Gian McCoy
How do you get more Google reviews for your dental office or medical practice?
You ask every patient, consistently, with a link that takes them straight to the review box. Most practices with few reviews are not doing anything wrong. They are simply not asking, or asking only when someone at the desk remembers.
Below: the rules, how to reply without creating a HIPAA problem, and a daily asking routine for your front desk.
What are the rules for asking patients for reviews?
Two sets of rules apply: Google’s policies for reviews on your Business Profile, and the Federal Trade Commission’s rule on consumer reviews. Both point the same way. Ask everyone, pay no one, and write nothing yourself.
Google: no review gating and no incentives
Google says businesses should not "discourage or prohibit negative reviews, or selectively solicit positive reviews."[1] That second part is called review gating: sending a short survey first and passing only the happy patients along to Google. Some review tools were built this way.
Google also says businesses should not "offer incentives, such as payment, discounts, free goods and/or services, in exchange for posting any review."[1] Note the word "any." A discount on a whitening kit for leaving a review breaks the rule even if you never ask for five stars.
The FTC rule on fake reviews
The FTC’s Trade Regulation Rule on Consumer Reviews and Testimonials took effect on October 21, 2024.[2] Among other things, it bans:
- Fake reviews, including reviews generated by AI.[2]
- Incentives conditioned on writing a review that expresses a particular sentiment.[2]
- Reviews by insiders, such as employees, without disclosing the connection.[2]
- Suppressing reviews through unfounded legal threats or intimidation.[2]
On asking only happy customers, the FTC’s own Q&A says: "The rule does not contain a specific prohibition against such conduct. But this practice could violate the FTC Act."[3] Combined with Google’s policy, the safe answer is simple: ask everyone.
| Practice | Allowed? | Why |
|---|---|---|
| Asking every patient for a review | Yes | Nothing in Google’s policy or the FTC rule prohibits it |
| Asking only patients who rated you well in a survey | No | Google prohibits selectively soliciting positive reviews[1] |
| A discount or gift card for leaving a review | No | Google prohibits incentives for any review[1] |
| Staff or family posting reviews without disclosing the connection | No | Undisclosed insider reviews are banned by the FTC rule[2] |
| Writing reviews with AI for patients to post | No | The FTC rule bans fake reviews, including AI-generated ones[2] |
| Threatening a patient over a negative review | No | The FTC rule bans suppression through unfounded threats or intimidation[2] |
How do you respond to patient reviews without violating HIPAA?
Reply as if you have never heard of the person. Never confirm that the reviewer is your patient, and never mention a visit, a treatment, a bill, or anything from the chart, even when the reviewer has shared those details publicly. The patient choosing to post about their care does not give you permission to discuss it.
This is where practices actually get fined. The HHS Office for Civil Rights has brought several enforcement actions over replies to online reviews:
| Practice | Where | Year | Outcome |
|---|---|---|---|
| Elite Dental Associates | Dallas, Texas | 2019 | $10,000 settlement and corrective action plan[4] |
| Dr. U. Phillip Igbinadolor, D.M.D. & Associates | North Carolina | 2022 | $50,000 civil money penalty[5] |
| New Vision Dental | California | 2022 | $23,000 settlement and corrective action plan[6] |
| Manasa Health Center (psychiatric practice) | New Jersey | 2023 | $30,000 settlement[7] |
In each case, the practice disclosed patient information while responding to reviews. At Manasa, the replies disclosed patients’ mental health diagnosis and treatment.[7] California practices also answer to the Confidentiality of Medical Information Act, which bars providers from disclosing medical information without authorization except in listed situations.[8]
Safe reply templates
These replies disclose nothing. They do not say "your visit," "your treatment," or "we reviewed your account," because each of those confirms a patient relationship.
| Review type | Reply |
|---|---|
| Positive | "Thank you for taking the time to share this. We appreciate the kind words and will pass them along to the team." |
| Negative | "We take every concern seriously. Privacy rules prevent us from discussing anyone’s care online. Please call our office manager at [office phone] so we can talk directly." |
| Negative, factually wrong | "We are sorry to read this. We cannot discuss specifics here because we protect everyone’s privacy. Our office manager would welcome a call at [office phone]." |
| Not a patient, or unclear | "Thank you for your feedback. Please call our office manager at [office phone] if you would like to talk." |
Make one person responsible for replies, and have a second person read any reply to a negative review before it goes live. This guide explains how the rules apply to review replies. It is not legal advice, and your privacy officer or attorney should approve your templates.
When and how should your front desk ask?
Ask at the end of the visit, then follow up the same day with a direct link. The best moment is checkout, when the visit is fresh and the patient is standing in front of someone who helped them. The follow-up text catches the people who meant to do it and forgot.
Get your direct review link
Copy the review link from your Google Business Profile (look for the option to ask for reviews). It opens the review box directly, so patients do not have to search for you.
Ask every patient at checkout
Use one short script for everyone. No screening question first, no judgment about who seems happy.
Send a same-day follow-up
Send the link by text or email a few hours after the visit, using wording that contains nothing about the care they received.
Send one reminder at most
If there is no review after a few days, one gentle reminder is enough. Then stop.
Reply to every review
Use the templates above within a few days. Replies show future patients the office is paying attention.
A checkout script for staff
Front desk script
"Thanks for coming in today. We’re a small office, and Google reviews help other families find us. I’ll text you a link this afternoon. If you have a minute, we’d really appreciate it."
Follow-up message wording
Follow-up text or email
"Hi [first name], thank you for visiting [practice name] today. If you have a minute, we’d appreciate a Google review: [link]. Thank you!"
The message names only what the patient already knows: that they visited your office today. It does not mention the procedure, the provider’s specialty if that reveals a condition, or anything from the visit. Whatever system sends these messages handles patient names and phone numbers, so that vendor should sign a business associate agreement.[9] Our guide on what to verify before an AI system handles patient information walks through the same vendor checks.
What should you avoid?
- Survey-first flows that send only happy patients to Google. That is review gating.[1]
- Any gift, discount, drawing, or raffle tied to leaving a review.[1]
- Reviews from staff or family without disclosing the connection.[2] Simpler still: keep insiders out of your reviews entirely.
- Drafting reviews for patients, with AI or otherwise.[2]
- Handing patients an office tablet to post from. Ask them to review later, from their own phone and their own Google account, so there is never a question about who wrote it.
- Replying with any detail about a visit, a treatment, or a bill.[6]
- Threatening legal action over a negative review.[2]
What does a steady review habit look like?
Picture a three-provider family medicine office in Fullerton. It has a few dozen reviews, most of them years old, and the newest one is a complaint the office never answered. The front desk asks for reviews "sometimes." Nobody owns replies.
The office manager adopts the checkout script, sets up a same-day follow-up text through a vendor that has signed a BAA, and assigns replies to herself with the physician-owner as the second reader on anything negative. She answers the old complaint with the "negative" template. Nothing about it is clever. The difference is that it happens every day, for every patient.
Reviews also feed how prominent your practice looks to Google, which Google names as one of the factors in local results.[10] If your practice is hard to find even by patients who are looking for it, start with why your practice isn’t showing up on Google.
Reviews are one piece of the medical and dental practice marketing I run for practices in Orange County, Los Angeles, the Inland Empire, and San Diego.
Frequently asked questions
What is review gating?
Review gating is screening patients before asking for a review, for example with a one-question survey, and sending only the satisfied ones to Google. Google prohibits selectively soliciting positive reviews.[1] The FTC says the practice could violate the FTC Act.[3]
Can we offer a small thank-you gift for leaving a review?
No. Google prohibits incentives in exchange for posting any review, positive or negative.[1] The FTC rule separately bans incentives conditioned on a particular sentiment.[2]
Can I respond to a review if the patient already shared their own details?
You can respond, but do not confirm they are a patient or add any detail about their care. OCR has fined practices for disclosing patient information in review replies.[5] Use a general reply and invite them to call the office.
Can we ask Google to remove a negative review?
You can flag a review that you believe breaks Google’s content policies.[1] A review you simply disagree with usually stays. A calm, private-details-free reply often does more for future patients than the removal would.
Is it OK to text patients a review link?
A short message that names only the visit and the link keeps the content to what the patient already knows. The service sending it handles patient names and numbers, so get a business associate agreement from that vendor.[9] Have your privacy officer approve the wording.
Related services
Keep reading
Why your practice isn’t showing up on Google →
Practice not showing up on Google or Google Maps? Check these 8 causes in order, from verification and categories to duplicates, distance, and reviews.
Is an AI receptionist HIPAA compliant? →
An AI receptionist can be set up to handle PHI under HIPAA, but no product is compliant on its own. The checklist practice owners should verify.
Gian McCoy · Hanshiro Inc.
Gian works with independent medical, dental, and specialty practices across Orange County, Los Angeles, the Inland Empire, and San Diego. He is a former PTCB Certified Pharmacy Technician who handled patient data under HIPAA, spent 20+ years in enterprise IT and marketing technology (IBM Global Services; contract work at Kaiser Permanente and City of Hope), and holds an MBA in Brand Management from Thunderbird. More about Gian
Sources
- 1.Google Business Profile Help. Prohibited and restricted content (Google Maps user contributed content).
- 2.Federal Trade Commission. Federal Trade Commission Announces Final Rule Banning Fake Reviews and Testimonials (2024-08-14).
- 3.Federal Trade Commission. Consumer Reviews and Testimonials Rule: Questions and Answers.
- 4.HHS Office for Civil Rights. Dental Practice Pays $10,000 to Settle Social Media Disclosures of Patients’ Protected Health Information (2019-10-02).
- 5.HHS Office for Civil Rights. Dr. U. Phillip Igbinadolor, D.M.D. & Associates, P.A. civil money penalty (2022-03-28).
- 6.HHS Office for Civil Rights. New Vision Dental resolution agreement (2022-12-14).
- 7.HHS. HHS Office for Civil Rights Reaches Agreement with Health Care Provider in New Jersey That Disclosed PHI in Response to Negative Online Reviews (2023-06-05).
- 8.Justia (California Code). California Civil Code § 56.10 (Confidentiality of Medical Information Act).
- 9.U.S. Department of Health and Human Services (HHS). Business Associates.
- 10.Google Business Profile Help. Tips to improve your local ranking on Google.