How to Ask Patients for Reviews (and Answer the Bad Ones)

A practice's reviews get read twice as carefully as its website, and written far less carefully than either. Most teams handle them backwards: nobody asks the happy patients, and then somebody with admin access answers an angry review at 9pm and creates a federal privacy problem on top of a reputation one. This guide covers both halves — the words that get more reviews, and the replies that won't cost you $30,000 — plus the part no reviews guide mentions: the conversation that wrote the bad review in the first place.

Why reviews decide who gets the call

Patients pick from the listing before they ever see the lobby. In a survey cited by Cooper (2018) in *Clinical Orthopaedics and Related Research*, 59% of patients called physician rating sites important when choosing a new doctor — and that was 2012, before reviews swallowed local search. The review column is now part of patient experience whether a practice manages it or not. The only choice is whether it's managed on purpose.

The rules before the tactics

Two bodies of law sit on top of this topic, and both changed the game recently enough that most advice online predates them.

What you can't offer

Since October 21, 2024, the FTC's rule on consumer reviews and testimonials (16 CFR Part 465) bans providing compensation or incentives conditioned on a review expressing a particular sentiment — positive or negative. "Leave us a five-star review for a gift card" is now a federal violation, not a growth hack. The rule also targets review suppression: threatening or intimidating people to take reviews down. You can still ask everyone, reward no one, and let the reviews land as they land.

What you can't say

HIPAA doesn't stop at the clinic door. A public reply that includes anything about a person's care — their diagnosis, their visit, even the fact that they showed up — is a disclosure of protected health information. That's the trap in responding while angry: the review already named details, so confirming them feels harmless. It isn't, and the enforcement section below shows what it costs.

How to ask patients for reviews

Ask at the end of a good visit, in person, from the person the patient actually dealt with — then send the link immediately by text or email so the review is two taps away. Ask everyone the same way, attach no reward, and make it easy. That's the entire method; everything else is wording.

The moment and the messenger

The best ask follows a visibly good interaction: the hygienist the patient laughed with, the front-desk coordinator who fixed the billing mix-up. Not the doctor rushing to the next room, and not a card in a bag. If the moment was bad, don't ask — fix it first, then maybe ask next visit.

The words (in person)

Say: "If today went well, would you mind leaving us a review? It genuinely helps other patients find us — I can text you the link right now."

After fixing a problem: "I'm glad we could sort that out. If you ever have a minute, a review means a lot to a practice our size."

The follow-up (text and email)

Text, same day: "Thank you for visiting [Practice] today! If you have a minute, we'd be grateful for a quick review: [link]. It helps other patients find us. — [First name]"

Email, next morning — subject "One quick favor?": "Hi [Name], thanks for coming in yesterday. If you were happy with your visit, would you leave us a short review? It takes about a minute: [link]. If anything wasn't right, reply to this email instead — I read every one. — [Manager], [Practice]"

That last line matters: it gives unhappy patients a private path, honestly offered. What it must never become is a filter that routes only happy patients to Google — asking selectively based on predicted sentiment is review gating, and it's exactly the behavior the FTC rule and the platforms' own policies exist to catch.

How to respond to negative patient reviews without a HIPAA violation

Respond once, publicly, generically: thank them, say privacy law prevents discussing anyone's care, and move the conversation to a phone number. Never confirm the reviewer was a patient, never mention their visit, and never explain your side of the clinical story — no matter what details they posted first.

The enforcement is real. In June 2023, the HHS Office for Civil Rights settled with Manasa Health Center, a New Jersey psychiatric practice, for $30,000 after it answered negative Google reviews with patients' diagnosis and treatment information — four patients in all, plus a corrective action plan with two years of monitoring. And the violation starts earlier than most people think: replying "we're sorry your appointment ran late" confirms the reviewer was your patient — that confirmation is itself the disclosure.

The reply that works in public

Any complaint: "Thank you for taking the time to share this. We take feedback seriously, but federal privacy law doesn't allow us to discuss anyone's care — or confirm whether someone has been our patient — in a public reply. Please call [Name] at [number]; we'd like to understand what happened and make it right."

A service complaint (wait, phones, front desk): "We're sorry to read about a frustrating experience. We're always working on wait times and communication, and we'd genuinely like the details — privacy rules keep us from discussing anything specific here, so please reach [Name] at [number]."

Notice what both do: they answer the real audience — future patients reading how you handle criticism while giving the reviewer a private door. One reply, then stop. Reply threads are where settlements come from.

Different complaints need different wording — a billing dispute reads differently from an accusation about a staff member. The builder below covers the four situations the templates above don't:

When the review is fake or crosses a line

Some reviews aren't feedback: a competitor, an ex-employee, someone who confused you with the clinic next door. Flag those through the platform's reporting flow under its content policies — impersonation, conflict of interest, off-topic rants — and know that removal is slow and refusal is common. Meanwhile the same reply rules apply, because HIPAA doesn't care whether the review is fair: even "this person was never seen here" is a statement about who is and isn't your patient. If a review is defamatory enough to involve lawyers, involve lawyers — quietly, not in the reply box.

The part reviews can't fix: the conversation that wrote them

Read your own one-star reviews and a pattern shows up fast. They're rarely about clinical outcomes. They're transcripts: the 50-minute wait nobody explained, the bill that surprised someone at the desk, the front-desk exchange that read as dismissive on a hard day. The review is where the conversation went after it failed in the room.

That makes reviews a training signal, not just a marketing chore. The three conversations that generate most of them are all practicable: the angry patient at the desk, the copay and billing conversation, and service recovery — owning and fixing the office's mistake before the patient reaches for their phone. Teams build these skills the way they build any skill: with structured customer-service training and repetitions — some practices now rehearse them against AI roleplay so the first angry patient of the day isn't the practice run. For front-desk teams specifically, the patient access scenarios map almost one-to-one onto the complaints that end up in reviews.

Ask for reviews and you'll raise the average. Fix the three conversations and you'll change what gets written.