In 2022 the HHS Office for Civil Rights settled with Manasa Health Center, LLC for $30,000 over four review responses that disclosed protected health information. The reviewer had publicly mentioned receiving care. The practice acknowledged that care. That acknowledgement alone — not a treatment detail, just the confirmation of patient status — was the violation.
Most healthcare practices don't know this. Most third-party review-management tools don't know this. Here's the rule, the templates, and the math.
Why HIPAA reaches review responses
HIPAA's Privacy Rule (45 CFR § 164.502) prohibits a covered entity from disclosing protected health information (PHI) without authorisation. PHI includes the fact that someone received care — not just the diagnosis or treatment.
When a patient publicly mentions in a review that they were seen at your practice, their disclosure is not your authorisation. You still cannot acknowledge the patient relationship publicly. The HHS Manasa settlement and the 2024 Anchorage Behavioral Health case both turned on exactly this issue.
The 11-word safe template
"Thank you for the feedback. We appreciate every comment as we continually improve."
That's it. 11 words. No confirmation, no reference to a visit, no procedure name. Use it for every positive review.
For negative reviews:
"We take all feedback seriously. Please call our office at [phone] to discuss."
Notice: no acknowledgement of any specific incident, no defence, no implied relationship.
Where practices most commonly cross the line
- "Glad we could help with your [procedure]!" Discloses both treatment and patient status.
- "Sorry your wait was long — we had two emergencies that morning." Discloses operational PHI of other patients.
- "Thanks for choosing us for your child's check-up!" Discloses patient status of a minor.
- "We'll see you at your follow-up next week." Confirms ongoing treatment relationship.
The legal framework non-attorneys should know
HIPAA breaches don't always require harm — the violation is the disclosure. Penalties range from $137 per violation (unknowing) to $68,928 per violation (wilful) under the 2024 inflation-adjusted tiers.
OCR can investigate based on a single complaint. Most healthcare review-related settlements have been triggered by patients reporting their own subsequent dissatisfaction with the response, not by random audits.
This is not legal advice — talk to your compliance officer. But the conservative template above protects against the most common failure modes.
Building a HIPAA-safe response system
- Train every team member who responds to reviews on the 11-word rule.
- Use a small template library — 4–5 variants of the positive template, 2–3 for negative.
- Document a review-response policy alongside your existing HIPAA policies.
- Run a quarterly audit of past responses against the rule. Edit or delete anything that crosses the line.
- For complex negative reviews, route to legal/compliance before responding publicly.
"The patient's disclosure is never your authorisation. They can mention their visit publicly; you still can't confirm it."
— Senior strategist, The Review Makers
