A public patient review does not give a healthcare practice unrestricted permission to discuss the person's care. Use a response process that protects confidentiality, offers a private contact route and separates service improvement from public debate. In the US, covered providers must consider HIPAA alongside other applicable duties.
01
Keep clinical and identifying details out
Do not correct a review by publishing appointment dates, diagnoses, treatment decisions or account balances. Even confirming that the reviewer is a patient can create a confidentiality problem. HHS has taken enforcement action concerning patient information disclosed in review responses. Have a designated person review proposed replies, and keep access to clinical records separate from the task of writing a public message. A reviewer sharing their own experience does not remove the practice's responsibilities.
02
Use a restricted response workflow
Preserve the review in an appropriate internal system and route the concern to the right owner. Decide whether a general acknowledgment is useful or whether no public reply is safer in the circumstances.
- Use neutral language about the practice's process rather than the individual's case.
- Provide a verified private contact channel without requesting details publicly.
- Investigate service concerns internally with authorized staff.
- Report a platform violation only when the evidence fits the relevant policy.
03
Example: a disputed billing review
A reviewer alleges that an unexpected charge was unfair. A public reply should not quote the account, insurance information or treatment history to prove a point. The practice can provide a general billing contact and review the matter privately. If the complaint reveals a recurring explanation problem, improve the billing information offered to future patients. The operational lesson can be addressed without identifying the reviewer in a public update.
Frequently asked questions
Can a practice copy a positive patient review into advertising?
Do not assume public posting provides every permission needed for advertising or disclosure. Review consent, professional rules and applicable privacy requirements before republishing it.
Does HIPAA govern a clinic in Mexico?
Do not assume it does. Mexican providers must assess applicable local confidentiality, health and personal-data obligations. The practical principle of avoiding public patient disclosures remains important, but the legal analysis differs.
Continue with your next step
Related guides on this topic
Sources and policies
Check the current policy before submitting a request.
You do not have to figure out the next step alone.
Share the URLs and explain your concern. We will review the context and explain which options are worth assessing.
Request a confidential reviewOr call (307) 429-2531Educational information, not legal advice. Outcomes depend on the facts and decisions made by third parties.