How to respond to 1-star reviews without breaking HIPAA
Most 1-star reviews on a health brand's profile will stay online, so the reply is what the next reader sees. For a covered entity, the reply is also a legal risk. This guide gives a framework that answers the complaint without confirming that anyone is a patient. We remove the 1-star reviews that break Trustpilot's rules, and this framework covers the rest.
By James Tumbucon. Published · Updated . Reviewed against Trustpilot’s guidelines on
100% risk-free. You only pay for the reviews that come down.
Short answer
Never confirm that a reviewer is a patient, and never mention a condition, a medication, a dose, a visit or a date. A safe reply has four parts: acknowledge the concern in general terms, state your policy in general terms, offer one private channel, and stop. This holds even when the patient has already shared the details. HHS has settled a case over exactly this. This guide is general information, not legal advice.
Key facts
A public reply that confirms someone is a patient, or mentions their treatment, can disclose protected health information even if the patient shared it first.
In June 2023 the HHS Office for Civil Rights settled with a provider for $30,000 after it disclosed the information of four patients in replies to negative online reviews.
A safe reply has four parts: acknowledge in general terms, state the policy in general terms, offer one private channel, stop.
Source: Remove One Star, How it works
Trustpilot removes business replies that include personal information, threats or aggressive language.
Why a reply is a HIPAA question
A review is written by the patient, who can share anything about their own care. A reply is written by you. If you are a covered entity, what you say about an identifiable person's care is a disclosure of protected health information, and it needs a legal basis. A public reply to a review does not have one.
In June 2023 the HHS Office for Civil Rights settled with a New Jersey provider for $30,000. The complaint was that the provider disclosed the protected health information of four patients in its replies to negative online reviews.
The instinct that causes this is a good one. Your team wants to set the record straight. The facts that would do that are exactly the facts you cannot post.
What never goes in a public reply
| Do not write | Why |
|---|---|
| "As our patient..." or "Thank you for being a customer" | Confirms a treatment relationship. For a brand whose name signals one condition, it also reveals the condition |
| Any date, order, visit or shipment detail | Identifies the person's care |
| A medication, dose, diagnosis or lab result | Health information |
| "Our records show you did not cancel" | Confirms the account and discloses its contents |
| The reviewer's name, if they used a nickname | Identifies them |
| "Our clinician decided..." about this person | Describes this person's care |
The four-part reply
- Acknowledge, in general terms. "We take concerns about billing seriously."
- State the policy, in general terms. "Our plans renew on the schedule shown at checkout, and cancellations can be made in the account area."
- Offer one private channel. "Please contact our support team at the address on our website so we can review this privately."
- Stop. No second paragraph, no defense, no back-and-forth in the thread.
Jordan P.
1 week ago on Trustpilot
They refused to prescribe after I paid. Total scam, I want my money back.
We are sorry, Chris. Our clinician reviewed your intake and your blood pressure readings made the medication unsafe for you, so no prescription was issued. Your visit fee is non-refundable.
Prescribing decisions are made independently by licensed clinicians, and a visit does not always lead to a prescription. Our refund policy is on our website. We cannot discuss any individual here. Please contact our support team so we can review this privately.
Replies by complaint type
| Complaint | A reply that discloses nothing |
|---|---|
| Charged after cancelling | "We want cancellations to be simple. If a cancellation did not go through, contact our support team and we will review it and apply our refund policy." |
| Refill or shipping delay | "We know waiting is stressful. Delays can come from pharmacy stock or carriers, and we post current timelines on our site. Please contact us so we can look into this privately." |
| Denied prescription | "Licensed clinicians make prescribing decisions independently, and a visit does not always lead to a prescription. We cannot discuss any individual case here. Please reach out to us directly." |
| Side effects | "We are sorry to read this. We cannot discuss health matters in public. Please contact our clinical support line, and if this is urgent, contact your doctor or emergency services." |
| Slow support | "That is not the response time we aim for. We are adding to our support team. Please contact us at the address on our site and mention this review." |
| "This company is a scam" | "We are a licensed telehealth provider, and our pharmacy partners are listed on our website. We would like to understand what happened. Please contact our support team." |
Keep the wording varied. Twenty identical replies in a row look like a bot, and readers notice. The same four parts work on Google, and our guide to replying to a 1-star Google review covers that platform.
Who replies, and when
- One owner. A single trained person or a small team writes every reply.
- Approved wording. Keep a reply library like the table above, signed off by whoever owns privacy at your company.
- No case lookup before writing. The safest reply is written without opening the account. Look up the case afterward, to fix the problem in private.
- Within a few days. Trustpilot shows readers how a business engages with reviews, including whether it replies to negative ones.
- Once. If the reviewer answers in the thread, move to the private channel and do not reply again in public.
What Trustpilot's rules add
Trustpilot encourages replies and sets limits. Its Guidelines for Businesses say replies should be polite and professional and that replies with personal information, threats or aggressive language will be removed.
Two more rules matter for health brands:
- Do not ask the reviewer to take the review down. Pressure to edit or delete is against the guidelines, and offering anything in exchange is treated as an incentive.
- Use Request information for identity questions. If you cannot match the review to a customer, Trustpilot's tool asks the reviewer for details privately. Do not ask for an order number in the public reply.
When the review should be flagged and not answered
Some reviews break Trustpilot's rules and should go through flagging:
- a review that publishes a clinician's name with a phone number or email
- a review that advertises another provider
- a review that is clearly about another company
- a review with threats or abuse aimed at staff
Our guide to what Trustpilot will and will not remove has both lists, and the telehealth page explains how to build evidence without touching the patient file.
Everything else gets a reply. The main Trustpilot review removal page explains the full process, and the free audit tells you which of your reviews fall on which side.
If you would rather hand the work over, see our Trustpilot review removal service and what each removal costs.
Frequently asked questions
No. The patient can share their own information. That does not give the provider permission to confirm or add to it in public. The HHS settlement in 2023 involved replies to reviews that patients had posted themselves. Source: HHS announcement. This is general information, not legal advice.
Reply to every review that raises a real issue, once, within a few days. Trustpilot lets every business reply for free. Do not reply to reviews you have flagged as harmful or illegal until Trustpilot has decided, because those are hidden during the check.
Offer to look into it privately, and apply the refund your policy owes. Never tie a refund to editing or deleting the review. Trustpilot treats that as an incentive, and the FTC named it in its NextMed case. Sources: Action We Take and the FTC announcement.
It can. Trustpilot's guidelines say replies should be polite and professional, and that replies with personal information, threats or aggressive language will be removed. Source: Guidelines for Businesses.
One trained person or a small team, working from approved wording, with a clinician or compliance lead available for edge cases. Support agents replying from memory of the case are the most common source of disclosures.
Primary sources used on this page
- OCR agreement with a provider that disclosed patient information in response to negative online reviews. U.S. Department of Health and Human ServicesLast verified
- Guidelines for Businesses. TrustpilotLast verified
- Action We Take. TrustpilotLast verified
- FTC Takes Action Against Telemedicine Firm NextMed (July 14, 2025). Federal Trade CommissionLast verified