A patient who got your name from a referral still pulls up your reviews before they call to book. That's what makes healthcare reputation management different from reputation work in most other industries.
The stranger reading your star rating has no relationship with you yet. They're deciding whether to start one based on what other patients wrote.
Ninety percent of patients rely on online reviews when evaluating a physician, according to a 2020 survey of 498 patients by Software Advice. Reviews aren't a nice-to-have next to your credentials and your office hours. For a lot of patients, they're the whole first impression.
Where healthcare reputation management actually gets decided
Most of that decision happens on Google, not on your own website. In the same survey, 37% of patients named Google as their primary source for reviews, ahead of every other platform.
The cost of ignoring that shows up in patient volume, not just star ratings. That same data found that 43% of patients would switch to an out-of-network provider if the reviews were better, even paying more out of pocket.
It means a patient walking past your door for a stranger's opinion of someone else.
Building the kind of online presence patients trust before they ever search for reviews matters here too. A website and a profile that look current do some of that work before a single star rating enters the picture.
Getting more reviews without tripping the FTC's rules
The instinct is to ask happy patients for a review and leave it at that. That's still allowed. What changed is anything that ties a reward to what the review says.
In August 2024, the FTC finalized a rule banning reviews conditioned on sentiment: no gift cards for five-star feedback, no contest entries that only activate once someone posts something positive, no staff member reviewing their own workplace without saying who they are.
The rule applies across every industry, healthcare included, and it gives the FTC civil penalty authority against businesses that knowingly break it.
What's still fine: asking every patient at checkout, a follow-up text with a review link a few hours later, a QR code on the exit paperwork. The line sits at incentive tied to outcome, not at asking in the first place.
Responding to reviews without violating HIPAA
Five-star reviews are easy to answer. A one-star review naming a specific visit is where practices get into trouble, because HIPAA doesn't stop applying just because the patient brought it up first.
According to Paubox, even acknowledging that someone is a patient can violate HIPAA if that relationship wasn't already public. Writing "thank you for being a patient at our practice" under a review confirms a relationship the reviewer disclosed.
The disclosure was theirs to make. Repeating it back is not the same thing, and it's not yours to make.
| Situation | Safe response | What to avoid |
|---|---|---|
| Reviewer names a specific visit or treatment | Generic thanks, invite them to call the office | Confirming they were a patient or referencing the visit |
| Reviewer complains about wait times | Acknowledge the general commitment to service, offer to talk by phone | Explaining scheduling details tied to their case |
| Reviewer disputes a diagnosis or a bill | Invite them to discuss it privately | Defending or explaining the medical decision in public |
The penalty structure gives this teeth. Paubox notes that OCR fines for HIPAA violations range from roughly $137 to over $2 million per violation, which turns a poorly worded reply from a tone problem into a real liability question.
Patients ask us some version of this in nearly every onboarding call, which is part of why the questions healthcare clients ask us most puts HIPAA near the top of the list.
What to do about a negative review specifically
Arguing with a one-star review in public rarely changes the reviewer's mind. It usually reads worse to the hundred people who see the exchange later than the original complaint ever did.
The safer move is a short, calm reply that confirms nothing about the visit, followed by a genuine attempt to move the conversation to a phone call.
If the review turns out to be fake, or posted by someone who was never a patient, that 2024 rule against fake reviews gives grounds to report it as exactly that. That's a cleaner path than arguing the substance of a complaint in the replies.
Where reviews actually matter most
Photo by Kindel Media on Pexels
Google carries more weight here than any other single channel. Software Advice's patients named it their primary review source by a wide margin, which lines up with how most healthcare searches start: a specialty and a city typed into Google, not a dedicated review app opened on purpose.
A profile with an outdated phone number or three-year-old photos loses a reader before they even reach the reviews sitting on the same page. Our guide to how patients find a provider through local search covers what that profile actually needs to carry its weight.
Turning this into a routine, not a fire drill
Reputation work fails when it only happens after a bad review shows up. Practices that stay ahead of it build the review request into the same moment as checkout or the post-visit text, instead of remembering to do it once a quarter.
That's the kind of task that's easy to automate without it feeling automated: a text goes out a few hours after the appointment, a dashboard flags anything under four stars for a same-day reply, and nobody has to check five different review sites by hand.
We've written about which front-desk tasks are worth automating first, and review requests are usually near the top of that list.
If reputation management is one piece of a bigger marketing push, treat it that way instead of a standalone chore. That's the kind of work our digital marketing and growth team builds into a practice's broader plan, alongside the local search and content work already in motion.
Frequently asked questions
Can I offer patients an incentive to leave a review?
You can still ask every patient to leave one. What changed is incentives tied to what the review says. A 2024 federal rule bans paying for a review, or offering any reward, conditioned on it expressing a particular sentiment. Asking with no reward attached is still fine.
Is it a HIPAA violation to reply publicly to any review?
No, replying by itself isn't the problem. The violation happens when the reply confirms the reviewer was a patient or repeats details about their visit, even details they posted themselves.
Should I ask every patient for a review, or only the happy ones?
The same survey found that patients who do leave reviews already skew positive, with 72% writing "very" or "somewhat positive" feedback. Asking broadly, rather than filtering for people you expect to be kind, is the lower-risk approach and the one more likely to build a review count that looks real.
Which review site should I focus on first?
Google, by a wide margin. Patients in that same survey named it their primary review source more than any other platform, and it's usually the first thing that comes up when someone searches your practice by name.
Cover photo by Tima Miroshnichenko on Pexels
Sources
- How Patients Use Online Reviews — Software Advice
- Understanding HIPAA Compliance in Online Review Responses — Paubox
