The one rule that trumps everything: never reveal PHI
For any healthcare practice, a public reply must never confirm that the person was a patient or mention any treatment, diagnosis, visit, or payment detail — even if the reviewer already did. Acknowledging "we're sorry your crown didn't fit" confirms a treatment relationship and is a HIPAA disclosure. This single mistake is the most common (and expensive) one practices make.
The 4-part framework
- Thank & acknowledge. Open by thanking them for the feedback and acknowledging their frustration — generically. ("Thank you for sharing this, and we're sorry your experience fell short.")
- Don't get specific. Resist the urge to defend or explain clinical details. You can speak to your general standards ("respecting your time is a priority for us") without confirming anything about this person.
- Move it offline. Invite them to a private channel — phone or email — so you can actually resolve it. ("Please reach us at … so we can make this right.")
- Sign off warmly. Keep the door open. Future readers should see a practice that cares.
What NOT to do
- ❌ Confirm the visit or treatment ("when you came in for your filling…").
- ❌ Argue the facts publicly or call the reviewer dishonest.
- ❌ Offer free treatment in public (looks like a bribe and creates more exposure).
- ❌ Copy-paste the identical reply to every 1-star — Google and readers notice.
Example: 1-star, long wait
Review: "Waited 45 minutes past my appointment and felt rushed."
Compliant reply: "Thank you for sharing this — we're sorry your time wasn't respected, and that's not the standard we hold ourselves to. We'd genuinely like to understand what happened and make it right; please reach us directly at (555) 123-4567 so we can speak privately. — The team"
Notice it never confirms an appointment took place with this specific person, apologizes, and moves the conversation offline. That's the whole game.