Dental reputation management means asking every patient for reviews the same way, replying in general terms without confirming anyone is a patient, and never paying for or filtering reviews. HIPAA limits what a reply may say, the FTC review rule limits how reviews are collected, and Google sets its own platform rules.
Reviews are public, searchable and permanent unless removed, and replies to them have cost dental offices real settlements. This guide belongs to our dental practice management guide. It covers how to ask, how to reply, how to handle a bad review and who in the office does each step.
Key takeaways
- Ask every patient the same way, with no reward and no clinical detail in the message.
- Never confirm that a reviewer is a patient; OCR has settled dental cases over review replies.
- Skip selective asking, staff reviews and paid reviews: Google, Yelp and the FTC rule all restrict them.
- Name an owner, a time target and a second privacy reader for every reply.
- Measure request coverage, reply time and offline resolution, not the star average alone.
What rules govern dental reputation management?
Three rule sets apply at once. HIPAA controls what the office may say, the FTC’s Consumer Reviews and Testimonials Rule controls how reviews are gathered and handled, and each review platform adds its own terms. A practice can satisfy one and break another.
On HIPAA, the American Dental Association warns that answering a negative review on social media can create a privacy violation, that even revealing someone is a patient may breach privacy law, and that information a patient already posted publicly stays protected in the practice’s hands (ADA, marketing and advertising). The AMA gives the same advice to physicians: a patient’s own public disclosure does not permit the practice to share anything (AMA, 2016).
On collection, the FTC rule took effect on October 21, 2024, after publication in the Federal Register on August 22, 2024 (Federal Register). It reaches fake reviews, incentives conditioned on a positive or negative opinion, undisclosed insider reviews and review suppression (FTC announcement). The FTC’s own question-and-answer page says it is not definitive or comprehensive and offers no safe harbor (FTC Q&A). On December 22, 2025 the agency sent warning letters to ten companies and noted civil penalties of up to $53,088 per violation. It said the letters are not findings (FTC).
On platforms, Google and Yelp both ban rewards for reviews, and Google adds rules on conflicts of interest and selective solicitation (details below). State dental boards then add advertising rules. The short version sits in our dental marketing plan. This guide is the working procedure.
How should a dental office ask for reviews?
Send the same short request to every patient after a visit, with a direct review link, no reward and no clinical detail.
Google lets businesses remind customers to review by sharing a link or QR code (Google Business Profile Help). Its contribution policy then lists what a business may not do.
| Office habit | Verdict | Rule behind it |
|---|---|---|
| Same text or email to every patient after a visit, with a review link or QR code | Lowest risk | Google allows link and QR requests; the FTC Q&A treats a request sent to all purchasers as a generalized solicitation |
| Asking only the patients you expect to be happy | Avoid | Google bars selectively soliciting positive reviews; the FTC Q&A says the rule has no specific ban but the practice could violate the FTC Act; Yelp says asking mostly happy customers biases ratings |
| Free whitening, discounts or gift cards for a review | Prohibited | Google and Yelp ban rewards; the FTC rule bars incentives conditioned on sentiment |
| Staff or relatives posting reviews | Avoid | Google lists employment and family ties as conflicts of interest; the FTC rule requires insiders to disclose the connection clearly |
| Review quotas for staff or pressure at checkout | Prohibited on Google | Google bars requiring or pressuring reviews on premises and staff solicitation quotas |
| Buying reviews from a vendor or agency | Prohibited | The FTC rule bars fake or bought reviews, and the Q&A says agencies and review brokers can be liable |
| Asking a patient to update a review after you fix the problem | Allowed, with care | The FTC Q&A allows asking satisfied customers to update; Google bars rewards for changed or removed reviews |
Sources: Google Business Profile Help and Maps contributions policy (read 2026); FTC Consumer Reviews and Testimonials Rule Q&A (2025); Yelp Business Help Center (read 2026).
Some dental marketing guides suggest choosing the five to ten patients most likely to say yes each week. That is the second row of the table.
What the request message may say
- Thank the patient and include the review link. Stop there.
- Leave out the procedure, provider name, diagnosis, appointment date and anything about cost or insurance.
- Send the same wording to everyone from an office-controlled number or address.
- Do not ask for a positive review or a number of stars. Ask for an honest one.
- Include a way to opt out of further messages.
Check the tool before you automate
A review-request platform receives patient names and contact details tied to a visit. HHS says a business associate is an entity that performs functions or services for a covered entity involving access to protected health information, and that the HIPAA Rules generally require a contract with each one (HHS, sample business associate provisions). Ask any vendor whether it will sign a business associate agreement before patient data goes in. Texting also carries its own consent and opt-out rules, so have counsel review your consent wording before you automate.
How do you reply to a review without confirming patient status?
Write a reply that would read the same if the author had never been a patient: no name, no date, no service, no thanks for a visit. Then invite the person to call the office. HIPAA does not let a practice defend itself publicly with facts from the chart.
OCR has acted on this more than once. In 2019 it announced a $10,000 settlement with Elite Dental Associates in Dallas (HHS); a complaint began with a patient who said the practice posted a last name and details of a health condition, and OCR found disclosures about multiple patients in replies to Yelp reviews, with two years of monitoring (California Dental Association). In December 2022 OCR published a $23,000 settlement with New Vision Dental in California over replies to patient reviews (HHS). In June 2023 it announced $30,000 with a New Jersey psychiatry practice that answered a negative review with a patient’s diagnosis and treatment details (HHS).
| Practice | Announced | Amount | What OCR reported |
|---|---|---|---|
| Elite Dental Associates (Dallas, TX) | October 2019 | $10,000 | Patient information disclosed in replies to Yelp reviews; two years of OCR monitoring |
| New Vision Dental (California) | December 2022 | $23,000 | Protected health information disclosed in replies to patient reviews; corrective action plan |
| Manasa Health Center (New Jersey, psychiatry) | June 2023 | $30,000 | Diagnosis and treatment details in a reply; three other patients’ information; missing privacy policies; two years of monitoring |
Sources: HHS Office for Civil Rights resolution pages and press release (2019, 2022, 2023); California Dental Association (2019).
OCR’s director said in 2023 that the Privacy Rule expressly protects patients from this conduct and that OCR will act on it.
Words and moves to avoid in any reply
- Confirming or denying that the writer is a patient, including phrases such as “we are sorry about your visit”.
- Naming procedures, providers, dates, wait times, fees, insurance or balances.
- Correcting the record with chart facts, even when the review is false.
- Thanking a positive reviewer for “coming in” or mentioning their next cleaning.
- Replying from a personal account or pasting review text into chat tools or documents outside the practice’s secured systems.
Approved reply for a negative review (adapt, do not improvise)
Thank you for sharing this. We take feedback seriously and want to understand it. Because of privacy rules we cannot discuss any individual’s care or whether someone is a patient. Please call our office manager at [office number] so we can listen and look into it. [First name, title]
Approved reply for a positive review
Thank you for the kind words. Our whole team appreciates you taking the time to write them. [First name, title]. Google does not require a reply to every review.
How should a practice handle a negative review?
Sort it first. A real complaint, a billing or insurance dispute, a clinical complaint and a policy violation each take a different path. Reply once, publicly and generally, resolve the matter by phone, and report to the platform only if the review breaks its rules.
Four kinds of negative review
- Service complaint (wait time, rude tone, a missed call): general reply, then an internal fix.
- Billing or insurance dispute: general reply, then a call from someone who can open the account after verifying identity. Many start with an unexpected balance; see our dental billing services guide.
- Clinical complaint: general reply, then the dentist or clinical lead calls. Nothing clinical goes in writing in public.
- Policy violation (competitor, wrong business, personal information, spam, a review from someone who was never a patient): flag it. Google says flagging is for policy violations, not for negative reviews alone, and personal information posted without consent can be reported (Google contributions policy).
The AMA’s advice still holds: do not reply right away, take the conversation offline, keep any public reply general, and do not ignore criticism (AMA). Google asks for honest replies signed with a name or initials (Google).
What the practice must not do
- Do not offer a refund, free service or gift in return for a changed or removed review. Google and Yelp prohibit it, and the FTC says it may be unfair under the FTC Act.
- Do not send unfounded or groundless legal threats to make a reviewer take a post down, and do not make knowingly false accusations about a reviewer. Both fall under the FTC rule’s review-suppression section; legitimate legal action is not barred (FTC Q&A).
- Do not bury negative reviews on a page the practice controls; the FTC says making them hard to find may violate the FTC Act.
What is allowed is the plain path: contact the person, fix the problem, and, if they are satisfied, tell them they are welcome to update their review. The FTC Q&A permits both.
“A review is the one place where your patient talks to the next patient. Reply as if both are reading, and say nothing the first one would not want read aloud.”
— Awais Afzal, Healthcare Operations & Data Analyst
What does a review-response workflow look like, with owners and timing?
A workable workflow names one owner for each step, a time target and a second reader for privacy. Without that, replies come from whoever is at the desk.
| Step | Owner | Suggested timing | Output |
|---|---|---|---|
| 1. Monitor every platform and read new reviews | Marketing coordinator or front-desk lead | Each business day | List of new reviews with link and star rating |
| 2. Sort by type: service, billing, clinical, policy violation | Office manager | Same business day | Type tag and a privacy-risk flag |
| 3. Draft the reply from an approved template | Marketing coordinator | Within 1 business day | Draft with no name, date, service or confirmation |
| 4. Privacy check by a second reader | Privacy official (often the office manager) | Before posting, same day | Approved or edited draft |
| 5. Post, signed with first name and title | Marketing coordinator | Same day as approval | Live reply |
| 6. Offline follow-up: verify identity, then listen and resolve | Office manager; dentist for clinical items | Within 1 to 2 business days of the review | Call note in the practice’s secured system |
| 7. Flag policy violations to the platform | Marketing coordinator | Within 2 business days | Report filed and logged |
| 8. Monthly review of themes and metrics | Owner dentist and office manager | Monthly | Short list of fixes with owners |
Timing targets are RCM Finder’s suggestions, not rules. Google asks only that replies be prompt.
Put the workflow in a written policy and train staff on it with real examples. The ADA recommends written policies for staff use of social networking tools because of the risk of inadvertent disclosure. Our HIPAA compliance checklist for medical practices covers the wider safeguards, and the dental patient retention guide shows how feedback collected inside the office can catch problems before they become public reviews.
Can a practice reuse reviews on its website and ads?
Yes, but the rules get stricter once a review moves into your own marketing. At that point it is a testimonial, and the practice answers for how it is chosen and shown.
The FTC Q&A says reviews featured in advertising become testimonials and the hosting exemption no longer applies. Featuring only positive reviews is outside the suppression section but may still be deceptive. The ADA adds that a testimonial must represent the endorser’s opinion and experience, and many states regulate testimonials in dental advertising. On the HIPAA side, HHS says marketing generally needs written authorization, with exceptions, and its marketing page does not address testimonials (HHS marketing guidance). Because a reposted review identifies a person as a patient, our conservative practice is to get the patient’s written permission first and have counsel confirm it. Placement is covered in the dental website design guide.
What should a dental practice measure?
Measure the process and the outcomes together: how many patients are asked, how many respond, how fast the office replies and how many new patients say reviews brought them in. The star average alone hides all of that.
- Request coverage: patients sent a request divided by patients seen. It should be near the whole schedule.
- Review yield: new reviews per month divided by requests sent, tracked by platform.
- Reply rate and time: share of reviews answered, and business days from posting to reply.
- Offline resolution: negative reviews where the office reached the person by phone, and how many were resolved.
- Privacy exceptions: replies caught by the second reader. Rising counts mean retrain.
- New patients by source: ask on the first call how the person found the office, and add Google and Yelp to the source list.
Do not set a monthly review target for staff; Google bars staff solicitation quotas. For how reviews feed the larger funnel, see our dental digital marketing guide. For the wider all-specialty routine, see the guide to online reputation management for doctors.
Want a second set of eyes on your review process?
We will look at how your office asks for and answers reviews.
Our recommendations
- Write one request and send it to everyone. We would set a single review-request message with no clinical detail and send it after every visit.
- Offer nothing for a review. Remove every gift, raffle and discount tied to reviews.
- Keep staff and family off the review pages. If a team member posts, the connection must be disclosed. Better, they do not post.
- Approve three reply templates and require a second reader. One for positive, one for negative, one for billing. Anything outside the templates goes to the privacy official before posting.
- Get a business associate agreement before any review tool sees patient data. Ask the vendor in writing.
- Review the log monthly and fix the cause. Give each repeated complaint an owner.
Bottom line
Dental reputation management works when the office asks every patient the same way, answers in general terms, and keeps a named owner and a second reader on every reply. Start with the dental practice management guide to see where reviews sit next to scheduling, eligibility and collections, then build the workflow above. Practices that want help with local visibility and reputation can start with RCM Finder’s healthcare digital marketing service.
Frequently asked questions
Can a dentist respond to a negative Google review?
Yes. A reply is allowed, but it must stay general. Do not confirm the writer is a patient, name services or dates, or correct the record with chart facts. Thank them, say you take feedback seriously, state that privacy rules limit what you can discuss, and give a phone number for the office manager.
Is it a HIPAA violation to thank someone for a positive review?
It can be, if the thanks confirms the person is a patient or names a service, provider or visit. The ADA warns that even revealing someone is a patient may violate privacy law. Use a general thank-you that works for any reader, and remember Google does not require a reply to every review.
Can we offer a discount or free whitening for a review?
No. Google calls rewards for reviews fake engagement and prohibits them, Yelp bans them, and the FTC rule bars incentives conditioned on a positive or negative opinion. Thank patients for feedback without attaching anything of value to it, and check your state dental board for advertising rules.
Can we ask only our happiest patients for reviews?
Avoid it. Google’s policy bars selectively soliciting positive reviews, and Yelp says asking mostly happy customers biases ratings. The FTC Q&A says the rule has no specific prohibition on selective asking, but the practice could violate the FTC Act. A request sent to every patient is the lowest-risk approach.
How do we get a fake or unfair review removed?
Flag it to the platform if it breaks the platform’s policy, for example a competitor post, a review of the wrong business or personal information. Google says flagging is for policy violations, not negative reviews alone. Do not threaten groundless legal action or offer rewards for removal; the FTC rule and platform terms restrict both.
Do we need a business associate agreement for review software?
If the tool receives patient names or contact details tied to a visit, ask the vendor in writing whether it will sign one, and have it in place before patient data goes in. HHS says business associates are entities performing services that involve access to protected health information, and HIPAA generally requires a contract with each.
Get your free practice audit
Tell us about your practice. We will contact you using the details you give.
- A review of your recent claims, denials and A/R aging
- Where your front desk and prior authorizations slow payment
- A prioritized fix list you keep, whether or not you hire us
Pricing is quoted after the audit, based on your volume and the services you choose. Prefer to talk? Call +1 (302) 556-2288.
Sources
- Marketing and advertising — American Dental Association (undated, read 2026)
- How to respond to bad online reviews — American Medical Association (2016)
- Trade Regulation Rule on the Use of Consumer Reviews and Testimonials — Federal Register (2024)
- Federal Trade Commission Announces Final Rule Banning Fake Reviews and Testimonials — Federal Trade Commission (2024)
- The Consumer Reviews and Testimonials Rule: Questions and Answers — Federal Trade Commission (2025)
- FTC Warns 10 Companies About Possible Violations of the Agency's New Consumer Review Rule — Federal Trade Commission (2025)
- Dental Practice Pays $10,000 to Settle Social Media Disclosures of Patients' Protected Health Information — HHS Office for Civil Rights (2019)
- Dental practice pays $10K to settle disclosures of patients' PHI on social media — California Dental Association (2019)
- HHS Civil Rights Office Enters Settlement with Dental Practice Over Disclosures of Patients' PHI — HHS Office for Civil Rights (2022)
- HHS Office for Civil Rights reaches agreement with New Jersey provider that disclosed PHI in response to negative online reviews — HHS Office for Civil Rights (2023)
- Marketing (HIPAA Privacy Rule guidance) — HHS Office for Civil Rights (undated, read 2026)
- Sample business associate agreement provisions — HHS Office for Civil Rights (undated, read 2026)
- Manage and respond to Google reviews (Business Profile Help) — Google (read 2026)
- Prohibited and restricted content (Maps user contributed content policy) — Google (read 2026)
- Don't ask for reviews — Yelp Business Help Center (read 2026)
Disclaimer: This article is educational and is not legal, compliance or coding advice. HIPAA, FTC, platform and state dental board rules change and differ by state, so confirm current requirements with your attorney, your privacy official and your state board before acting. Settlement amounts are as announced by HHS.
