How to Respond to Negative Reviews Without Violating HIPAA

Sooner or later it happens to every practice: you open your phone and there's a one-star review. Maybe it's a billing dispute. Maybe it's someone angry about a wait time. Maybe you're certain it has the facts wrong. Your instinct is to set the record straight — you remember exactly what happened, and you can explain it in three sentences.

That instinct is precisely how chiropractors turn a bad review into a federal privacy violation. In 25 years of working with practices online, I've seen far more lasting damage done by responses to negative reviews than by the reviews themselves.

The rule that governs everything

Never confirm that the reviewer was a patient. Not directly, not by implication. HIPAA doesn't switch off because the patient went public first. They're free to post anything they want about their care; the moment you acknowledge they received care — or even had an appointment — you've disclosed protected health information without authorization.

Read these carefully, because every one of them fails the test:

• "We're sorry your adjustment didn't meet your expectations." Confirms treatment.
• "Our records show you were seen promptly at your visit on the 14th." Confirms a visit, a date, and a records lookup.
• "You were only charged for the services you received." Confirms billing, and therefore care.

This is not a theoretical risk. In 2019 a Dallas dental practice paid a $10,000 settlement to the HHS Office for Civil Rights after replying to reviews with patients' names and treatment details. Regulators read Google reviews too.

You are not writing to the reviewer

Here's the reframe that makes every response easier to write: the reviewer has already made up their mind. Your actual audience is the next 100 prospective patients who will read the exchange while deciding whether to call you. You will never win the argument with the reviewer. You're auditioning for everyone else.

And that audience isn't looking for perfection — nobody trusts a spotless record anyway. They're watching how you behave under criticism. One calm, professional response to an unfair one-star review builds more trust than a page of five-star praise.

Three templates that keep you safe

Notice that none of these confirm the reviewer was ever treated at your office. That's the entire trick.

1. The standard negative review

"Thank you for taking the time to share this. We hold ourselves to a high standard and take feedback seriously. Privacy regulations prevent us from discussing anyone's care publicly, but we'd welcome a direct conversation — please call our office manager at [phone]."

2. The angry, detailed accusation

"We appreciate all feedback, including critical feedback. Federal privacy law doesn't allow us to discuss whether any individual has been seen at our office, so we can't address specifics here. Anyone with a concern about an experience with our practice can reach us at [phone], and we'll make time the same day."

3. The review you believe is fake

"We take every review seriously, but we're unable to verify the situation described here. Privacy law prevents us from discussing individual care in any case. If you feel you've had a poor experience with our office, please contact us at [phone] so we can address it directly."

For suspected fakes, respond once with the template above, then flag the review through your Business Profile dashboard. Do not announce "this person was never a patient here" — a statement about patient status is a statement about patient status, in either direction, and if you're wrong it's a disclosure.

Timing, tone, and the two-draft rule

• Respond within 24 to 48 hours — never within the first hour. Write the angry draft, delete it, then write the one you'll publish. The two-draft rule has saved more reputations than any template.
• Keep it under 60 words. Long responses read as defensive even when every sentence is polite.
• Never offer compensation publicly, and never condition anything on removing the review. The first invites copycats; the second violates Google's policies and looks like a payoff.
• Move it offline. The public response exists to show grace; the phone call exists to solve the problem.

The takeaway

A negative review is survivable; a defensive or revealing response is what does the lasting damage. The strongest protection is context: a profile earning fresh reviews every week makes any single bad one look like statistical noise, and a working review engine keeps that context from ever running dry.

If you want to see what those next 100 readers actually see — your map-pack position, your profile gaps, and how your reputation compares with the practices nearby — run the free Local SEO Report and start from an honest picture.