include a disclaimer about your inability to comment on specific details due to privacy regulations (we’ll show you what that looks like in the examples later on). 

Sometimes reviews can be confusing, though. In the interest of nurturing patient relationships — especially one that may have soured from a poor experience — you want to be able to respond appropriately and empathetically without crossing a line, yet you may not always understand where that line is. When in doubt, it’s always a good idea to consult with legal counsel about how to create and maintain HIPAA-compliant review responses.

What happens if you don’t follow the rules?

To review: If you include anything in your review response that identifies the patient or their condition, treatment, or doctor, you’re violating their patient privacy — regardless of how forthcoming the patient might have been about those details themselves.

HIPAA violations can have serious financial penalties — even if the violations are completely unintentional. Whether accidental or not, violations can cost you anywhere from $100 to $50,000 in fines, per violation. If you rack up several violations in a year, it can get very expensive. 

In addition to running afoul of HIPAA, you can also become the target of patient lawsuits if reviewers feel you violated their privacy in some way, which can bring additional financial harm to your practice or clinic. That’s why it’s better to be clear upfront about the risks to patient privacy in public forums and how to avoid them, then to find out after the fact.

However, don’t let these discussions turn you off from responding to patient reviews. There are definitely ways you can write HIPAA-compliant review responses that keep patient privacy intact while enabling you to engage productively with the reviewer and earn or strengthen their loyalty.  

4 steps for handling patient reviews

Before we get into specific HIPAA-compliant review response examples, here’s a step-by-step guideline you can follow every time you get a patient review:

1. Think it through before responding

Before writing or posting anything, pause a moment and decide:

• Did the reviewer include any PHI in their review that has to be avoided in the response?
• Is the review positive — in which case a simple “thank you” is fine?
• Is the review negative — in which case a more thorough interaction with the reviewer may be necessary?
• If the review is negative, do you fully understand the reviewer’s experience or complaint, and if not, what questions do you need to ask to understand it better?

Sometimes when you get busy, the impulse is to check off the boxes quickly — patient review comes in, review response goes out, move on to the next item on your list. But it’s better to take some time first so you know what you’re dealing with and can craft a thoughtful, appropriate, HIPAA-compliant review response.

2. Thank the reviewer

Whether the review is positive or negative, always thank the reviewer for their feedback. This shows them that you’re paying attention, care about what they have to say, and sincerely want to improve if there is an issue. 

You can work a “thank you” into any kind of response you give without violating HIPAA. In fact, sometimes it may be the only thing to say publicly, as we’ll talk about next.

3. Take the conversation offline, if necessary

Let’s be honest: negative reviews can be unpleasant. And because healthcare businesses have to be extra cautious about how they respond, it’s very likely that you can’t address the details that are included in the reviewer’s complaint, unless you want to risk a response that violates HIPAA. Nor is it a good idea to get into a back-and-forth with a disgruntled reviewer in a public, online setting.

This can understandably feel uncomfortable, though, since you want to be respectful to the reviewer and adequately address their concerns. At the same time, you need to be aware that there could be potential patients watching how you handle the review.

In keeping with HIPAA-compliant review responses, when a review is negative, the best way to respond is to thank the reviewer for their feedback — as noted above — and let them know that due to privacy regulations, you can’t discuss specific details. Then, invite the reviewer to discuss their comments with you further on a phone call. That way the reviewer isn’t being ignored, and you can get the information you need to better understand the situation and come up with a resolution.

4. Turn patient feedback into action

Positive and negative feedback both point somewhere — to things that are going well that you should do more of, or things that aren’t working and need to be fixed.

Feedback is always valuable, so take the information the reviewer is giving you and turn it into action. It helps to use a software platform that can analyze patient sentiment and deliver easy-to-understand insights you can use to make effective changes that ensure a better patient experience — and get more positive reviews to boot.

Examples of non-compliant and HIPAA-compliant review responses

Now that we’ve talked about the basic steps for handling patient reviews, here are some examples of review responses and what makes them HIPAA-compliant or not. Feel free to borrow and rework the HIPAA-compliant examples to use in your own practice, clinic, or hospital.

Doctor’s / dentist’s office:

Positive review: “My name is Jan and I recently had my yearly check-up with Dr. Jones at your office. I just want to say how great Dr. Jones and the rest of your staff were. They were prompt and helpful, and I really appreciated it.”

• Non-compliant response: “Thank you, Jan! We’re so glad to hear from our patients when they have a great experience with Dr. Jones and our staff.”
• Why it’s non-compliant: The response mentions the patient’s name, the doctor’s name, and acknowledges that the reviewer is a patient.
• HIPAA-compliant review response: “Thank you! We strive to be prompt and helpful, and we really appreciate your feedback.”

Negative review: “I was just at your clinic for a teeth-cleaning and I was so disappointed. Dr. Cook was 20 minutes late, the person who checked me in was rude, and I got billed twice for the service. I’m seriously thinking about not coming back.”

• Non-compliant response: “I’m so sorry to hear that you didn’t have a great experience and that we incorrectly processed your billing. I will also address your concerns with Dr. Cook and our front-desk personnel so we can do a better job going forward. Please consider returning as our valued patient and enjoy 10% off the next teeth-cleaning you book with us.”
• Why it’s non-compliant: The response mentions treatment, billing, the doctor’s name, and acknowledges that the reviewer is a patient.
• HIPAA-complaint review response: “Thank you for this valuable feedback. Due to privacy regulations, I can’t discuss specific details. However, please call [phone number] and ask to speak with our office manager, who will be able to discuss your concerns.”

Hospital:

Positive review: “My nephew Brad was admitted to the ER after a car accident, and we couldn’t have had a better experience during such a stressful time. The ER doctors and nurses were so kind and worked hard to stabilize him and treat his broken leg. We felt well taken care of the entire time. For anyone who has to unfortunately end up in the ER, [hospital name] is the place to be.”

• Non-compliant review response: “We’re so glad to hear that you had a positive experience with our ER staff as they treated your nephew Brad’s broken leg. We want to extend our wishes for a speedy recovery.”
• Why it’s non-compliant: The response mentions a medical condition and acknowledges the reviewer’s nephew was a patient.
• HIPAA-compliant review response: “Thank you for your positive feedback. We take great pride in having a well-run, well-staffed emergency room to help care for the community.”

Negative review: “Whatever you do, don’t schedule surgery at [hospital name]. I had gastrointestinal surgery there about three weeks ago, and it was an awful experience. Everyone I encountered was too busy to talk to me about the procedure, I didn’t know what to expect, and when it was done, I was left alone in the recovery room for way longer than I was told. It’s clear the staff doesn’t care at all about the patients.”

• Non-compliant review response: “Thank you for letting us know about your patient experience. I’m so sorry it was disappointing. We work hard to provide a high level of patient care, but it looks like we didn’t meet our own standards this time. Would you mind disclosing how long you were in the recovery room, so we can look into this further?”
• Why it’s non-compliant: The response acknowledges the reviewer was a patient, mentions an aspect of the medical treatment (recovery), and publicly asks for more details about the recovery experience.
• HIPAA-compliant review response: “Thank you for your comments. We take all feedback very seriously. Due to privacy regulations, we’re unable to discuss specific details. However, please call the hospital administrator at [phone number] as they will be able to further address your comments.”

Medical spa:

Positive review: “I’m a 34-year-old who had lip injections two days ago for the first time. They were done by Kelly. I have to say she was amazing — so professional — and she gave me tons of good advice afterward. I highly recommend her and [med spa name] for anyone looking for the same service.”

• Non-compliant review response: “This is great to hear! We love our first-time customers. Thanks for letting us know about your positive experience with Kelly and our lip injection service. We hope to see you back here soon.”
• Why it’s non-compliant: The response mentions a particular staff member and treatment, and acknowledges the reviewer is a customer/patient.
• HIPAA-compliant review response: “Thank you for your great feedback. We put a lot of effort into providing positive experiences for anyone who visits.”

Negative review: “Don’t bother going to [med spa name]. I had a laser treatment on June 4 and couldn’t leave my house for a week after. I had a weird reaction to it as soon as I got home and freaked out about it, but I couldn’t get anyone to call me back! Terrible customer service. Not worth the time or money.”

• Non-compliant review response: “Thanks for letting us know about this upsetting experience you had with our laser treatment. We pride ourselves on our customer service and I’m sorry no one called you back. Could you let us know when you called and if you asked to speak to anyone in particular? Our phone system may have been down on June 4.”
• Why it’s non-compliant: The review mentions treatment, the date of treatment, and acknowledges the reviewer was a patient/customer.
• HIPAA-compliant review response: “Thank you for your feedback. Due to privacy considerations, we can’t discuss any details here, but if you’re willing to call the clinic director at [phone number], they’ll be happy to chat with you further.”

An important tip regarding AI-generated review responses

Many review management platforms utilize artificial intelligence (AI) to generate and automate review responses. This is a great feature to have as it can save tons of time and relieve the creative burden, especially for businesses with a small team juggling multiple responsibilities or agencies that are handling review management for multiple clients.

However, when it comes to AI, HIPAA-compliant review responses definitely require human attention. If you do rely on AI to write responses to patient reviews — even in a partial capacity, such as just for positive reviews — you still need to have someone who can carefully look over and, if necessary, ruthlessly edit those responses before they are posted publicly. That way, you can be sure to remove any PHI or other identifying information that could potentially violate HIPAA.

Even as generative AI tools continue to improve in ability and output, there is still an important role for humans when it comes to responding to reviews in the healthcare space. HIPAA is too critical to leave entirely to AI at this time. You’ll thank yourself for taking the extra step of running review responses past a human first before posting.

HIPAA doesn’t have to be an obstacle

Remember, you don’t have to fear patient review responses. Follow the guidelines here for HIPAA-compliant review responses, and engage legal counsel for additional questions you have or for help in responding if you’re uncertain about something.

You can successfully use reviews and review responses to engage with your patients, deepen their loyalty, and maintain a positive image of your healthcare brand. 

To learn about GatherUp’s comprehensive reputation management platform with review response capabilities, schedule a demo today.

Client acquisition is far and away the biggest challenge agencies face. Selling reputation management services is a way to bring in more small business clients, but it can be difficult to know how to grow and nurture the service — especially when technology is involved. 

Not every small business has a comfort level with transitioning business or customer data to a technology platform and managing it there, nor do they have a background in marketing to be able to immediately see why it’s a good idea. If you run an agency, it’s your team’s job to make the case for reputation management, but to do it successfully, you need effective strategies to grow, nurture, and retain those customers. 

This topic was recently discussed in-depth on a GatherUp webinar. Here’s a detailed recap of that discussion.

Building a solid foundation 

Last year, we surveyed marketing agencies to find out what their biggest challenges are. As we mentioned above, over half (56%) of agencies said getting new customers was the toughest hurdle, followed by managing client expectations (36%). 

Juxtapose this with the small businesses we also surveyed, in which we asked them which activities they have an agency manage for them. Thirty-two percent said SEO, 29% said web design and management, and 21% said digital advertising. Lower in the list was review and reputation management at 14%.

And here’s where the opportunity lies.

As popular as they are, when you manage SEO and web design for clients, it’s difficult to show instant value. It can take months of manually tracking and managing these functions before you can point to some successes. 

But if you start with a simple review management offering, you can achieve relatively quick wins, especially when you combine it with SMS/loyalty marketing to capture reviews from satisfied customers and marketing automation to make it faster and easier. 

Right out of the gate, offering review management helps address those challenges we mentioned above. First, it opens the door to new clients that need help with reviews and don’t have the resources to manage them in-house. Second, by taking a really simple approach to it, you can better manage client expectations. 

Whether your business clients have zero reviews or some reviews, you can greatly enhance and ramp up their review efforts by automating the process.

Of course, automation means technology. And any transition to a technology solution has to be handled thoughtfully. For example, in a healthcare setting in which patient data requires extraordinary care, clinics often fear their data and functionality could get lost. Knowing how to smoothly and carefully onboard and support clients with a reputation management platform is key, which we’ll talk about in greater detail below.

Acquisition strategies

It’s common knowledge in the business world that it costs significantly more to acquire a new customer than to retain an existing one. If you’re constantly having to acquire new customers, you’re spending more and more money to do so. 

To connect the dots with reputation management, it’s clear that small businesses need a solid review strategy. Ninety-six percent of U.S. consumers read reviews, and 66% say that online reviews make them trust a brand. In the healthcare space alone, 75% of consumers look online first to find out about a doctor, dentist, or medical care.

But the trouble is, when clients come to you for review help but don’t have a lot of experience with what they’re asking you to do for them, and they don’t see value right away, you could end up losing them. This means you have to start the (expensive) acquisition process all over again. 

Here are some strategies you can use to ensure more successful acquisition:

1. Define automation

The first step is helping your clients understand marketing automation in the first place. 

Most small businesses aren’t marketers by trade. They need a lot of help understanding these concepts upfront. They may vaguely realize they need consistent reviews coming in with consistent replies going out — and that it can be done through automation. Maybe someone in the business heard from a colleague about automation, or it was talked about at a conference they went to. 

As a result, they want “automation” as the endpoint but don’t necessarily know how to get there or what it looks like in practice. That’s where you can provide the education.

2. Explain the benefits

The second step is helping clients understand the benefits of automation. 

Automation doesn’t just streamline the review process. It also produces a wealth of data that can help you and your clients understand trends, uncover keywords to improve your clients’ online presence, and create more impactful marketing materials and promotions for them. Data from consistent customer feedback is equally important — especially the negative feedback — as it helps your clients make business improvements and learn how they can better take care of their customers.

Automation can also fill in some major gaps in the review process. A recent Moz study showed that 86% of consumers write at least some reviews, but 39% of review writers haven’t received a request in the past five years. Crucially, automating the review request process can fill in those gaps and make reputation management that much more effective.

3. Put internal structures in place

As you acquire more reputation management clients, you need the internal structures in place to manage them. 

That means making some predictions about the level of staff you’ll need. For example, you could set a threshold for the number of clients per staff member so you can anticipate the need for new staff as your client base grows. You can also map out both the onboarding process and the initial wins you expect to deliver to your clients. You can do this by breaking down — task by task — what you need to do for each client to determine how many hours it’ll take, per client, to set them up on the technology, as well as which tasks you’ve typically done manually in the past that you can then automate to save time.

Bottom line: it’s about making sure you have the staff, tools, and time in place to get the client to initial value in the most cost-effective way.

Activation and onboarding best practices

Onboarding is the bridge from sales to realized value. You might sell a lot, but if you have a poor onboarding experience with spotty communication or unrealistic timing, it doesn’t matter how much you’ve sold.

To be a partner in your client’s success, you need to do the following:

1. Create a roadmap for onboarding

Determine what you need to do — start to finish — to successfully activate and onboard a new client. This includes: 

• Training protocols — before going live and after
• The go-live date, with everyone on the same page
• Q&A sessions and check-in calls to solve problems and pain points along the way
• Communication at every step, with the right experts in place to answer specific questions and direct the process

The overall goal is to be proactive and to get ahead of any potential frustrations or minor annoyances before they turn into far bigger problems down the road.

Something like a minimum competency test or quiz can be helpful as well to ensure all users know how to perform basic functions in the platform. Think of it like this: if entry-level users don’t get it, no one else will either. (This is just as important for internal staff within your agency, too, since they also need to be familiar with the technology.) 

And remember that you don’t have to onboard the whole product in one sitting. Doing it in pieces or segments is easier and much less overwhelming. Find out what the initial two or three goals are that your clients want to address or learn how to do first, take care of those, and then slowly and steadily get them up to speed on the other goals or functions.

2. Celebrate successes along the way

Once value is achieved, celebrate it with your clients. “You have 10 new reviews.” Or “You now have more 5-star ratings.” Or “Your rating moved from 4 to 4.5.” Sending milestone emails in the early days, post-onboarding, can really start to show value to your clients.

At the same time, you can direct your clients how to aim higher and set more goals. “You sent out 100 review requests. We know that’ll convert into 3 new reviews. Now, let’s get 100 total reviews.” Your encouragement and goal-setting keeps everything moving forward and reinforces the value of reputation management.

Post-onboarding is also a good time to ensure features are used properly and to their best advantage to achieve even more success and avoid dips in review performance.

3. Align expectations

When clients come to you, it’s because they have a need. They want to increase business, get more repeat customers, and earn more reviews — whatever the case may be. As such, they need guidance about how to get there — which also means aligning their expectations. 

With clients up and running on the system, help translate a broad goal they have into an aggressive but realistic, reputation-specific goal — such as increasing volume and average rating. Then outline the key, day-to-day actions they can take in the system to start seeing results. 

It’s also helpful to look beyond the initial offering and make it clear to your clients how reviews, SEO, and keywords all work together, how each builds upon each other to increase business success. In effect, show them how reputation management ladders up to larger business goals. 

It’s also important to keep looking for ways to bring more value. When we surveyed small businesses and agencies, we found a gap between what agencies are doing vs. what the businesses are doing themselves. Many businesses are doing a lot of the social media work and review analysis on their own — rather than agencies doing it for them. These are typically tedious, time-consuming tasks that agencies could take over to increase the value clients get from the service.

Retention strategies for long-term success

Finally, keeping your reputation management clients engaged is the key to long-term success and retention. Here are some ideas for reaching out to clients on a regular basis, gauging their success with the platform, and maintaining contact:

1. Implement a feature series

This can involve creating and sending out a short explainer video that walks users through a key feature, workflow, or even a niche feature or workflow to help them use the platform more effectively. 

Building a video series also opens up lines of communication and helps solicit ideas from your clients about what they consistently need help with or areas where they could use more information. Having a solid library of videos can also help with onboarding and supplement training calls.

2. Continually discover and solve problems 

Sometimes a client’s initial problem gets solved only for a new one to crop up in its place. Data from the platform will often show an end customer issue before the customer even reaches out. At the same time, turnover or hiring within the business can raise new problems or expose the need to solve those problems from different perspectives. 

Successful retention requires constant iteration. It means looking at the data to discover new problems and new solutions, training support and customer success teams on new features, pairing new features with problems to solve, and making it easy for them to adopt the new features. 

3. Create regular touchpoints

Social media, e-newsletters, a podcast, webinars — whatever channels you use to engage with clients become valuable sources for clients to easily pop up in the moment and ask a question they really need an answer to. It’s important to be willing and able to listen and collect feedback wherever possible and through any means. 

4. Provide metrics

One of the best ways to retain clients is to give them tangible, granular metrics that provide insight and show value. These can include review volume and rating, numbers of customers or patients getting a review request, response rates, sentiment, and specific areas of focus or new products/services.

Final takeaways

Finally, as you scale reputation management, keep these tips and tidbits in mind:

• Implement clear processes
• Work from the perspective that onboarding is never done
• Maintain regular communication with clients
• Use every touchpoint as an opportunity to solve a problem
• Don’t underestimate the value of simple
• Challenge yourself to see how quickly and efficiently you can show value to your clients

To learn more, download the Review Management for Agencies eGuide.