Practice Growth · For clinicians

Getting More Patient Reviews Ethically: HIPAA-Compliant Review Responses

By the Find Her Doctor editorial team · Updated November 1, 2026 · 5 min read

The ethical way to get more patient reviews is simple: ask every patient, consistently, at the right moment, with a direct link, and never filter who gets asked or reward positive feedback. Responding has an equally simple rule: never confirm that the reviewer is a patient or mention any detail of their care. A short, generic reply that invites them to contact the office keeps you on the right side of HIPAA.

Most practices don't have a review problem so much as a process problem. Reviews arrive only when a patient is unusually delighted or unusually angry, and the replies get written by whoever happens to see them first, sometimes at 11 p.m. and sometimes with clinical detail. Both are fixable with a workflow.

Why reviews matter in OB/GYN and midwifery

Patients choosing someone to manage a pregnancy or a sensitive gynecologic problem want reassurance from people like them. Reviews also feed local search visibility on Google and other platforms, which matters in a dense market like New York, where a patient searching from Park Slope or Forest Hills sees a dozen practices within a mile.

Recency and volume tend to count as much as the star average. A steady trickle of recent reviews usually reads as more trustworthy than a perfect rating from five years ago.

Building the ask into your workflow

Ask everyone

Google's policies prohibit "review gating," where a satisfaction survey goes out first and only happy patients are invited to post publicly. The FTC's 2024 rule on consumer reviews also targets suppressing negative reviews. The defensible approach is a uniform ask.

Pick the right moments

Timing that works in women's health:

• After an annual exam or problem visit, once the patient has checked out
• After the postpartum visit, rather than mid-pregnancy
• After a resolved issue, such as a successful procedure follow-up

Skip the ask after a difficult diagnosis, a pregnancy loss or bad news. That's a judgment call staff should be trained to make, and it isn't gating as long as you're not selecting on expected sentiment. A practical way to handle it: let clinicians flag an encounter as "no outreach" in the EHR, and have the messaging platform respect the flag.

Make it easy

• Send a text or email with a direct link to your Google review form or a directory profile.
• Keep the wording short and neutral: "Thank you for visiting us. If you'd like to share feedback about your experience, you can leave a review here."
• Put a short link or QR code at checkout.

Confirm that your messaging vendor will sign a business associate agreement (BAA) if messages are triggered by appointment data. Even a review request can reveal that someone is a patient of an OB/GYN.

Don't incentivize

No gift cards, raffles or discounts for reviews. Major platforms prohibit incentivized reviews, and the FTC rule addresses incentives conditioned on sentiment. Staff shouldn't review their own practice, and nobody should post reviews on a patient's behalf.

Automate it

A review request that depends on someone remembering will fade within a month. Build it into the patient messaging platform or the checkout script, and look at the numbers monthly.

What makes a response HIPAA-compliant

Under the HIPAA Privacy Rule, confirming that someone received care from your practice is itself a disclosure of protected health information. That holds even when the patient has already posted publicly about their own care. Patients can share their information; you can't share it for them without authorization.

HHS's Office for Civil Rights has taken enforcement action against providers whose review responses disclosed patient information. The rule to train on:

Don't confirm, deny or discuss anything about the reviewer's care, visit, condition or relationship to the practice.

Responses that get practices in trouble

• "We're sorry you had to wait for your ultrasound."
• "Our records show you missed two appointments."
• "Dr. Smith spent 30 minutes with you explaining your results."
• "We'd be happy to talk with you about your delivery."

Each one confirms a patient relationship, and most add clinical detail. The instinct to correct the record is understandable, especially when a review is unfair. It's also exactly how these complaints start.

Safer templates

Positive review:

Thank you for taking the time to share your feedback. We appreciate it.

Negative review:

We take all feedback seriously and want everyone who contacts our office to have a good experience. Because of privacy laws, we can't discuss any individual's care online. Please call our practice manager at [main number] so we can talk directly.

Wait times or billing, where the reviewer is clearly a patient:

We're always working to improve how our office runs. Privacy rules prevent us from responding to specific situations here, but our practice manager would welcome a call at [main number].

None of these say "your visit," "your care" or "as our patient." That's the whole trick.

Do you have to respond to every review?

No. Many practices respond to all negative reviews with a template and to a portion of positive ones. Consistency matters more than volume. What you should never do is argue, correct the record with clinical details, or threaten legal action in a public reply.

Fake, abusive or off-topic reviews

Platforms let you flag reviews that violate their content policies: spam, hate speech, reviews of a different business, or posts from someone who was never a customer. Use the official flagging process. Don't ask patients or staff to report reviews en masse, and don't reply in a way that reveals whether the reviewer was a patient.

The FTC rule also targets businesses that use unfounded legal threats or intimidation to get negative reviews removed. Talk to counsel before any legal step.

Who owns reviews in the practice

Give one person ownership, usually the practice manager or a marketing coordinator, along with:

• Access to Google Business Profile and key directory accounts
• Approved response templates
• A clear escalation path to the physician owner or compliance officer for serious complaints
• A monthly report: new reviews, average rating, response rate and recurring themes

The themes are where the operational value is. If reviews keep mentioning phone hold times, the fix is in the front office, not in marketing. Our piece on front-desk phone conversion covers that side, and reducing no-shows touches the same reminder systems.

Staff training checklist

• Never confirm a patient relationship online.
• Use only approved templates.
• Don't engage reviewers through social media DMs.
• Move conversations to a phone call or the patient portal.
• Log serious complaints in your internal grievance process.
• Refresh training whenever new front-office or marketing staff start, alongside your broader HIPAA-compliant marketing basics.

Claim your free listing

Directory profiles give satisfied patients another place to find you and give prospective patients more context. Claim your free listing to keep your practice details accurate across New York, and check how your practice appears in search for your county. For extra visibility in your area, featured placement is available at /advertise/.

Frequently asked questions

Sources

• HHS Office for Civil Rights — HIPAA Privacy Rule
• Federal Trade Commission — Trade Regulation Rule on the Use of Consumer Reviews and Testimonials
• Google — Prohibited and restricted content policy for reviews

This article is for general education and is not medical advice. It does not replace an evaluation by a licensed clinician who knows your history. If you think you have a medical emergency, call 911.