How therapy practices can request and respond to patient reviews

Use a consistent, voluntary review-request process and keep public responses general. Do not reveal care details, confirm a patient relationship, offer rewards for positive feedback, or selectively invite only people expected to praise the practice. Check the platform’s rules and your practice’s privacy procedures before using a request or response template.

Pediatric and adult practices need different recipient checks. A caregiver’s involvement with a child’s care and a helper’s involvement with an adult are not interchangeable. A public review also does not give the practice unrestricted permission to discuss the person’s care or reuse the review as a testimonial.

How should a practice separate reviews, complaints, and care questions?

A public review is one person’s public feedback. A complaint may need an internal investigation and a private response. A clinical question belongs in the appropriate care communication route. Do not try to handle all three in a public reply.

Assign an owner for monitoring and an approval process for responses. Staff should know when to pause a draft and route it to the privacy or operations owner. A quick reply is not useful if it discloses information or makes an unsupported claim.

Use a log containing review URL, date, platform, administrative status, owner, and next action. Keep unnecessary patient details out of a marketing dashboard.

Step 1: What do Google’s rules say about asking for reviews?

Google’s contribution policy prohibits fake engagement, including incentivized reviews and selective solicitation of positive reviews.¹ Do not offer discounts, gifts, or priority scheduling in exchange for feedback, and do not ask a person to remove negative feedback for a benefit.

Use the same appropriate eligibility process rather than sending unhappy people only to a private form while directing happy people to a public review page. A private feedback channel can be valuable, but it should not be used to manipulate the public review population.

For another directory, check that platform’s own rules. Do not assume Google’s process or a practice’s internal preference controls every review site.

Step 2: Who should receive a review request, and through which channel?

Decide who receives a request, what information the message reveals, which system sends it, and whether the process is appropriate under the practice’s obligations. A third-party review tool can create a different data flow from a simple administrative message.

For pediatric care, identify the appropriate recipient under the actual arrangement. Do not send a child’s details to every parent address in an old contact list. For adult care, use the adult’s preferences and applicable authority; do not automatically send requests to relatives or helpers.

Keep the message neutral and optional. Do not imply that care, scheduling, or staff relationships depend on submitting a review. If the practice chooses not to solicit publicly, it can still maintain an appropriate private feedback process.

Step 3: How do you ask for a review without pressuring anyone?

What should a general review request message include?

Use this only after the practice has reviewed the recipient and channel. Do not include a diagnosis, visit summary, or treatment achievement in the request. Do not supply a five-star review for the recipient to copy.

How do you adapt a review request for a child’s caregiver?

Use the appropriate caregiver recipient and omit unnecessary child information. The message does not need to name the child, describe therapy, or mention a condition to explain the feedback route.

How do you adapt a review request for an adult patient?

Address the adult directly unless the documented preferences or applicable arrangement call for another recipient. Use the available communication supports rather than assuming a helper should receive the message.

Step 4: How do you reply to a review without disclosing patient details?

An online reviewer may disclose personal facts, but the practice should not expand, verify, or rebut those facts using its records. HHS’s Manasa enforcement summary concerns disclosure of patient information in a response to a negative review.² A public post by the person is not a blanket release for the provider.

Avoid confirming appointments, diagnoses, payments, missed visits, treatment recommendations, or a child’s progress. Do not write that a person was never a patient merely because staff cannot find a matching name. A public display name may differ from the practice record, and the public reply is not the place to investigate.

What should a public reply to a positive review say?

This acknowledges the public comment without saying the person received care or identifying a result. Do not add a personalized clinical detail to make the response sound warmer.

What should a public reply to a review raising a concern say?

Use a route the practice actually monitors. Do not promise a particular resolution before review.

How do you reply to a review about trouble reaching the practice?

Choose wording that fits the actual concern without confirming the person’s relationship with the practice.

For replies on a DrSensory profile, How to reply to a review without breaching HIPAA shows replies that keep to these rules and one that does not.

Step 5: When can you report a review for breaking platform policy?

If a review appears to violate a platform policy, record the specific policy and use its reporting process. Do not report solely because the rating is low or the practice disagrees with the account.

Google’s review-reporting guidance distinguishes policy violations from negative feedback.³ A report is subject to review; do not promise that it will be removed.

Keep the public response separate from the private report. Do not publish records as evidence or threaten a reviewer with disclosure. If a request involves extortion or another serious concern, use the applicable official and practice procedures rather than an improvised public argument.

Step 6: How do you investigate a concern raised in a review?

Route an actionable concern to the appropriate owner. Check the facts in the proper system, identify the allowed contact process, and record the operational result. Do not use the marketing team as a substitute for clinical, billing, or privacy review.

An adult’s difficulty reaching the clinic may reveal an inaccessible phone-only route. A caregiver’s scheduling concern may reveal unclear appointment windows. Those are questions to investigate, not facts to assume from a review alone.

When a process correction is needed, update the relevant website, profile, or staff script. Do not describe an individual case publicly to demonstrate that the practice has improved.

Step 7: Can you reuse a patient review as a website testimonial?

Copying a review onto a website, advertisement, brochure, or social post changes the use and context. Review accuracy, applicable permissions, platform terms, and patient-information implications before doing so.

Do not imply that a testimonial is representative of every patient or guarantees an outcome. Do not edit a review to remove qualifying language while preserving a stronger claim. For pediatric feedback, consider the child’s information as well as the adult author’s words.

The HHS marketing guidance is relevant to covered practices’ use of patient information for marketing.⁴ A publicly visible review is not a substitute for evaluating the specific promotional use.

What should staff check before sending a review request or reply?

Before sending a request or publishing a response, confirm the recipient and route, voluntary wording, absence of incentives or selective positive solicitation, absence of care details, accurate contact information, and the required approval.

For a public reply, read it as an outsider. Does it reveal that the reviewer or a child received services? Does it imply a diagnosis or outcome? Does it contradict the privacy process? Remove unsupported or disclosing detail rather than relying on a generic disclaimer.

Maintain the templates and review their use periodically. Staff should know that a suggested response can be declined or escalated when the circumstances do not fit.

Who should own review requests and replies at your practice?

Assign the review owner and approve neutral templates. Check the website content guide before reusing reviews or making public trust claims.

Sources

1. Google. Prohibited and restricted content (Maps User Generated Content Policy), Fake engagement. Merchants may not “Offer incentives – such as payment, discounts, free goods and/or services - in exchange for posting any review”, nor “Discourage or prohibit negative reviews, or selectively solicit positive reviews from customers”; they may “Solicit or encourage the posting of content that does represent a genuine experience, without offering incentives to do so or attempting to influence the rating or the contents of the review.” Checked October 6, 2026.
2. U.S. Department of Health and Human Services, Office for Civil Rights. HHS Office for Civil Rights Reaches Agreement with Health Care Provider in New Jersey That Disclosed Patient Information in Response to Negative Online Reviews (content last reviewed June 5, 2023). The complaint alleged that Manasa Health Center “impermissibly disclosed the protected health information of a patient when the entity posted a response to the patient’s negative online review”; the practice “paid $30,000 to OCR and agreed to implement a corrective action plan.” Checked October 7, 2026.
3. Google. Report inappropriate reviews on your Business Profile (Google Business Profile Help). “You can report any review, but only those that violate Google policies are eligible for removal”; “Do not report a review just because you disagree with it or dislike it”; “Review evaluation typically takes several days.” Checked October 7, 2026.
4. U.S. Department of Health and Human Services, Office for Civil Rights. Marketing (HIPAA Privacy Rule guidance, 45 CFR 164.501 and 164.508(a)(3); content last reviewed July 26, 2013). “With limited exceptions, the Rule requires an individual’s written authorization before a use or disclosure of his or her protected health information can be made for marketing”; marketing is “a communication about a product or service that encourages recipients of the communication to purchase or use the product or service”; and “the Rule distinguishes marketing communications from those communications about goods and services that are essential for quality health care.” Checked October 7, 2026.

Medical disclaimer. This page is for general educational purposes and does not constitute medical advice, diagnosis, or treatment. It is general guidance on running a therapy practice. The HIPAA and other legal points are general information, not legal advice; your own compliance adviser is the person to ask about your practice.