HIPAA and Google Reviews for Dentists: What You Can (and Can’t) Reply

Dentists can ask patients for Google reviews. A public reply cannot confirm that the person was a patient, name a procedure, or discuss treatment. Ask after the visit with a short, neutral message and a direct review link. Do not ask only the happy patients. Do not mention the tooth, the film, or the insurance claim in the thread, even if the reviewer already did. This is an operations guide for a dental office, not legal advice. Confirm the wording with your compliance lead or counsel before you paste it into a profile that already has reviews.

The review itself is the patient’s choice. They may write whatever they want about their own care. You do not get to match that detail in your reply. The automation how-to for the ask, without the compliance rules, is review automation for dentists. This page is what you can say, and what you must leave out, once a review is public.

What a dental office can ask, and when

A review request is allowed when it does not reveal protected health information to anyone who should not have it. In practice that means the request goes to the patient, on a channel they already use with you, after a completed visit, and the message does not name the treatment. “Thanks for coming in today. If you have a minute, here is a link to leave an honest Google review” is a request. “Thanks for coming in for your root canal on tooth 14” is a clinical note sent over SMS. Do not do the second one, even if the patient knows what they had done.

Ask after the visit is complete, not at the first phone call that booked them, and not while they are still in the chair. A front-desk tablet passed to every patient with “tap five stars before you leave” is the wrong tool. It pressures people, it often uses one shared device, and it tends to turn into gating: the coordinator only hands it to the smiling ones. Hand the same path to every completed visit. A text or email after they have left the building is calmer, and it does not put a camera and a form in their face at checkout.

Do not offer a whitening add-on, a waived copay, or a raffle entry for a review. Google treats incentives for posting, changing, or removing a review as fake engagement. A dental office that “thanks” a five-star review with a free exam on the next visit has created both a Google problem and a messy record. Keep the fee schedule on the fee schedule.

Staff can mention that reviews help other local patients choose a dentist. They cannot coach the words. Do not give a sentence to paste. Do not ask them to “just say Dr. Lee was gentle with the extraction.” That sentence confirms a procedure and a clinician in a message you caused. If the patient writes that later, on their own, that is their review. Your job is not to supply the clinical plot.

What you cannot put in a Google review reply

Read the review. Then write as if a stranger who has never been in your office will read your sentence next to their name. If your reply would tell that stranger that this named person is a patient of yours, stop and shorten it.

Do not confirm the visit. “Glad you came in on Tuesday” confirms the appointment. “Thank you for the feedback. We are glad to hear that” does not. Do not say “we have you in our system” or “our records show you were here in March.” Do not correct the date of a visit. Do not name the hygienist, the operatory, or the referral source.

Do not name or correct the procedure. If they write “worst filling of my life,” you do not write “that was a crown, not a filling, and we explained the crack.” You also do not write “sorry the filling was uncomfortable.” Both lines confirm treatment. A safe public reply is gratitude or concern, plus an offline path: “Thank you for sharing this. Please call the office and ask for the manager so we can speak with you directly. We do not discuss care details on a public review.”

Do not mention insurance, balances, missed appointments, or a payment plan. “You still owe the lab fee” is a billing disclosure in a review thread. Collect that on the phone, using the identity checks you already use for billing calls. Do not quote a chart note, an x-ray finding, or a “you refused treatment” history. Those lines feel like a defense. They are also a file, published.

Do not reply with the patient’s full name if the review shows only a first name or a nickname. Do not ask other patients to post in support. Friends-and-family review drives, and staff reviews of their own employer, are not a compliance plan. They are manufactured reviews.

Safe replies, and the unsafe versions to retire

Positive review that names a procedure. They wrote it. You still do not repeat it. Safe: “Thank you for the kind words. We are glad your visit went well. The team appreciates you taking the time.” Unsafe: “So happy the implant feels natural already. Dr. Shah will be glad to hear the bite is good.” The unsafe line confirms a clinician, a procedure, and an outcome.

Negative review about pain or a result. Safe: “We are sorry to read that your experience was frustrating. Please contact the office so we can talk with you. We do not discuss treatment on Google.” Unsafe: “The sensitivity after a deep filling is normal for two weeks. You should have called instead of posting.” That line diagnoses, lectures, and confirms the procedure.

Review from someone you cannot match. Safe: “Thank you for the note. If you were seen at this office, please call so we can help. If this was meant for another practice, we understand.” Do not write “we have no patient by this name,” which is still a statement about your records, and do not speculate about a competitor.

Review that includes details you must not amplify. Do not quote the clinical part back. Do not argue with a claim of a missed infection in the thread. One calm reply, then the phone. If the text is abusive or unrelated to a real visit and you believe it violates Google’s review policies, report it through the profile tools. A report is not a clinical response, and a report is not something you announce with the chart.

Train the person who posts replies. Many offices let whoever is at the front desk reply between calls. That is how a well-meaning “sorry about the root canal” gets published. Put the safe templates in a note the owner approves. Require a second look on anything one star or anything that mentions pain, a child, or a named doctor. The broader reply tone, for non-clinical shops, is in how to respond to negative Google reviews. Use it for structure. Swap out any line that would confirm a patient relationship before you hit send.

A front-desk routine that stays review-safe

Decide the moment. For a general dental office, the clean trigger is a completed appointment that is checked out, after the patient has left, the same day. Not the recall reminder. Not the new-patient form. Not a blast to every chart from the last two years. A one-time note to recent completed visits can be done carefully. A year of charts is not a review campaign. It is a mailing list with health context, and it should not be exported into a consumer texting tool without a proper review of how you handle that data.

The message content stays non-clinical. Business name, city if needed so they open the right listing, a direct Google review link copied from Get more reviews, and a stop instruction. Do not include the appointment type in the SMS body. The scheduling software may know it was a crown seat. The text should not.

Same script for every completed visit. If the visit went poorly, you still do not withhold the Google path and send only a private survey to unhappy patients. That is gating. You can, separately, have a normal customer-service call when someone is in pain. That call is care. It is not a filter that decides who may speak on Google.

Watch the listing you send them to. Dental brands often have a practice profile and old practitioner pins. Copy the review link from the profile you want reviews on. A patient who lands on the wrong pin still did the work. You then have a public review on a listing you barely manage, and a reply problem on both. The same link discipline is in how to create a Google review link.

Log the ask as “request sent,” not as “patient had a filling.” If a vendor dashboard stores the reason for the visit next to the phone number, turn that field off. The dashboard should show channel, time, and whether they opted out. It should not become a second chart.

If you want a simple outside read on how the public profile looks to a stranger, check your Reputation Score. That view is about the listing, not the chart. Pair it with the free playbook for the request wording, then have compliance strike any line that names a procedure before the team uses it.

You can run this by hand, and the software has to stay as careful as you

An owner or office manager can do the whole loop with a copied review link, a plain text saved in the computer, and a rule: no procedure names, no visit confirmation, no reply posted without a second read. You do not need a bot to be HIPAA-aware. You need a habit.

ReviewNix connects the Google Business Profile and can send a neutral SMS, email, or WhatsApp request after a completed visit. The message stays a review ask. It does not need, and should not carry, the procedure, the tooth, or a note from the clinical record. Reminders stop when the person opts out. The dashboard is for sends and replies, not for charting. AI reply drafts can start from the public review text. A person in the practice must edit them so the draft does not confirm a visit or invent a clinical fact. If a draft says “sorry about your extraction,” you delete that line before it ever posts. The tool does not replace your privacy rule. It removes the reason people improvise a chatty reply at the front desk because nobody had time.

Set it up once. Let ReviewNix handle the follow-up. Start on the trial form if you want the ask to leave the building with the patient, in neutral words, instead of living in a clipboard at checkout.

FAQ

Is it a HIPAA problem to ask patients for a Google review?

Asking after a completed visit, in a private message, without naming the treatment, is a normal office request. Confirm the process with your own compliance officer. Do not put diagnosis or procedure names in the text. Do not send the ask to a family member’s number unless that is already an approved contact for that patient. The patient decides whether to write a review. You do not decide the words.

The patient named their procedure. Can I thank them for mentioning it?

No. Their choice to write a detail is not permission for you to repeat it. Thank them in general terms and stop. Repeating “the crown” or “the extraction” in an owner reply confirms care to everyone reading Google. If they ask a clinical question in the review, invite them to call the office. Answer it on the phone, not under the star rating.

Can we only ask patients who leave happy feedback at checkout?

No. Choosing who gets the Google link based on a smile, a survey score, or a “how did we do” tap is gating. Ask every completed visit the same way, or do not ask. You may still call someone who is in pain. That is follow-up care. It is not a reason to hide the public review path from them and show it only to promoters.

Who should hit reply on a dental Google review?

One trained person, with a second reader for anything negative or anything clinical. Front desk staff can be that person if they have the templates and the rule set. Do not let an associate fire off a reply from a phone between patients. Google says you must verify the business before replies can be posted, and the reply is public under the practice name. Treat the send button like a letter that leaves the office, because it is one.