Your Reputation’s Real Risk Is the Reply
A one-star review is not, by itself, a HIPAA problem. Your reply can be. If it confirms someone was a patient, names their treatment, or restates their complaint in detail, you have likely disclosed protected health information in public — and that exposure is real and enforced.
Read the next section before you answer the review that brought you here.
Free. No card. About 40 seconds.
The Reply Is the Liability, Not the Review
Star ratings recover. A public HIPAA disclosure does not un-happen.
That is the actual asymmetry behind every angry reply, and it is the reason this page exists. A reply must never contain the four things below — saying “we treated you for X” confirms a patient relationship even if you never wrote a name. That confirmation is the disclosure.
- The patient's name, or anything else that identifies them as a patient.
- The specific treatment, procedure, or visit details.
- A diagnosis, condition, or any health information.
- Billing, payment, or insurance details.
This already happened, in public, to a real practice. In 2023, the HHS Office for Civil Rights fined Manasa Health Center $30,000 — a psychiatric practice in Kendall Park, New Jersey. It had replied to four negative Google reviews and disclosed patients’ mental health diagnoses and treatment details. OCR found this violated the HIPAA Privacy Rule under 45 C.F.R. § 164.502(a) and § 164.530(i), and the practice took on a two-year corrective action plan.
[UNVERIFIED — RITIK TO CONFIRM] This case is confirmed against secondary legal-industry reporting (HIPAA Journal, JD Supra), not against the HHS resolution agreement directly — HHS.gov blocked automated verification. Confirm the figures above against the source before this page is treated as final.
The safe version of a reply says almost nothing: thank the reviewer, say the practice takes the feedback seriously, and ask them to reach out directly by phone or email. No confirmation, no clinical detail, no defense of the treatment. The diagram below sets out exactly when even that much is right.
This is not legal advice. Confirm anything specific to your situation with your own counsel before you rely on it.
| Most reputation work tracks | What we track |
|---|---|
| Star average alone | Velocity, response rate, consistency, and AI visibility together |
| Reply written to defend the treatment | Reply written to avoid confirming a patient relationship |
| One profile kept current | Every directory a patient might actually check, kept consistent |
| Reviews solicited from happy patients only | Every patient asked the same way, every time |
Three Questions, in Order
This is the same check we run before any reply goes out on a client’s behalf. It takes longer to read than to use.
Four Things Move It, Not One
Reputation management is not just star average. An angry owner rarely tracks any of the other three.
Review velocity and recency
These carry more weight than the average itself. A 4.8 average built from reviews mostly over a year old reads as stale to a patient checking today, and increasingly to an AI system summarizing your practice too.
Response rate
This is a signal patients and AI systems both read. A practice that never replies reads as absent. One that replies to everything, generically, reads as automated. Neither builds trust.
Cross-platform consistency
Your name, address, phone number, and specialty need to match across Google Business Profile, Healthgrades, and every insurance-network directory a patient might check before booking.
AI visibility
We’re telling you what we’ve observed, not what any vendor has confirmed: AI answer engines appear to read this same reputation surface when deciding which practice to name. None of them publish how.
Practices with consistent, current, well-answered profiles get named more often in our own monthly checks.
What Actually Happens, in Order
The steps below run in this order for every practice, every month. Later steps depend on the ones before them.
Audit the current surface
We check your review count, velocity, response rate, and consistency across Google Business Profile, Healthgrades, and the directories your specialty actually uses.
Fix the entity mismatches first
Inconsistent name, address, or phone details get corrected everywhere they appear. A review strategy built on top of mismatched listings is building on sand.
Put a safe reply process in place
Templates that thank the reviewer, avoid confirming a patient relationship, and move the conversation offline — checked against the four rules above every time.
Build response rate and recency deliberately
Real reviews get real, timely replies. We do not buy, generate, or incentivize new ones — see what we will not do, below.
Track it monthly, alongside AI-answer citations
Reputation and AI visibility get reported together, because we've observed they move together.
What We Will Not Do
Naming what we refuse is the cheapest real credibility a new agency can buy.
We do not write replies as your practice.
A reply that confirms someone is a patient is your exposure, not ours. Putting our name behind it does not change whose license is on the line.
We do not buy, generate, or incentivize reviews.
The FTC's final rule against fake and incentivized reviews took effect October 21, 2024, and it carries real civil penalties. We would rather have forty real reviews than four hundred purchased ones.
We do not review-gate.
Asking happy patients for a public review while routing unhappy ones to a private form is a direct violation of Google's Business Profile policies, and Google's own systems are built to detect the pattern.
Handled Differently by Specialty
Dental
Dental reviews split the same way patient searches do. An emergency patient who waited too long in your lobby leaves a different kind of review than an elective patient unhappy with an Invisalign timeline. Both need a reply that never confirms treatment details, but the tone that calms one rarely calms the other. We track dental reviews inside the same emergency-versus-elective split our dental marketing work already runs on.
See our dental marketing approachDermatology
Dermatology carries an extra risk most practices miss: a photo. A reviewer who posts a picture of a rash or a cosmetic result and tags your practice has already made a disclosure you did not make. Replying with any clinical detail about that photo still becomes yours. We handle this inside the same medical-versus-cosmetic split our dermatology marketing work runs on.
See our dermatology marketing approachThe Same Three Tiers, Built for Reputation Work
The engagement tiers do not change for reputation work specifically. What changes is how much of the audit, reply process, and monthly tracking your practice needs built from scratch.
| Tier | Price | Best for |
|---|---|---|
| Visibility | $1,500/mo | Single-location practices that need listings corrected and a safe reply process built for the first time. |
| Growth | $3,500/mo | Practices with real review volume and no consistent process across Google, Healthgrades, and insurance directories yet. |
| Market Leader | $7,500/mo | Multi-location or DSO-affiliated groups running the same reputation process across several practices at once. |
Every tier includes the reply-process build and monthly consistency tracking described above. Full feature lists and annual pricing live on our pricing page.
We Turn Down More Practices Than We Take On
Already has a written review-reply policy staff follow correctly
You don't need us to build what you already have.
Wants us to write replies under the practice's name
See what we will not do, above — this is the one line we do not cross.
Looking to buy or incentivize reviews
We will turn this down every time, not just say so on this page.
Fewer than 10 reviews total
Reputation work needs a real surface to manage. Fix intake and ask real patients first.
Needs a crisis handled today
We build the ongoing process. For an active HIPAA exposure, call your own counsel first.
More on who we are and how we work is on our about page.
Before You Ask
Someone already saw our bad reply. Can anything be done?
Delete or edit it immediately, and stop making it worse. Whether it needs to be reported further depends on what was disclosed and to whom — that is a question for your own counsel, not something we can answer generally.
Do you handle the HIPAA side, or is that on us?
We build the reply process and templates to avoid the exposures on this page. Your own compliance officer or counsel signs off on anything specific to your practice. We are not a legal substitute.
How is this different from a general reputation management company?
Ask a general agency whether their reply templates are checked against the HIPAA Privacy Rule specifically. Most are not, because most of their clients are not covered entities.
Do you guarantee our star rating goes up?
No. We report what we measure: response rate, velocity, and consistency, tracked monthly. A star average is an outcome of real care and real replies, not something an agency can guarantee.
What if a review is fake or from someone who was never a patient?
Flag it through Google's own review-reporting process first. We can advise on wording, but we do not file disputes on your behalf without your sign-off — the practice's name is what's on record.
What happens if we stop?
Nothing locks you in. The engagement runs month to month, and we put the terms in writing before anything starts.
See What AI Says About Your Practice
We send three real patient questions to a live AI answer engine and show you the exact answers it gives back — who gets named, and who does not. No call required, and the report is yours either way.
It is also the fastest way to see whether your practice already has the consistent listings and response rate this page is about, or whether that work is still ahead of you.
Free. No card. About 40 seconds.
Read more about the method behind this on our healthcare SEO page, or see how ranking and being named differ on AI search visibility.