Yes, a dentist can respond to a negative review without violating HIPAA, as long as the response doesn't confirm the person was a patient, reveal any treatment details, or share other protected health information, even indirectly. The safest responses stick to general, non-specific language and avoid discussing the actual clinical situation described in the review, no matter how tempting it is to set the record straight with specifics.
HIPAA, the Health Insurance Portability and Accountability Act, is a federal law that protects patient health information, generally referred to as protected health information or PHI. In the context of online reviews, a HIPAA violation happens when a dental practice discloses PHI publicly, which can include confirming someone was a patient, describing a diagnosis or treatment, or referencing appointment dates, even if the goal was simply to defend the practice against an unfair review.
This article is meant to give general, practical guidance and isn't a substitute for legal advice. Dental practices dealing with a specific HIPAA concern should consult a healthcare compliance attorney or their practice's designated privacy officer.
What Does HIPAA Actually Protect in a Review Response?
HIPAA protects any information that could identify a person as a patient and connect them to health information, including their name, the fact that they received care, specific treatment details, appointment history, and billing information tied to their care. This protection applies regardless of how the information becomes public, which means it covers a public review response just as much as it covers a medical record.
A common misunderstanding is that HIPAA only applies to sharing "medical" details like a diagnosis. In reality, simply confirming that someone is or was a patient of the practice, without mentioning any clinical details at all, can already count as a disclosure of PHI, since patient status itself is protected information under HIPAA.
Do Dentists Have to Abide by HIPAA Laws?
Yes, most dentists qualify as HIPAA-covered entities, since they create, store, and transmit protected health information as part of routine patient care, including records, insurance claims, and treatment documentation. This means the same HIPAA Privacy, Security, and Breach Notification Rules that apply to physicians and hospitals also apply to dental practices.
There are some narrow exceptions. A dentist who communicates exclusively through non-electronic means, without submitting any electronic claims or using a third party to handle claims and eligibility checks, may not meet the technical definition of a covered entity. In practice, this exception is rare, since most dental offices file insurance electronically or work with a billing service that does, which brings them under HIPAA regardless of how the front office itself communicates with patients.
It's also worth noting that some states have their own privacy laws that go further than HIPAA in certain areas, which means a dental practice operating in one of these states may need to follow additional rules on top of the federal HIPAA requirements. This doesn't change the core guidance around review responses, since avoiding any disclosure of patient status or treatment details in public stays the safest approach regardless of which state a practice operates in.
What Can I Say Without Violating HIPAA?
A dental practice can respond to a negative review using general, non-specific language that doesn't confirm or deny anything about a person's status as a patient or reference their care in any way. A safe response typically thanks the reviewer for their feedback, expresses general concern, and invites them to contact the office directly to discuss their experience, without acknowledging any specific details from the review itself.
What Words or Details Should a Dental Practice Avoid in a Response?
Avoid confirming the person was a patient, referencing specific dates, procedures, or costs, and avoid correcting or disputing clinical claims made in the review, even if those claims are inaccurate. Phrases like "our records show" or "during your visit on" should never appear in a public response, since both confirm patient status and reference specific PHI, regardless of how minor the detail seems.
How Do You Respond to a Clinical Complaint Without Confirming Treatment?
When a review describes a specific procedure or complaint, the safest approach is to respond to the general sentiment without engaging with the clinical specifics at all. A response like "we take all patient feedback seriously and would welcome the chance to discuss any concerns directly, please reach out to our office" addresses the complaint's tone without confirming or denying any part of the clinical story the reviewer described.
What Are Some Examples of HIPAA Violations in the Dental Field?
Beyond review responses specifically, common HIPAA violations in dental practices include discussing a patient's treatment within earshot of other patients in the waiting area, leaving charts or screens visible to unauthorized staff or visitors, sending appointment reminders or billing information to the wrong patient, and staff accessing patient records without a legitimate reason tied to their role.
In the specific context of reviews and online reputation, the most common violation is a well-meaning but risky response defending the practice by referencing specifics, for example a front desk employee replying to a review with something like "we explained the risks of this procedure to you at your appointment on [date]" in an attempt to correct the record. Even though the intent is to clarify a misunderstanding, this kind of response discloses PHI publicly and can trigger a real compliance issue, regardless of whether the original review was fair or accurate.
What Are the New HIPAA Rules for Dental Offices in 2026?
A confirmed change took effect on February 16, 2026: dental practices covered by HIPAA were required to update their Notice of Privacy Practices to address how they handle protected health information received from substance use disorder treatment programs, aligning HIPAA with federal confidentiality rules for that category of records. Practices still using an outdated Notice of Privacy Practices from before this update are considered out of compliance on that specific requirement.
Separately, HHS has proposed a broader overhaul of the HIPAA Security Rule, which would convert many currently optional security practices into mandatory requirements, including things like multifactor authentication, encryption of stored data, and regular risk assessments. As of mid-2026, this proposed update has not been finalized, though it remains on the federal regulatory agenda, and practices would likely be given a compliance window of several months to a year once it is finalized. Since this rule focuses on data security infrastructure rather than review responses specifically, it doesn't change the core rules around what a practice can say publicly about a patient, but dental practices should keep an eye on official updates from the Department of Health and Human Services rather than relying on any single source for the exact final requirements.
How Should a Dental Practice Train Staff to Respond to Reviews Safely?
The safest approach is having one designated person, often the practice manager or owner, handle all review responses, rather than leaving it to whichever staff member happens to see the review first. This reduces the risk of an untrained team member responding emotionally and accidentally including PHI while trying to defend the practice.
It also helps to have a few pre-approved response templates ready for common situations, like a general complaint, a pricing concern, or a clinical dispute, so staff aren't improvising language under pressure. Reviewing these templates periodically, and briefly training new staff on what never to include in a public response, keeps this consistent even as the team changes over time.
Setting a simple internal rule, such as requiring any review response involving a specific clinical complaint to be reviewed by the practice manager before it's posted, adds a useful checkpoint without slowing down responses to more routine, general reviews. This kind of light approval process catches the situations most likely to create risk, without requiring every single response to go through a lengthy review.
How Can You Track and Manage Dental Reviews Without Risking a HIPAA Violation?
Dental practices often deal with reviews across Google, Facebook, Healthgrades, and other healthcare-specific review sites, and monitoring all of them individually makes it easier for an untrained response to slip through unnoticed on a platform that isn't checked as often. Centralizing this process also makes it easier to apply the same reviewed, HIPAA-safe response templates consistently across every platform, rather than only on the ones checked most frequently.
A reputation management platform like Vercepta pulls reviews from multiple sites into a single dashboard, which makes it easier for a dental practice to make sure every review, regardless of platform, goes through the same careful review process before a response is posted. This also supports the broader approach to responding to negative reviews professionally, since a dental practice needs the same calm, consistent tone other businesses use, layered with the extra care HIPAA requires around what specifically gets said.
Frequently Asked Questions
Can a dental practice ask Google to remove a review that reveals private patient information? Yes, if a patient's own review includes details about their treatment, this is generally treated as the patient's own choice to share their information, not a HIPAA violation by the practice, since HIPAA restricts the practice's disclosures, not the patient's own choices about their own care.
Does HIPAA apply if a patient mentions the dentist's name in their own negative review? No, a patient can freely discuss their own care and name their provider in a review without violating HIPAA, since HIPAA only restricts the practice and its staff from disclosing patient information, not the patient's own choice to share their experience.
Can a dental office send information to a lawyer to defend against a review-related legal issue? Generally yes, but this typically requires care around how the information is shared and often involves legal counsel guiding the process, since disclosures made for legal defense purposes have different rules than a public review response.
Is it a HIPAA violation to like or react to a positive review on social media? Simply liking or reacting to a review generally doesn't violate HIPAA, but writing a public reply that confirms the person as a patient or references any treatment details would still carry the same risk as it would on Google or any other platform.