Can I confirm someone is a patient if they've already said so themselves in their review?

It's safer not to. A reviewer disclosing their own information publicly doesn't extend the same protection to your practice repeating, confirming or adding detail to it in a reply — keep your response generic regardless of how much detail they've shared.

Is it a breach of patient privacy just to reply to a Google review at all?

No — a warm, generic acknowledgement that doesn't confirm any patient relationship or clinical detail is standard, safe practice. The risk comes from the content of the reply, not the act of replying itself.

What should I do if a review raises a genuine clinical safety concern rather than a service complaint?

Move it to a private conversation immediately and handle it through your practice's normal clinical governance process rather than the review reply — a public reply is the wrong forum to investigate or resolve anything clinical.

Google Reviews

How Healthcare Practices Should Respond to Google Reviews Without Breaching Patient Privacy

For a clinic, dental practice or allied health provider, even confirming that someone was a patient can expose health information a reply was never supposed to touch. Here's how to reply warmly and professionally without crossing that line.

Updated 21 July 2026 · 7 min read

Why a healthcare reply is different to any other business's

For most businesses, a review response risk is reputational — sounding defensive, unprofessional, or dismissive. For a medical, dental, psychology or allied health practice, there's a second, more serious risk: privacy. Simply replying "Thanks for coming in, John, sorry your filling wasn't comfortable" can confirm, to anyone reading the profile, that a named person is a patient of yours and what they were treated for — health information that carries stronger legal protection than an ordinary customer complaint.

That doesn't mean healthcare providers can't or shouldn't reply to reviews. It means the reply needs to be written with that risk in mind from the first draft, not edited down afterwards.

Never confirm someone is a patient — in either direction

The core rule is simple to state and easy to slip on under pressure: don't confirm or deny that the reviewer is or was a patient, regardless of whether the review is glowing or scathing. This applies even when the reviewer has already named themselves and described their treatment in detail — their choice to disclose their own information publicly doesn't extend the same freedom to the practice to confirm or add to it.

A generic reply that doesn't repeat their name, their condition, or any detail of their treatment protects the practice regardless of how much detail the reviewer themselves included.

What a safe reply actually looks like

A short, warm, non-specific acknowledgement does the job without adding risk:

"Thank you for taking the time to share this — we really appreciate the feedback and are glad we could help." (a positive review, with no confirmation of any specific visit or condition)
"We're sorry to hear you had this experience. We'd welcome the chance to understand what happened — please contact our practice manager directly so we can look into it properly." (a negative review, moved to a private channel without confirming anything)
Notice neither reply repeats the reviewer's name back, references what they said they were treated for, or confirms any detail about their visit — even where the reviewer volunteered it themselves.

Take it offline properly — and say so in the reply

Inviting a patient to follow up privately is good practice for any business, but for a health provider it's close to mandatory once a review raises anything specific — a clinical concern, a billing dispute, a complaint about a particular practitioner. Direct them to a named contact point, such as a practice manager or patient liaison line, rather than a generic email address, and keep the public reply itself free of any detail that belongs in that private conversation.

If a review raises something that looks like a genuine clinical safety concern rather than a service complaint, that's a matter for your practice's usual clinical governance and, where relevant, your regulatory body's process — not something to resolve through a review reply.

What to leave out, always

A few categories of detail should never appear in a public reply from a healthcare business, no matter how the reviewer phrased their own comment:

Any diagnosis, treatment, medication, or clinical detail, confirmed or denied.
Appointment dates, times, or how often someone has visited.
Billing specifics — what someone was charged, whether they disputed it, or the outcome of that dispute.
Anything that could help a third party work out who the reviewer is, beyond what they've already disclosed themselves.

Train whoever writes the replies

In many practices, review replies are written by whoever has a spare few minutes — a receptionist, a practice manager, sometimes a practitioner directly. Whoever it is needs a short, standing brief: a couple of approved reply templates for positive and negative reviews, an explicit instruction never to confirm patient status, and a clear escalation path — to the practice manager or principal — for anything that looks clinically sensitive or legally risky rather than routine.

This is worth writing down once as a simple internal policy, rather than relying on whoever's on the desk that day to independently make the same judgment call correctly.