How to report a fake or abusive Google review

For occupational, physical and speech therapy practices serving children or adults: Google removes a review only when it breaks a Google policy, never for being negative. Match it to a named policy, keep a private record of public facts, report it in the Reviews Management Tool, appeal once if refused, and reply without confirming anyone was a patient.⁠¹

Can a therapy practice get a negative Google review removed?

Only when the review breaks one of Google’s content policies; a low rating, a harsh tone or an account of events the practice disputes is not enough. Google’s Help page for business owners says any review can be reported but only reviews that break Google’s policies can be removed, tells owners not to report a review just because they disagree with it, and says Google does not get involved in conflicts between businesses and customers.⁠¹ The contribution policy protects the critical review written with restraint: it allows content that describes negative experiences in a respectful manner.⁠²

That leaves three separate jobs, and mixing them is where practices get into trouble:

• The policy question. Does the review break a named Google policy? Google decides, on a report from the practice.
• The public answer. Does the practice reply, and with what? The practice decides, within privacy law and its profession’s code.
• The concern itself. Is there something real to fix, such as an unanswered phone line or a confusing bill? The practice looks into it privately, whatever Google decides.

This guide covers the first two for reviews that look fake, abusive or misplaced. Asking every patient or family for reviews in the same way, and replying to ordinary praise and criticism, are covered in the review request and reply guide.

Which Google policies can a fake or abusive review break?

The sections a therapy practice meets most often are fake engagement and rating manipulation, conflict of interest, impersonation, harassment, offensive content, personal information, off-topic content and repetitive content, all in Google’s Maps contribution policy.⁠² Classify the review first, then report it under the one section its facts support:

• Fake engagement and rating manipulation. Content that is not based on a real experience or does not accurately represent the place, ratings that were paid for, content posted from several accounts by or at the request of one person, content posted on a competitor’s business to undermine its reputation, and unusual volumes or patterns of reviews that point to an effort to manipulate a rating.⁠²
• Conflict of interest. Google’s examples are current or former employment, a contractual or consulting relationship, and professional or personal ties such as competitors and family.⁠² A former employee’s one-star review and an owner’s cousin’s five-star review break the same rule.
• Impersonation. Content that pretends to be a person, group or organization; Google allows alternative names that are not meant to mislead.⁠²
• Harassment and hate speech. A specific threat of harm that would make a reasonable person fear for their safety, doxxing, and content that demeans people for a protected characteristic.⁠²
• Offensive content. Attacks on people, deliberately provocative content, and unsubstantiated allegations of unethical behavior or criminal wrongdoing.⁠²
• Personal information. Another person’s full name or last name posted without consent, and medical, financial or identification information about the writer or anyone else; Google allows the name of a public-facing professional doing business under their own name, and lists doctors among its examples.⁠²
• Off-topic content. Content not based on an experience at that specific place, and general, political or social commentary or personal rants.⁠²
• Repetitive content. The same content posted several times, from one account or many.⁠²

Extortion has its own route. A sudden run of one- and two-star reviews followed by a demand for money, goods or services to remove them goes to Google’s merchant extortion report form, not to the ordinary report.⁠⁵ Google can also act on a whole place: when contributions are consistently unhelpful, harmful or off-topic it may limit or suspend them, and it may turn posting off for a short time to protect a place from a spike in irrelevant or offensive content.⁠⁸

What does not prove that a Google review is fake?

An unfamiliar name, a low rating or no match in the schedule proves nothing on its own. Google lets people use pseudonyms as user names and prohibits only impersonation.⁠³ A parent may post under their own name rather than the child’s, an adult may use a nickname, and someone who called twice and never booked had a real experience of the practice’s phone line. A schedule search that finds no match may simply have searched for the wrong name, and its result is patient information that stays inside the practice, as the evidence section explains.

Timing is not proof either. A review that appears the day after a difficult phone call may be from that caller, or from someone else; the report rests on what the review and the reviewer’s public profile show.

Which reviews should a therapy practice report to Google?

Report the ones that fit a policy section on their public facts, reply to the rest in general terms, and send extortion to its own form. The table matches common situations to Google’s sections.

What evidence should a practice keep before reporting a review?

A short private record of what anyone can see, made on the day the review is found: the link, the display name, the date shown, the rating, the exact text, a screenshot, the profile it sits on, the policy section it seems to break, and the public facts that support that. To get the link, open the review in Google Maps and choose Share review, then Send a link.⁠⁹ For extortion, Google asks owners to gather evidence immediately, with screenshots that show the date, time and sender’s contact details as far as possible, and direct links to every review involved.⁠⁵

Never edit a screenshot, crop out the date or tidy a quotation. If the reviewer changes the review, capture the new version beside the old one: Google updates the date on a review when its writer changes it.⁠⁹

Why should patient records stay out of the review file?

Because the file leaves the care setting, and a covered practice’s uses and disclosures of protected health information have to fall within what the Privacy Rule permits or requires.⁠¹⁰ HIPAA counts information that relates to the provision of health care to a person, and that can identify them, as individually identifiable health information, so the bare fact that someone was seen, or when, is covered.⁠⁴ A review file passes to an office manager, perhaps an agency, and in part to Google.

If the review raises a real concern, look into it in the record system as its own task. The Privacy Rule’s definition of health care operations includes quality assessment, arranging for legal services and the resolution of internal grievances.⁠¹¹ Keep what that check finds in the operations record, out of the marketing file and out of anything sent to Google.

How do you report a review in Google’s Reviews Management Tool?

Sign in with the account that manages the Business Profile, open the Reviews Management Tool, and report the review with the reason that fits; the same report can also be made from the review list on the profile itself.⁠¹

1. Open the tool. Go to the Reviews Management Tool, confirm that the email shown is the one tied to the Business Profile or switch accounts, and select the business.⁠¹
2. Start the report. Choose to report a new review for removal, find the review and select Report.⁠¹
3. Choose the reason that fits. Pick the reason that matches the policy section in the evidence record, not the one that sounds most likely to succeed.
4. Submit and log it. Record the day, the reason chosen and who submitted it in the case tracker.
5. Check the status. Return to the tool: Decision pending means the review has not been evaluated yet, and Report reviewed - no policy violation means Google kept it.⁠¹

Google says evaluation typically takes several days.⁠¹ Report from the account that manages the profile, so the report, its status and any appeal sit in one place. Anyone can also report a review from Google Maps, and the Maps app keeps a list of a person’s reports with statuses such as Processing report, Content removed and Content not removed.⁠¹²

This route is for a single review. Google routes the appeal of a review removal decision through the Reviews Management Tool and the appeal of a suspended or disabled profile through its separate appeals tool, and a suspended or disabled profile has to be reinstated before any content decision can be appealed.⁠¹³ The suspended profile guide covers the profile appeal, and access, verification and duplicate problems are sorted out in the Google Business Profile troubleshooting guide.

Can you appeal when Google keeps a review you reported?

Yes, once. When the status reads Report reviewed - no policy violation, Google’s Help article offers a one-time appeal: in the Reviews Management Tool, choose to check the status of a review reported earlier, select Appeal eligible reviews (up to 10 at a time), and fill in the form.⁠¹ Google emails the result: a review that violates a policy comes down, and one that complies stays live, with its status showing Escalated - check your email for updates.⁠¹

Because there is one appeal, put the whole case in it: the policy section, the public facts and the links from the evidence record. Do not appeal a review that the evidence record does not support.

How do you report the account that posted a fake review?

Through the Google Maps app, when the account itself posts content that breaks Google’s policies: from the business’s reviews, tap the user’s name, tap More and then Report on their profile, and pick a reason such as Legal issue or Privacy concerns.⁠¹ Google asks people to report only profiles that post violating content, not users whose content is unwelcome but accurate and relevant, and says an assessment can take several days.⁠³

What should a report or appeal to Google say about the review?

The policy section, the public facts that show it, and nothing from the practice’s records. The ordinary report is a choice of reason, but the appeal form, the extortion form and a legal request all ask for details, and Google’s legal page asks for the specific URL and for precision about what is wrong and why.⁠^1,5,14

Everything in it leaves the practice. HIPAA’s definitions describe a disclosure as releasing or divulging information outside the entity holding it, so a report to Google is a disclosure like any other.⁠⁴ That is why the explanation neither confirms nor denies that the reviewer is a patient. “This person was never our patient” rests on a records search that may have used the wrong name, and the opposite sentence, written about someone who was seen, discloses their care.

The wrong-place line describes the business, not the reviewer: what the clinic offers and where, as anyone could read on its website.

How should a practice reply publicly to a review it has reported?

Briefly and generally, or not at all: a reply is optional, and one posted while a report is pending says nothing that confirms or denies a patient relationship. Google posts a business’s reply publicly under the review as the business, checks it against its content policies first, and notifies the reviewer, who can still change the review afterward.⁠⁹

Google’s own advice for negative reviews says never to share a reviewer’s private information and, when a situation is complex, to ask the reviewer politely to get in touch by phone or email.⁠¹⁵ The same page also recommends personal replies that use the reviewer’s name and respond to the particular points they raised.⁠¹⁵ That second tip was written for every kind of business; for a therapy practice, acknowledging the specifics is often how a reply confirms care, so leave it aside.

A reply never contains any of the following, because each one, tied to the reviewer, is information about their health, their care or its payment.⁠⁴

• whether the person, or their child, was seen, or when;
• appointments kept, missed or canceled;
• a diagnosis, a condition or the reason someone came;
• a bill, a balance, a plan or a payment;
• a therapist’s account of a session, or progress, or its absence (“your son did so well with us”);
• any sentence that begins “our records show”.

Use a route someone actually watches, and make sure the person who answers it follows the practice’s intake or complaint process rather than a script about the review. The review request and reply guide has wording for positive reviews and ordinary complaints.

Does a reviewer’s own post let the practice discuss their care?

No. The Privacy Rule starts from the position that a covered entity uses or discloses protected health information only where the rule permits or requires it, and its permission to disclose to the individual reaches the person, not every reader of their review.⁠¹⁰ HHS’s case against Manasa Health Center, which provides psychiatric services to adults and children in New Jersey, began with a complaint that it disclosed a patient’s information in its reply to the patient’s negative online review.⁠⁶ The resolution agreement lists impermissible disclosures about four patients in responses to their negative Google reviews; the practice paid $30,000, without admitting liability, and agreed to a corrective action plan.⁠^6,7 That plan required written policies on permissible and impermissible disclosures, training for everyone including owners and managers, and breach notices to each person whose information had been disclosed on Google Reviews or any other internet platform.⁠⁷

A parent’s review works the same way. For a child, the parent is usually the child’s personal representative, whom a covered practice treats as the individual, but that settles who may hear about the child’s care, not where: a public reply reaches everyone who reads the profile.⁠¹⁰

Do these privacy rules apply if the practice does not bill insurance?

HIPAA’s Privacy Rule may not, but the profession’s code still does. The rule binds covered entities, and a health care provider is one only if it sends health information electronically as part of one of the transactions HIPAA covers, such as a health care claim.⁠⁴ A cash-only practice that sends nothing of the kind may sit outside the rule, but not outside its profession’s code. APTA’s Code of Ethics for the Physical Therapy Profession requires physical therapists and physical therapist assistants to protect patients’ and clients’ confidential information and not to disclose it except as the patient or client authorizes or as the law permits or requires.⁠¹⁶ ASHA’s Code of Ethics, which applies to its members, its certificate holders and applicants, lets them disclose confidential information about the people they serve only where the law authorizes or requires it.⁠¹⁷ For occupational therapy, AOTA states the obligation of OTs, OT assistants and students to demonstrate ethical conduct with clients, families and caregivers, and its 2025 code’s Standards of Conduct are the enforceable part.⁠¹⁸ State law may add confidentiality rules of its own, a question for the practice’s attorney. The reply rules on this page fit every practice either way.

What should a practice do when a reviewer threatens or demands money?

Stop engaging, keep everything, and use the route that fits: Google’s merchant extortion form for a demand tied to reviews, a harassment report for a threat, and the police where someone’s safety is at risk. Google’s extortion page tells owners not to engage with or pay the people behind a scheme, not to try to resolve it by offering money or services, to gather evidence immediately, and to report every related communication in the form, including details of the suspicious reviews and how the demand was made.⁠⁵ The form is only for practices directly subjected to a demand for money or favors in exchange for removing reviews; spam and off-topic reviews take the ordinary report.⁠⁵ Google says privacy and security reasons keep it from sharing specific details of its investigation.⁠⁵

Apply the same caution to a vendor who offers to make reviews disappear. Third parties offer services that include responding to reviews, and Google’s advice when someone claims to work for Google is to ask the person’s name and request an email sent from a google.com address.⁠¹⁹ Removal is Google’s decision, made through the report and appeal routes on this page.⁠¹

Can a practice offer something if a reviewer removes a review?

No. Google’s contribution policy prohibits offering incentives such as payment, discounts or free services for revising or removing a negative review, and Google’s review tips call such offers fake and misleading content.⁠^2,15 A refund owed for a real billing error is a billing matter, settled on its own terms and never tied to the review. The reviewer can edit or delete their own review from their Google Maps contributions.⁠¹²

Pressure is ruled out too. Under the FTC’s rule on consumer reviews, it is an unfair or deceptive practice to try to get a review removed with a legal threat that has no foundation, a physical threat, intimidation, or a public accusation made knowing it was false or with reckless disregard for the truth.⁠²⁰ Never use a phone number or address from the chart to press someone about a review; an invitation to talk, in the public reply, is the most a practice offers.

Is a false review defamation, and who decides that?

That is a legal question for the practice’s attorney, decided on the facts and the law that applies, and this guide does not analyze it. Two practical points sit beside it. First, Google’s policy report and a legal claim are separate routes: Google’s legal help page takes requests about content that violates the law or a person’s rights, asks people to flag the content in the product first, and confirms each request with a reference number.⁠¹⁴ Second, anything the attorney needs about a reviewer’s care comes from the record system as part of arranging legal services, which the Privacy Rule counts among health care operations, not from the marketing file.⁠¹¹

Do not reach for a legal threat in the meantime. One posted in a reply or sent to a reviewer does not replace that conversation, and an unfounded legal threat made to get a review removed is itself an unfair practice under the FTC rule.⁠²⁰

How do reviews about children differ from reviews by adults?

The privacy rules are the same; what differs is who wrote the review and whom it describes. Five situations come up:

• A parent’s review about a child. It is the parent’s to write, and the reply still says nothing about the child. A review that identifies the child, or states the child’s diagnosis, may be reported under Google’s personal information section, which covers medical information about the writer or anyone else; report it on that ground only, with the public text as the evidence.⁠²
• A school or early intervention complaint on the clinic’s profile. A review may describe services a school district or an early intervention program delivered. If the clinic plays no part in that program, the review may be off-topic, since Google asks for content based on an experience at the specific place; if the clinic’s therapists serve that school or program, the review is about the clinic and stays.⁠² Either way, the reply describes the clinic, never the child or the program.
• An adult’s review that mentions a family member. An adult who writes that a spouse drove them to every visit has disclosed their own care; the reply mentions neither of them. A family member’s full name or last name posted without their consent falls under the personal information section.⁠²
• A review written by someone else about an adult. A daughter may review the practice about her father’s therapy. The reply answers the review, not the relationship, and tells the writer nothing about the patient.⁠¹⁰
• A review that names a therapist. Google allows the name of a public-facing professional conducting business under their own name, with doctors as an example; whether that covers a staff therapist is Google’s call, so report a clinician’s name only alongside another ground, such as a home address or a threat.⁠²

What should a practice never do about a fake or unfair review?

Never answer a bad review with fake engagement, pressure or disclosure, and avoid the quieter mistakes too:

• Counter-reviews. Reviews from staff, relatives, contractors or competitors are conflict-of-interest content, and reviews posted from several accounts at one person’s request are fake engagement.⁠² When Google finds that a business owner broke its fake engagement policy, it can stop new reviews for a period, unpublish existing ones or show a warning that fake reviews were removed.⁠²¹
• A sudden drive for praise. Google prohibits discouraging negative reviews or selectively soliciting positive ones, so asking only the happiest families to post this week breaks the policy.⁠² Ask everyone the same way, all the time.
• A reason chosen for effect. Report under the section that fits, even when another sounds stronger.
• A rebuttal in the reply. Facts from the chart belong nowhere in public, however unfair the review.⁠¹⁰
• Pressure on the reviewer. No threats, no offers, and no contact through the chart to press for removal.⁠^2,20
• Paying someone who promises removal. Google’s guidance on extortion is not to pay, and removal is Google’s decision.⁠^1,5
• Ignoring a real problem. If the review points at something true, such as an unanswered phone line or a confusing statement, fix it whatever Google decides, and never describe the fix in terms of the person.

The guide to the FTC review rule covers bought, insider and suppressed reviews under federal law in full.

How should a practice track a reported review to a decision?

One row per case, owned by one person, using Google’s own status words:

Label each case accurately. “Reported” is not “removed”, and an agency’s note that a report went in is not a decision. Do not tell staff that every one-star review can be taken down.

Ownership matters as much as the record. One person reports and replies, approved by whoever owns privacy decisions, and only the practice’s own people hold owner access to the profile; the troubleshooting guide covers a former employee or agency that still controls it. The Manasa plan’s requirement of written policies and training for everyone, owners and managers included, is a fair model for a practice of any size.⁠⁷

While a report is pending, keep everything else current: the website’s service pages, the Google profile’s hours and contact details, and any directory listing, so a family or an adult who reads one review also finds what the practice actually offers. The website content checklist covers the pages.

How do reviews and reports work on a DrSensory listing?

Families write reviews on a clinic’s DrSensory profile, and a paid listing can reply to them publicly.⁠^22,23 A review that breaks DrSensory’s review guidelines is reported to DrSensory from the Reviews page in the clinic’s portal, not argued in a reply.⁠²⁴ The reply rules above hold there too: answer as the clinic, about the clinic, and never confirm that the writer or their child was seen. The profile guide sets out the guidelines and how a report is decided.

What does reporting look like at a children’s clinic and an adult one?

The same steps lead to different routes: an off-topic review at a pediatric clinic, and an extortion run at an adult one.

Sources

1. Google. Report inappropriate reviews on your Business Profile (Google Business Profile Help). Checked October 26, 2026.
   Show the passageHide the passage

   “You can report any review, but only those that violate Google policies are eligible for removal.”; “Do not report a review just because you disagree with it or dislike it. Google doesn’t get involved in conflict between businesses and customers.”; from the profile, “Next to the review you’d like to flag, select Report”, with reasons such as “Spam” or “Profanity”; “Review evaluation typically takes several days. You can check the status of your report in the Reviews Management Tool.”; in the tool, “If the email address shown is the one associated with your Business Profile, select Confirm.”, “If you want to manage reviews for a Business Profile associated with another email, select Switch account.” and “Report a new review for removal”; statuses “Decision pending: The review is flagged, but it hasn't been evaluated yet.”, “Report reviewed - no policy violation: The review was evaluated, and no policy violation was found.”, “If you disagree with the decision, you can submit a one-time appeal.” and “Escalated - check your email for updates: The appeal has been escalated, and you’ll get an email about the final decision.”; “If a flagged review doesn’t qualify for removal, submit a one-time appeal.”; “Check the status of a review I reported previously and appeal options”; “At the bottom, select Appeal eligible reviews.”; “You can select up to 10 reviews.”; “If the review violates our policies, it will be removed.”; “If the review complies with our policies, it will remain live.”; to report a user profile in the Google Maps app, “To flag a user, tap the user’s name.”, with reasons such as “Legal issue” or “Privacy concerns”; “Occasionally, the system may also mistakenly remove legitimate reviews. If this happens, contact support for assistance.”
2. Google. Prohibited & restricted content (Maps User Generated Content Policy Help; every section opened). Checked October 26, 2026.
   Show the passageHide the passage

   “Contributions to Google Maps should reflect a genuine experience at a place or business. Fake engagement is not allowed and will be removed.”; fake engagement includes “Content that is not based on a real experience or does not accurately represent the location or product in question.”, “Reviews or ratings that have been paid for, directly or in kind.” and “Content that has been posted from multiple accounts by or at the request of one person.”; merchants and users may not “Offer incentives – such as payment, discounts, free goods and/or services - in exchange for posting any review or revision or removal of a negative review.” or “Post content on a competitor’s place or business to undermine that business’ or product’s reputation.”; rating manipulation includes “Content exhibiting unusual volumes or patterns of review contributions that are indicative of efforts to manipulate a place’s rating” and “Content that is based on a conflict of interest. A conflict of interest may include current or former employment, a contractual or consultory relationship, or other professional or personal affiliations that demonstrate a conflict of interest (such as industry competitors, familial relationships, etc.).”; merchants may not “Discourage or prohibit negative reviews, or selectively solicit positive reviews from customers”; impersonation: “Content posted or shared seeking to impersonate any person, group, or organization.” and “We do allow content that contains alternative names for a person or organization where the content is not attempting to mislead others.”; harassment: “Content that contains a specific threat of harm against individuals or defined groups of people that would make a reasonable person fear for their mental or physical safety or well being.” and “Doxxing.”; hate speech: “Content that is dehumanizing, belittling, or vilifies individuals or groups based on a protected characteristic.”; offensive content: “Using Google products to attack other individuals or groups.”, “Content that is clearly and deliberately provocative.”, “Unsubstantiated allegations of unethical behavior or criminal wrongdoing.” and “We do allow content that describes negative experiences in a respectful manner.”; personal information: “Content which contains personal information of another posted without their consent such as: full name, or last name, their face in a photograph or a video” and “Personally identifiable information and other personal information about yourself or others including financial information, medical information or personal identification information.”, while Google allows “An individual’s name if they are a public-facing professional conducting business under their name.”, including “Doctors, lawyers, realtors, financial planners, contractors and others professionals doing business under their names”; off-topic: “Only post content that is based on your experience or questions about experiences at a specific location.” and “We don’t allow content which contains general, political, or social commentary or personal rants.”; repetitive content: “Posting the same content multiple times either from the same account or multiple accounts”.
3. Google. Report inappropriate user profiles (Maps User Generated Content Policy Help). Checked October 26, 2026.
   Show the passageHide the passage

   “Only report user profiles that contribute content that violates Google policies. Do not report users that contribute content you don't like but is still factually accurate and relevant.”; “It can take several days for a profile to be assessed.”; “While users are permitted to use pseudonyms in their usernames, impersonation is prohibited.”
4. eCFR. 45 CFR 160.103, Definitions (HIPAA Administrative Simplification; up to date as of October 23, 2026). Checked October 26, 2026.
   Show the passageHide the passage

   “Covered entity means: (1) A health plan. (2) A health care clearinghouse. (3) A health care provider who transmits any health information in electronic form in connection with a transaction covered by this subchapter.”; “Disclosure means the release, transfer, provision of access to, or divulging in any manner of information outside the entity holding the information.”; individually identifiable health information “Relates to the past, present, or future physical or mental health or condition of an individual; the provision of health care to an individual; or the past, present, or future payment for the provision of health care to an individual” and identifies the individual or gives “a reasonable basis to believe the information can be used to identify the individual”; transactions include “(1) Health care claims or equivalent encounter information.”
5. Google. Report negative review extortion scams on your Business Profile (Google Business Profile Help). Checked October 26, 2026.
   Show the passageHide the passage

   “These scams may involve a sudden increase in 1-star and 2-star reviews on your Google Business Profile, followed by someone demanding money, goods, or services in exchange for removing the negative reviews.”; “Do not engage with or pay the malicious individuals. This can encourage further attempts”; “Do not try to resolve it yourself by offering money or services.”; “Gather all evidence immediately.”; “Report all relevant communication you receive in the form.”; “Go to the merchant extortion report form.”; the form asks for “Details on the suspicious negative reviews.” and “Details on the malicious third party’s contact and extortion methods.”; “Make sure the screenshots show the date, time, and the sender's contact information, to the extent possible”; “Share direct links to all reviews you believe are part of the extortion attempt.”; “The date and time you first noticed the sudden increase in negative reviews.”; “Due to privacy and security reasons, we can’t share specific details about the investigation”; “This reporting channel and the need for evidence of extortion are exclusively for cases where you‘ve been directly subjected to an extortion attempt demanding money or favors in exchange for review removal.”; “For reviews that you believe violate our policies for other reasons like being spam or off-topic, learn how to report or fix content.”
6. U.S. Department of Health and Human Services, Office for Civil Rights. HHS Office for Civil Rights Reaches Agreement with Health Care Provider in New Jersey That Disclosed Patient Information in Response to Negative Online Reviews (resolution agreement summary; content last reviewed June 5, 2023). Checked October 26, 2026.
   Show the passageHide the passage

   Manasa Health Center is “a health care provider in New Jersey that provides adult and child psychiatric services”; the complaint alleged that it “impermissibly disclosed the protected health information of a patient when the entity posted a response to the patient’s negative online review”; potential violations include “impermissible disclosures of patient protected health information in response to negative online reviews, and failure to implement policies and procedures with respect to protected health information”; “Manasa Health Center paid $30,000 to OCR and agreed to implement a corrective action plan to resolve these potential violations.”
7. U.S. Department of Health and Human Services, Office for Civil Rights. Manasa Health Center LLC Resolution Agreement and Corrective Action Plan (signed March 27 and 28, 2023; content last reviewed June 5, 2023). Checked October 26, 2026.
   Show the passageHide the passage

   “Manasa impermissibly disclosed the PHI of four (4) patients in response to their negative reviews posted on Google Reviews. See 45 C.F.R. § 164.502(a).”; “This Agreement is not an admission of liability by Manasa.”; the corrective action plan requires “Policies and Procedures that specifically address permissible and impermissible uses and disclosures of PHI”; “All members of Manasa’s workforce, including owners and managers, shall receive training”; and breach notices “to all individuals, or the individuals’ personal representatives, whose PHI was disclosed by the Covered Entity on Google Reviews or any other internet platform without a valid authorization.”
8. Google. Posting Restrictions (Maps User Generated Content Policy Help). Checked October 26, 2026.
   Show the passageHide the passage

   “When we find that user contributions for certain types of places are consistently unhelpful, harmful, or off-topic, we may limit or suspend user-generated content (UGC) for those places.”; “Posting may be turned off for a particular place for a short period of time to help protect the place or area from a spike in irrelevant or offensive content”.
9. Google. Manage customer reviews (Google Business Profile Help). Checked October 26, 2026.
   Show the passageHide the passage

   “Before you can reply to reviews, you must verify your business.”; “Google reviews your replies: This makes sure that they follow Google’s content policies.”; “Your reply is publicly posted: If your reply is approved, it will be publicly posted under the customer’s review. It will appear like your business replied, and your personal name won't be shown.”; “The person who wrote the review is notified when you reply. Customers can still change their review after reading your reply. If they change their review, the date on their review will change to show when the latest update was made.”; to get a link to a review in Google Maps, “Select Reviews.”, then “Share review” and “Send a link”.
10. eCFR. 45 CFR 164.502, Uses and disclosures of protected health information: General rules (HIPAA Privacy Rule; up to date as of October 23, 2026). Checked October 26, 2026.
    Show the passageHide the passage

    “A covered entity or business associate may not use or disclose protected health information, except as permitted or required by this subpart or by subpart C of part 160 of this subchapter.”; the permitted uses and disclosures begin “(i) To the individual;” and “(ii) For treatment, payment, or health care operations, as permitted by and in compliance with § 164.506;”; “a covered entity or business associate must make reasonable efforts to limit protected health information to the minimum necessary to accomplish the intended purpose of the use, disclosure, or request.”; “a covered entity must, except as provided in paragraphs (g)(3) and (g)(5) of this section, treat a personal representative as the individual for purposes of this subchapter.”; “If under applicable law a parent, guardian, or other person acting in loco parentis has authority to act on behalf of an individual who is an unemancipated minor in making decisions related to health care, a covered entity must treat such person as a personal representative”.
11. eCFR. 45 CFR 164.501, Definitions (HIPAA Privacy Rule; up to date as of October 23, 2026). Checked October 26, 2026.
    Show the passageHide the passage

    Health care operations include “(1) Conducting quality assessment and improvement activities”, “(4) Conducting or arranging for medical review, legal services, and auditing functions, including fraud and abuse detection and compliance programs” and, among business management and general administrative activities, “(iii) Resolution of internal grievances”.
12. Google. Report or Fix Content (Maps User Generated Content Policy Help). Checked October 26, 2026.
    Show the passageHide the passage

    “You can report inappropriate content on a computer or mobile device.”; “We have a feature on the Google Maps app where you can track your reports for reviews or media.”; statuses include “Processing report: We have received your report.”, “Content removed: The reported content has been removed from Maps.” and “Content not removed: The content has not been removed because either your account has been restricted or we do not have enough information to support the removal.”; “If we do not remove the content you reported, you may be eligible to submit one appeal.”; under “Fix your content”, a contributor choosing a review in ‘Your Contributions’ can select “‘Edit Review’, ‘Delete Review’ or ‘Add a Photo’”.
13. Google. Appeal Business Profile content & profile restrictions (Google Business Profile Help). Checked October 26, 2026.
    Show the passageHide the passage

    In its table of appeal routes, “Appeal review removal decision” goes to the “Reviews management tool”; “If you report a customer review but the decision says that it doesn’t violate Google Policies, you can submit a one-time appeal.”; “If your business is located outside of the UK and EEA, you can use the appeals tool to submit an appeal for your suspended or disabled profile.”; “If your Business Profile is suspended or disabled, it must be reinstated before you can appeal any content decisions.”
14. Google. Report Content for Legal Reasons (Google Legal Help). Checked October 26, 2026.
    Show the passageHide the passage

    “If you see content on a Google product that you believe violates the law or your rights, let us know.”; “Before creating a request, try to flag the content in the relevant product.”; “please include the specific URL(s) of the content you want to report”; “Be as specific as you can about what content on the page is violative, and why you are reporting it.”; “After you file a request, you will receive an email confirmation and a reference number.”
15. Google. Tips to get more reviews (Google Business Profile Help, with its section “Tips to write better review replies”). Checked October 26, 2026.
    Show the passageHide the passage

    “Offering incentives, like free or discounted goods or services, in exchange for customers to post reviews, change reviews, or remove negative reviews is considered fake & misleading content and is strictly prohibited.”; “Your replies are public”; “Negative reviews aren't necessarily a sign of poor business practices.”; “Protect privacy and avoid personal attacks: Never share a reviewer's private information or engage in personal attacks. If a situation is complex, politely request that the reviewer contact you via phone or email to resolve the issue privately.”; “Personalize your reply: Address the reviewer by name and acknowledge their specific feedback.”
16. American Physical Therapy Association. Code of Ethics for the Physical Therapy Profession (PDF, the current code; it replaced the 2020 Code of Ethics for the Physical Therapist). Checked October 26, 2026.
    Show the passageHide the passage

    “1.2 Physical therapists and physical therapist assistants shall protect patients’ and clients’ confidential information and not disclose that confidential information except as authorized by the patient or client or as permitted or required by law.”
17. American Speech-Language-Hearing Association. Code of Ethics (effective March 1, 2023; Principle of Ethics I, Rule P). Checked October 26, 2026.
    Show the passageHide the passage

    The code “is applicable to the following individuals”: “a member of ASHA holding the Certificate of Clinical Competence”, “a member of ASHA not holding the Certificate of Clinical Competence”, “a nonmember of ASHA holding the Certificate of Clinical Competence” and “an applicant for ASHA certification or for ASHA membership and certification”; Rule P: “Individuals shall protect the confidentiality of information about persons served professionally or participants involved in research and scholarly activities. Disclosure of confidential information shall be allowed only when doing so is legally authorized or required by law.”
18. American Occupational Therapy Association. Ethics (Practice Essentials; the page links the AOTA 2025 Occupational Therapy Code of Ethics, doi:10.5014/ajot.2025.79S302, and AOTA’s Code of Ethics Core Values and Principles infographic (© 2025)). Checked October 26, 2026.
    Show the passageHide the passage

    “Occupational therapy personnel, including occupational therapists, occupational therapy assistants, and students, have an obligation to demonstrate ethical conduct that reflects professional values when working with clients, families, caregivers, administrators, colleagues, policymakers, payers, and other health care professionals.”; from the infographic: “Sanctionable offenses and violations of ethical standards are addressed separately under the Code’s Standards of Conduct, which outline specific and enforceable behaviors.”
19. Google. Tips for working with third parties to manage your Business Profile (Google Business Profile Help). Checked October 26, 2026.
    Show the passageHide the passage

    Third parties “might offer services to keep your profile up-to-date, provide you with customer insights, answer your questions, and respond to reviews.”; “If a third-party representative claims they work for Google, ask for their name and request they email you from their ‘@google.com’ email address.”
20. eCFR. 16 CFR 465.7, Review suppression (FTC Rule on the Use of Consumer Reviews and Testimonials; up to date as of October 23, 2026). Checked October 26, 2026.
    Show the passageHide the passage

    “It is an unfair or deceptive act or practice and a violation of this part: (a) For anyone to use an unfounded or groundless legal threat, a physical threat, intimidation, or a public false accusation in response to a consumer review that is made with the knowledge that the accusation was false or made with reckless disregard as to its truth or falsity, in an attempt to: (1) Prevent a review or any portion thereof from being written or created, or (2) Cause a review or any portion thereof to be removed”.
21. Google. Business Profile restrictions for policy violations (Google Business Profile Help). Checked October 26, 2026.
    Show the passageHide the passage

    “If we determine that a business owner has violated our Fake Engagement policy, we might place restrictions on their Business Profile (in addition to removing the violative reviews).”; examples: “Business Profile will not be able to receive new reviews or ratings for set period of time”, “Business Profile’s existing reviews or ratings will be unpublished for set period of time” and “Business Profile will display a warning to let consumers know that fake reviews were removed”.
22. DrSensory. DrSensory for therapists (the For Therapists hub). Checked October 26, 2026.
    Show the passageHide the passage

    “DrSensory is a directory families use free to find occupational therapy, physical therapy and speech therapy clinics”; “A paid listing adds your own description, logo, up to five photos, hours, reviews with your replies, and inquiries that come to you instead of to the DrSensory team.”; “A paid listing is the same page made yours: you correct and extend it, families can review you, and their messages reach you.”
23. DrSensory. Therapy Clinic Directory Pricing (the pricing page and its comparison of unclaimed and claimed listings). Under “Collect and display reviews”: “Gather and show reviews from the families you work with, and reply publicly.”; the comparison marks “Reply to reviews” as part of a claimed listing only. Checked October 26, 2026.
24. DrSensory. How to claim and optimize your DrSensory profile (For Therapists guide, section “How do reviews work on DrSensory?” and its questions). Checked October 26, 2026.
    Show the passageHide the passage

    “Families write them on your profile, DrSensory checks each one before it appears, and you can reply. Reviews appear only on paid listings.”; “A negative review is not removed for being negative.”; “You can report a review once, from the Reviews page.” and “you get the decision and the reason in your Messages”; “You can report a review that breaks the guidelines, for example one that names a child or was not written about a visit to you.”

Medical disclaimer. This page is for general educational purposes and does not constitute medical advice, diagnosis, or treatment. It is general guidance on running a therapy practice, not legal, compliance, billing or financial advice. Whether a review is defamatory, and what HIPAA or state law requires of a particular practice, are questions for the practice’s attorney, and its examples are hypothetical.