Most patients who had a good visit will leave a review if someone asks them. Most never get asked. That gap is why so many good practices sit on a handful of old reviews while a competitor down the road has hundreds. Asking is the fix, but since October 2024 there are clear federal rules about how you ask, and for medical practices HIPAA adds a second set of limits on how you reply. This guide covers both.
What the FTC rule bans
The FTC’s Trade Regulation Rule on the Use of Consumer Reviews and Testimonials (16 CFR Part 465) took effect on October 21, 2024. For a practice, the parts that matter most are:
- Fake reviews. No reviews from people who weren’t patients, and no reviews written by you, a vendor or AI and posted as if from a patient.
- Rewards tied to sentiment. You can’t offer anything in exchange for a positive (or negative) review.
- Undisclosed insider reviews. Staff, owners and their relatives can’t post reviews without clearly disclosing the connection, and you shouldn’t ask them to.
- Review suppression. No threats, pressure or legal intimidation to get a review removed, and no hiding negative reviews on your own site while implying you show them all.
The stakes are real. In December 2025 the FTC sent warning letters to ten companies, reminding them that violations can bring civil penalties of up to $53,088 each (Kelley Drye summary).
Google’s rules are stricter still
Google doesn’t allow incentives for reviews at all, positive or not, and it doesn’t allow “review gating”: sending a survey first and only asking happy patients to post on Google. Gating can also look like suppression under the FTC rule. The simple, safe approach is to ask every patient the same way.
How to ask, in practice
- Ask everyone. Build the request into your routine after every visit, not just when a patient seems pleased.
- Ask soon. A text or email within a day of the visit gets far more responses than a request weeks later.
- Make it one tap. Link straight to your Google review form, so patients don’t have to search for you.
- Keep it neutral. “We’d appreciate your feedback on your visit” works. “If you loved us, please leave 5 stars” doesn’t.
- Respect communication consent. Only text patients who’ve agreed to receive texts from you, and keep the message free of any health details.
A simple message that works: “Thanks for visiting [Practice] today. If you have a minute, we’d appreciate your feedback: [link]. Reply STOP to opt out.”
How to reply without a HIPAA problem
This is where practices get caught. HHS’s Office for Civil Rights has settled with dental practices that revealed patients’ names, treatment or insurance details while replying to Yelp reviews, including Elite Dental Associates in 2019 and New Vision Dental in 2022 (DLA Piper on the New Vision Dental settlement). It doesn’t matter if the patient mentioned those details first; posting their own information doesn’t waive their privacy.
A safe reply never confirms the reviewer is a patient and never mentions care, timing, insurance or cost. For a negative review: “Thank you for your feedback. We take every concern seriously and would like to talk with you directly. Please call our office manager at [number].” For a positive one, a short thank-you is enough.
What not to do
- Don’t buy reviews or use a service that “boosts” ratings.
- Don’t offer discounts, gift cards or entries into a draw for reviews.
- Don’t ask staff or family to review the practice.
- Don’t send review links only to patients who gave a high survey score.
- Don’t argue with reviewers, or threaten action over a negative review.
- Don’t copy reviews onto your website as testimonials without checking your privacy and authorization requirements.
The short version
Ask every patient, quickly and neutrally. Reply to every review briefly and without patient details. Never pay for, filter or fake reviews. Done consistently, that builds a reputation that’s both stronger and safer. If you’d like help setting it up, see our reviews and reputation service.
This article is general information, not legal advice. For questions about your practice’s obligations under HIPAA or FTC rules, talk to your compliance advisor or attorney.