Can a medical practice respond to Google reviews without violating HIPAA?

Short answer

Yes, but only if you never acknowledge that the reviewer is a patient or reveal any health information. Even confirming someone was seen at your practice can be a HIPAA violation. Keep replies generic and move specifics offline.

Compliant replies

• Never reference visits, treatment, diagnoses, or any patient detail publicly.
• Use neutral, non-confirming language and thank people for feedback in general terms.
• Invite direct contact through a private, HIPAA-compliant channel for anything specific.

Practices have been fined for defending their care publicly with patient details. The safe pattern is a warm, information-free reply plus a private follow-up — which is exactly how careful automation is configured for healthcare.