Staff guidance: replying to reviews as a health brand

What staff may and may not say in a public reply, and when to hand a review up the line.

Why this matters

A public reply that confirms someone is a patient, or mentions their treatment, can disclose protected health information. It does not matter that the patient shared it first.
In 2023 the HHS Office for Civil Rights settled with a provider for $30,000 after it disclosed patient information in replies to negative online reviews. Source: U.S. Department of Health and Human Services, "OCR agreement with a provider that disclosed patient information in response to negative online reviews", https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/agreements/manasa/index.html

Never, in a public reply

- Confirm or deny that the writer is a patient, a customer or has an account.
- Mention a treatment, a prescription, a condition, an appointment or an order.
- Name a staff member, or repeat anything the review says about one.
- Argue about what happened, or correct the writer's account of it.
- Offer anything in exchange for changing or removing the review.

Always

- Thank them for the feedback, in general terms.
- Talk about your process, not about them: "If you have an account with us, our team can look into it."
- Offer a private route: the contact page or the support email, never a personal number.
- Use an approved template, and have a second person read any reply you change.

Hand it up the line when

- The review contains a threat: tell your manager at once. Safety comes before any reply.
- It names or describes a staff member: tell your manager the same day, and tell the person named.
- It accuses the business of a crime or says it will take legal action: do not reply. Pass it to the owner, who decides whether counsel sees it.
- A journalist, regulator or lawyer gets in touch about a review: do not reply. Pass it to the owner.
- You think it breaks a platform rule: note which one and pass it to whoever files reports. Do not report from a personal account.

From Remove One Star, https://www.removeonestar.com/resources/templates. Free to use and adapt.