Answer every patient review the same way: thank the reviewer, describe your practice’s standards in general terms, and invite them to contact the office, without confirming that the person is a patient or saying anything about a visit, treatment, or bill. Two laws can apply at once. The federal HIPAA Privacy Rule bars a practice that is a HIPAA covered entity from disclosing patient information except as the rule permits, and federal regulators have penalized practices whose review replies did exactly that. The Minnesota Health Records Act adds a consent rule of its own and lets the patient sue the practice for damages, plus attorney fees. This article, part of my business torts practice, covers what a Minnesota medical, dental, or therapy practice may say, who should say it, and the separate federal rules on asking for reviews and using testimonials.

Why can a reply to a patient review violate HIPAA?

For a practice HIPAA covers, a reply violates HIPAA when it ties the reviewer to a visit, a treatment, or a bill, because that is protected health information, and the practice may disclose it only as the Privacy Rule permits or with the patient’s signed authorization. A patient’s public complaint is not an authorization, so the reply cannot borrow permission from the review.

The Privacy Rule’s general rule, 45 C.F.R. § 164.502(a), is that a covered entity “may not use or disclose protected health information, except as permitted or required by this subpart.” A practice is a covered entity under 45 C.F.R. § 160.103 if it is “A health care provider who transmits any health information in electronic form in connection with a transaction covered by this subchapter”; a practice that is not still falls under the Minnesota Health Records Act, whose definition of a provider in § 144.291, subd. 2(i)(1) covers “any person who furnishes health care services and is regulated to furnish the services under” the listed licensing chapters. Health information is defined in 45 C.F.R. § 160.103 to include information, “whether oral or recorded in any form or medium,” that relates to “the provision of health care to an individual” or “payment for the provision of health care,” and it becomes identifiable when “there is a reasonable basis to believe the information can be used to identify the individual.” A reply that discusses a reviewer’s care under the reviewer’s name or screen name can meet that test. Outside the rule’s permitted uses, a disclosure needs an authorization under 45 C.F.R. § 164.508, and a valid authorization must contain the “Signature of the individual and date.”

The U.S. Department of Health and Human Services Office for Civil Rights (“OCR”) has enforced this against small practices:

  1. Elite Dental Associates (Dallas) paid $10,000 after a Yelp reply disclosed a patient’s “last name, details of her treatment plan, insurance and cost information.”
  2. New Vision Dental (California) paid $23,000 over Yelp replies that sometimes gave “full names where only Yelp monikers were used by the patients.” OCR’s summary states: “This practice is illegal under HIPAA.”
  3. Manasa Health Center, a New Jersey psychiatric practice, paid $30,000 after it disclosed “the PHI of four (4) patients in response to their negative reviews posted on Google Reviews.”
  4. A North Carolina dental practice received a $50,000 civil money penalty after it “impermissibly disclosed a patient’s PHI on a webpage in response to a negative online review” and then did not respond to OCR’s data request or subpoena.

The settlements are not admissions of liability, but they show what OCR investigates. Each began with a complaint to OCR. For the broader rules, see how HIPAA applies in Minnesota.

How does the Minnesota Health Records Act change the risk?

The Minnesota Health Records Act requires a patient’s signed and dated consent before a provider releases health records, defines a health record to include oral information about a patient’s care, and gives the patient a lawsuit for damages “plus costs and reasonable attorney fees.” HIPAA penalties come from the government; this claim belongs to the patient.

Under Minn. Stat. § 144.293, subd. 2, a provider “may not release a patient’s health records to a person without” one of three things: “a signed and dated consent from the patient or the patient’s legally authorized representative authorizing the release,” “specific authorization in Minnesota law,” or a representation from a provider that holds such a consent. The exceptions in subdivision 5 concern medical emergencies and releases to other providers, such as “other providers within related health care entities when necessary for the current treatment of the patient.” A review reply fits none of them.

What counts as a record is broad. Minn. Stat. § 144.291, subd. 2(c) defines “Health record” as “any information, whether oral or recorded in any form or medium, that relates to the past, present, or future physical or mental health or condition of a patient; the provision of health care to a patient; or the past, present, or future payment for the provision of health care to a patient.” The Minnesota Court of Appeals applied that definition in Holtzbauer v. Allina Health System, No. A24-1390 (Minn. App. May 19, 2025). It held that a hospital employee’s statement that a person was a current patient in a specific room and bed was “information . . . that relates to . . . the provision of health care” and therefore a release of a health record. The court did not decide whether disclosing only that someone is or was a patient, without more detail, is enough. The Minnesota Supreme Court granted review and scheduled argument for January 13, 2026; check for its decision before relying on the court of appeals’ reading.

The consequences come from Minn. Stat. § 144.298. A person who “negligently or intentionally requests or releases a health record in violation of sections 144.291 to 144.297” is “liable to the patient for compensatory damages caused by an unauthorized release or an intentional, unauthorized access, plus costs and reasonable attorney fees.” A violation “may be grounds for disciplinary action against a provider by the appropriate licensing board or agency.” HIPAA does not displace this kind of claim: in Yath v. Fairview Clinics, N.P., 767 N.W.2d 34 (Minn. App. 2009), the court held that the Act’s predecessor statute “is not a contrary state law preempted by HIPAA.” On the federal side, under 42 U.S.C. § 1320d-5, the HHS Secretary imposes civil money penalties and a state attorney general may sue “on behalf of such residents of the State.”

What can a practice safely say in a reply to a negative review?

A safe reply reads the same whether or not the reviewer was ever a patient: thank them, state the practice’s general commitment, explain that privacy law keeps you from discussing anyone’s care online, and give a way to reach the office. It confirms no visit, no name, no condition, and no fact from the review.

A version that works for most complaints:

Thank you for your feedback. We take every concern seriously. Privacy laws do not allow us to discuss any individual’s care in a public forum. Please contact our office manager at [phone or email] so we can speak with you directly.

What the reply leaves out matters more than what it says:

  1. No name or initial, even if the reviewer used their real name.
  2. No dates, procedures, diagnoses, or insurance or billing details, including a correction of a detail the reviewer got wrong.
  3. No characterization of the person, such as calling the reviewer a difficult patient or saying how many appointments they missed. The North Carolina practice’s reply said the reviewer’s “level of intelligence is in question” and ended “Get a life.”
  4. No promise to look into the reviewer’s visit, which confirms there was one.

The HIPAA rule on how much to share points the same way. Even for a permitted disclosure, 45 C.F.R. § 164.502(b) requires “reasonable efforts to limit protected health information to the minimum necessary to accomplish the intended purpose.” A review reply needs no patient information to do its job, so the right amount is none. If a review states something false and damaging, the response belongs in a private channel or a removal request, not in the reply box.

What makes a thank-you reply to a good review a disclosure?

A thank-you becomes a disclosure when it adds information the practice holds about the patient, such as the patient’s name, the procedure, the provider who treated them, or how recovery is going. Under Minnesota’s definition, information that “relates to . . . the provision of health care to a patient” is a health record, and a warm tone does not change that.

Practices rarely think of positive replies as risky, and that is why the details slip in. A reply that thanks a patient by first name and says the practice is glad the implant healed well names the patient and the procedure. A reply saying it was great to see the reviewer and the kids last week confirms a visit date and family members. Both fit the HIPAA definition of information relating to “the provision of health care to an individual,” and both fit the Minnesota definition in § 144.291, subd. 2(c). Write positive replies to the same standard as negative ones:

Thank you for the kind words. We will share them with our team.

A short, uniform reply also protects the practice’s position on the negative reviews. When every reply looks alike, a generic answer to a complaint does not stand out as an evasion.

When is it better not to reply at all?

Silence is the better choice when any useful reply would have to address the facts, when the post accuses a staff member of misconduct, or when the author is escalating through calls, messages, or more posts. A reply cannot fix those problems, and every reply is one more public statement the practice must stand behind.

A post accusing a provider or staff member of misconduct is the clearest case. That kind of accusation can turn into a licensing board complaint or a police report, and Minnesota treats a records violation itself as possible grounds for discipline under § 144.298, subd. 1. In my practice, when a review accused a staff member of misconduct, I suggested the clinic hold off on replying or contacting the patient until it had legal advice, because a reply can make the situation harder to resolve. I also suggested that it update its malpractice carrier and ask whether its policy covers defending a licensing board complaint.

While you decide, preserve the evidence. Save a screenshot of each post showing the date, the web address, and the account name, because posts can be edited or deleted. Have each staff member who spoke with the author write down when the conversation happened and what was said.

Who should answer reviews, and what should the written policy say?

One or two trained people should answer reviews, working from approved reply wording, under a written policy. HIPAA already requires the pieces: written privacy policies, workforce training, sanctions for violations, and mitigation when something goes wrong.

The Privacy Rule requires a covered entity to “implement policies and procedures with respect to protected health information” (45 C.F.R. § 164.530(i)), to “train all members of its workforce on the policies and procedures with respect to protected health information” (45 C.F.R. § 164.530(b)), and to “have and apply appropriate sanctions against members of its workforce who fail to comply” (45 C.F.R. § 164.530(e)). In the Elite Dental settlement, OCR’s covered conduct included a failure to implement policies “including releasing PHI on social media/public platforms.” A review policy for a Minnesota practice should cover at least these points:

  1. Who may post. Name the people who may reply on Google, Yelp, Facebook, and Healthgrades on the practice’s behalf, and remove access for everyone else, including former staff and marketing vendors.
  2. Approved wording. Keep the generic negative and positive replies on file, and require that any other wording be approved before it posts.
  3. What never goes in a reply. List the categories in the section above.
  4. Escalation. Send any review accusing someone of misconduct, threatening a lawsuit, or naming a staff member to the owner before anyone responds.
  5. Training and sanctions. Train the people who reply, document the training, and state the consequence of posting patient information.
  6. Cleanup. Say who removes a bad reply and documents the incident. The rule requires the practice to “mitigate, to the extent practicable, any harmful effect” of a disclosure that violates its policies (45 C.F.R. § 164.530(f)).

What are the rules for asking patients for reviews and using testimonials?

Asking every patient for an honest review is lawful. Rewarding only positive reviews, or having a manager post a review without disclosing the manager’s relationship to the practice, violates the Federal Trade Commission’s (“FTC”) review rule. A testimonial that names or shows a patient needs the patient’s signed HIPAA authorization and, in Minnesota, a signed and dated consent.

The FTC’s Trade Regulation Rule on the Use of Consumer Reviews and Testimonials, 16 C.F.R. Part 465, took effect in 2024; the Federal Register notice states, “This rule is effective October 21, 2024.” Under 16 C.F.R. § 465.4, a business may not “provide compensation or other incentives in exchange for, or conditioned expressly or by implication on, the writing or creation of consumer reviews expressing a particular sentiment, whether positive or negative.” Under 16 C.F.R. § 465.5, an officer or manager who writes a review must clearly and conspicuously disclose the “material relationship to the business.” A review request should go to every patient on the same terms, and it should ask for an honest review rather than a five-star one.

Testimonials are a different matter, because the practice, not the patient, is publishing them. HIPAA requires “an authorization for any use or disclosure of protected health information for marketing,” with narrow exceptions for face-to-face communications and promotional gifts of nominal value (45 C.F.R. § 164.508(a)(3)). OCR settled with a Los Angeles-area physical therapy practice for $25,000 after it posted “patient testimonials, including full names and full face photographic images, to its website without obtaining valid, HIPAA-compliant authorizations.” In Minnesota, the testimonial is also a release of health records that needs “a signed and dated consent from the patient” under § 144.293, subd. 2. Use one form that meets both laws, describing exactly what will be posted, where, and for how long, and keep the signed copy.

What does the FTC review rule forbid when a practice wants a review gone?

The FTC rule bars using “an unfounded or groundless legal threat, a physical threat, intimidation, or a public false accusation in response to a consumer review” to stop a review or get one removed, where the accusation is made “with the knowledge that the accusation was false or made with reckless disregard as to its truth or falsity.” Federal law also voids form-contract terms that bar patients from posting reviews.

Under 16 C.F.R. § 465.7(a), the prohibition applies when the threat is used in an attempt to “Cause a review or any portion thereof to be removed.” A threat is “unfounded or groundless” under 16 C.F.R. § 465.1(p) when it rests on “claims, defenses, or other legal contentions unwarranted by existing law or based on factual contentions that have no evidentiary support.” A letter demanding removal of an honest, negative opinion is the risky case. A letter should rest on statements of fact the practice can prove false, and it should be written expecting that the author may post it. The general risks are covered in cease and desist letters that backfire.

The FTC’s rulemaking record shows that a dental trade association asked the FTC “to permit dentists and other health care providers to disclose patient information in response to a review (limited to the scope of the topics addressed in the review) without violating any FTC privacy-based prohibitions.” The FTC’s answer: “This request is beyond the scope of this rulemaking.”

A practice cannot contract its way out of reviews either. Under the Consumer Review Fairness Act, 15 U.S.C. § 45b, a review-restricting provision of a form contract “is void from the inception of such contract,” and “It shall be unlawful for a person to offer a form contract containing a provision described as void in subsection (b).” The details are in contracts that prohibit customer reviews.

How does getting a review removed from Google or Yelp work?

The platform decides whether a review comes down, under its own content policy. Federal law does not treat Google or Yelp as the publisher of a patient’s post, so a practice’s lever is a report showing the post breaks a specific platform rule, not a demand that the platform answer for what the patient wrote.

47 U.S.C. § 230(c)(1) provides that “No provider or user of an interactive computer service shall be treated as the publisher or speaker of any information provided by another information content provider.” Each platform removes reviews that break its own content policy. An honest negative review from a real patient usually stays up.

How the report is written matters. In that same matter, I suggested that the clinic’s report to Google name the review policy the post broke and say nothing about whether the author was a patient or about the visit. A removal report is still a statement by the practice to a third party, so the same privacy rules apply to it. When the post is fake, see fake reviews and listings. When a real patient states something false, the options run from a platform report to a letter to a lawsuit, each with its own risks; see handling fake or defamatory online reviews and Minnesota defamation law.

Can we correct a review if the patient already disclosed their own diagnosis in it?

No. A patient’s own post does not give the practice permission to discuss the visit. For a practice that is a HIPAA covered entity, HIPAA requires a valid authorization that carries the patient’s signature and date (45 C.F.R. § 164.508), and Minnesota requires a signed and dated consent before a provider releases health records (Minn. Stat. § 144.293, subd. 2). Confirming or correcting the diagnosis adds the practice’s own disclosure to the patient’s. Reply generically and move the conversation to a private channel.

Can we reply that the reviewer was never our patient?

Sometimes, but it is rarely wise. A true statement that someone was never treated discloses no patient’s records, because the privacy laws protect information about patients. The trouble is the pattern: if the practice says it about one reviewer, readers will infer that every reviewer it did not say it about was a patient. For a post you believe is fake, report it to the platform under its fake-review policy instead.

Does a generic 'please call our office' reply confirm the person is a patient?

Not when the practice posts the same reply to every reviewer, patient or not. In Holtzbauer v. Allina Health System, the Minnesota Court of Appeals expressly did not decide whether disclosing only that a person is or was a patient releases a health record. A uniform invitation to call the office, with no mention of a visit, keeps the practice away from that open question.

Can we offer patients a gift card for leaving a review?

Under the FTC’s review rule, the answer turns on whether the reward depends on what the review says. That rule, 16 C.F.R. § 465.4, makes it unlawful to provide incentives conditioned, expressly or by implication, on a review expressing a particular sentiment. Offer the same reward for any honest review, positive or negative, and do not offer it only to patients you expect to be happy. For patients eligible for Medicare or a State health care program, a separate federal law, 42 U.S.C. § 1320a-7a(a)(5), reaches anyone who “offers to or transfers remuneration to any individual eligible for benefits” under those programs that the person “knows or should know is likely to influence such individual to order or receive from a particular provider, practitioner, or supplier any item or service for which payment may be made.”

Can the office manager or our hygienists post reviews of the practice?

The office manager may not post one without disclosing the material relationship; for hygienists, the rule reaches the manager who asks them. Under 16 C.F.R. § 465.5(a), an officer or manager who writes a review of the business must clearly and conspicuously disclose the officer’s or manager’s material relationship to the business. Under 16 C.F.R. § 465.5(c), a manager who asks employees for reviews can violate the rule if a review appears without a disclosure of the reviewer’s material relationship to the business and the manager encouraged the employee not to disclose, did not instruct employees to disclose clearly and conspicuously their relationship to the business, or knew or should have known of the undisclosed review and failed to take remedial steps. The simplest policy is that staff do not review the practice.

What if someone on staff already replied with patient details?

Take the reply down, record what it said and who saw it, and treat it as a privacy incident under your HIPAA policies. The Privacy Rule requires mitigating known harm and applying sanctions to staff who break the policies (45 C.F.R. § 164.530). HIPAA’s breach notification rule, 45 C.F.R. § 164.404(a)(1), also requires a covered entity, following the discovery of a breach of unsecured protected health information, to notify each individual whose information was disclosed as a result of the breach. Under 45 C.F.R. § 164.408(a), the covered entity must also “notify the Secretary” of Health and Human Services, “in the manner specified on the HHS web site.” In the review-reply settlements, HHS required breach notices to affected patients. Under Minn. Stat. § 144.298, the patient may also have a damages claim.

A Minnesota practice can answer every review it receives, as long as no reply confirms a patient relationship or says anything about care. The same discipline applies to thank-you replies, removal reports, review requests, and testimonials, and it should be written into a policy that the people posting have been trained on. HIPAA exposes a covered practice to federal penalties; the Minnesota Health Records Act adds the patient’s own damages claim with attorney fees. For related issues, see my business torts practice. If you would like a second set of eyes on a review, a reply your practice is considering, or your review policy, email [email protected] with a brief description and a link to the post. Please do not send patient records or other confidential documents until the firm has completed an intake and conflict check.