How Medical Practices Get More Google Reviews Without Breaking HIPAA

Building a steady flow of google reviews for medical practice visibility is one of the highest-return things a clinic can do for local growth, and it is also the one most front desks are quietly terrified to touch. The fear is understandable but mostly misplaced. Asking a patient for an honest Google review is not a HIPAA violation. Disclosing that someone is a patient, or naming their treatment, is. This guide draws the line in plain English, hands you copy-paste scripts that carry zero protected health information, and shows the automation and review math that actually move rankings.

Is Asking for a Review a HIPAA Violation? No, If Three Things Are True

Here is the part nobody at the front desk believes until they see it in writing: a review request is compliant as long as all three of these hold true.

• The message carries no protected health information. No diagnosis, no procedure, no reason for the visit. "Thanks for coming in" is fine. "Thanks for your Botox appointment" is not.
• The ask is not conditioned on a positive experience. You send it to everyone, not just the patients you think are happy. Filtering for good reviews is called review gating, and it is a separate legal problem.
• There is no incentive. No discount, no gift card, no raffle entry in exchange for a review.

The thing that trips up practices is almost never the ask. It is the response. Confirming that a specific person received care from you is itself a disclosure of protected health information, even when you are just being polite.

The Rules in Plain English (With Primary Sources)

Three sections of the HIPAA Privacy Rule do the heavy lifting here. You do not need to be a lawyer, you need to know which side of the line each activity sits on.

• Asking for a review is not "marketing." Under 45 CFR 164.501, marketing is a communication that encourages someone to buy a product or service. Inviting an existing patient to leave honest feedback does not meet that definition, so it does not require a prior authorization.
• Posting an identifiable testimonial does need written authorization. If you want to quote a patient by name or show their face on your site, 45 CFR 164.508 requires a signed authorization first. A review the patient posts themselves on Google is their disclosure, not yours; a testimonial you publish is yours.
• De-identify before you use anything. 45 CFR 164.514 sets the standard for stripping identifiers. If you reference patient stories in your own marketing, this is the bar.

One more rule lives outside HIPAA. The FTC final rule on fake and deceptive reviews took effect October 21, 2024, and carries a civil penalty of up to $51,744 per violation. Read it accurately: it targets fake reviews, undisclosed insider reviews, and reviews bought with incentives. Asking real patients for honest feedback is completely fine. Buying reviews or only soliciting the happy ones is the risk.

The Word-for-Word Request Scripts (Copy-Paste, PHI-Free)

Every script below is deliberately empty of health information. Swap in your practice name and your Google review short link. That is it. Do not add the reason for the visit, ever.

SMS 1 (sent about 24 hours after the visit)

"Hi [First name], thanks for visiting [Practice name]. If you have 30 seconds, a quick Google review helps other patients find us: [review link]. No pressure either way."

SMS 2 (gentle reminder, 3 days later, only if no review)

"Hi [First name], following up from [Practice name]. If you have a moment, we would be grateful for your honest feedback here: [review link]. Thank you."

Email version

Subject: A quick favor from [Practice name]
"Hi [First name], it was good to see you. Your feedback helps our team and helps future patients choose the right practice. If you are willing, you can leave a Google review here: [review link]. Thank you for trusting us with your care."

Front-desk verbal script

"Before you go, if you were happy with today, would you mind leaving us a Google review? I can text you the link right now so it is easy." Then send the standard SMS so the link is PHI-free and consistent.

The unhappy path, done compliantly

You are allowed to make it easy for an unhappy patient to reach you directly. What you cannot do is route only the happy patients to Google and everyone else to a private form. That selective routing is gating. The compliant version gives every patient both options on the same screen: leave a public review, or share private feedback with the office. Same message, same audience, patient chooses. This is a core piece of any real reputation management services program.

The 24-Hour Post-Visit Automation

Doing this by hand dies the first busy week. The reason practices with systems pull ahead is that the ask never depends on someone remembering. Here is the build, described so it works in whatever automation platform your practice runs.

• Trigger on appointment status, not appointment type. Fire when the visit is marked completed or checked out. Triggering on the type of appointment can leak the reason for the visit into your data flow; status stays clean.
• Wait about 24 hours. Long enough that the visit is done and the patient is home, fresh enough that they still remember you.
• Send SMS 1 with the PHI-free script and the review link.
• Add a condition. If the patient has not left a review after three days, send the reminder. If they have, stop the sequence.
• Fallback to email for patients with no mobile number on file.

Two non-negotiables. First, any platform that touches patient names and phone numbers must be covered by a signed business associate agreement, a BAA. No BAA, no patient data in the tool. Second, the message templates live in the automation, so nobody can freelance and paste in a diagnosis. This is exactly the kind of workflow we build inside a practice's CRM and marketing automation stack, and it pairs naturally with SMS marketing automation that is set up for healthcare from day one.

Review Velocity and the Map Pack: The Math

Total review count is a ranking factor, but so is velocity, how many fresh reviews you earn per month, and recency, how new they are. A practice with 400 reviews and nothing in the last year looks stale next to one earning 15 a month. Reviews from the last 90 days pull the most weight in the local pack. Here is a realistic target by market density.

The math is friendlier than it looks. A practice seeing 200 patients a month that asks every one of them, at even a 10 percent conversion, earns 20 reviews a month. That is enough to compete in most markets. The gap is almost never patient volume. It is that nobody asks. Reviews feed the same local signals as medical practice SEO, so a steady flow compounds with everything else you do to get found.

Responding to Reviews Without Disclosing PHI

You should respond to reviews. It signals an engaged practice and it is good for local ranking. You just have to respond like the Elite Dental case is taped to your monitor. The safe move: never confirm the person was a patient, never reference any care detail, keep it generic and move the conversation offline.

• Positive review reply: "Thank you for the kind words. We appreciate you taking the time and are glad you had a good experience with our team."
• Negative review reply: "We take feedback seriously and would like to understand what happened. Please contact our office manager at [phone] so we can help directly." Note what is missing: no confirmation this person was ever seen, no details, no defensiveness.
• Never do this: confirm the visit, name the treatment, correct the patient's version of events, or mention insurance or billing. All of it is protected health information the moment you tie it to an identifiable person.

Sources

HHS Office for Civil Rights, Elite Dental Associates settlement (2019) · FTC final rule on fake reviews (2024) · 45 CFR 164.501 · 45 CFR 164.508 · 45 CFR 164.514