Review Reply HIPAA Checker
Paste a draft reply to a patient review. We flag the phrases that could create HIPAA exposure, and we show you why each one is flagged.
Your text never leaves this browser. Nothing is sent to us, stored, or logged.
This is not legal advice, and it is not a compliance guarantee. It checks for common patterns only. A clean result doesn't mean a reply is compliant. A flagged result doesn't mean it definitely isn't. Confirm anything specific with your own counsel.
Your text never leaves this browser. Nothing is sent to us, stored, or logged.
Six Pattern Checks, Run on Your Draft
The tool above runs six checks. Four run on your draft reply alone. Two — whether it repeats a clinical detail the reviewer already disclosed, and whether it names the reviewer beyond what they posted — get sharper if you also paste the original review. That second field is optional, and the four main checks run either way.
Every match gets highlighted directly in your draft, with the specific category and a one-line reason underneath. Nothing here is scored, ranked, or averaged into a single number — you see the exact phrase, and you decide what to do with it.
What It Does Not Do
It doesn't read your state's specific rules, your practice's specific risk, or the original platform's own policies. It doesn't catch every possible phrasing — six pattern categories can't cover every way a reply might drift into risky territory. And it never tells you a reply is safe to post. It only tells you what it found, and why that specific phrase is worth a second look.
Four Things a Reply Must Never Contain
Confirmation this person is a patient
"Our patient", "your appointment", "you were seen" — each one confirms a relationship with a specific, identifiable person, which is itself protected information.
Any clinical detail
A condition, a treatment, a medication — even one the reviewer named first. Their disclosure isn't permission for your practice to confirm it.
Any date, time, or visit detail
A specific day or appointment time can identify a person almost as precisely as a name, especially alongside other public details.
Anything about payment or billing
Balances, insurance, and charges are protected the same way clinical information is.
A safe reply does the opposite of all four. It acknowledges the feedback, invites the person to a private channel, and stops there. Below is that template. It is general enough to adapt, and specific enough to actually use — shown here directly, not locked behind running the checker above.
Thank you for taking the time to share your feedback. We take every patient experience seriously, and we'd like to understand more. Please reach out to our office directly so we can look into this properly — we're not able to discuss any specific patient details in a public reply.
Review replies are one of the more common, avoidable ways a practice creates its own HIPAA exposure. See the real enforcement context on our reputation management page.