Ask every patient for a review the same way, soon after their visit, with a one-tap link — and offer nothing in return. Google prohibits incentives and asking only happy patients; the FTC's review rule bans fake, bought and suppressed reviews; and HIPAA means your replies must never confirm that someone is a patient or mention their care.
By Viktoria Mols, CMO · Published October 30, 2026 · 12 min read
Two practices sit a mile apart on the map. One has 23 Google reviews, the most recent from eight months ago. The other has 310, with three from this week. A family that has just moved to the area reads both profiles on a phone in the evening — and calls one of them in the morning. It is rarely the one with 23.
Most practices with too few reviews don't have unhappy patients. They have no routine for asking. This guide sets one up, explains the rules that decide which kinds of asking are allowed — Google's policy, the FTC's rule on reviews, and HIPAA for the replies — and gives scripts for the request and for every kind of reply.
General information, not legal advice. Policies change; check the current versions linked below.
Google's policy for Maps reviews prohibits offering incentives — discounts, free services, gifts — in exchange for reviews, for changing reviews or for removing negative ones. It also prohibits discouraging negative reviews, selectively asking only customers you expect to be happy, and setting review quotas for staff (Google's policy on prohibited and restricted content). Profiles that break these rules can lose reviews and be restricted from receiving new ones. What Google does allow — and encourages — is asking for honest reviews that reflect real experiences (Google Business Profile: tips to get more reviews).
One practical consequence: "review gating," where a survey asks patients how they felt and only sends the happy ones on to Google, is exactly the selective solicitation the policy forbids.
Since October 21, 2024, the FTC's Rule on the Use of Consumer Reviews and Testimonials has been federal law (FTC Rule on the Use of Consumer Reviews and Testimonials (16 CFR Part 465)). Among other things it prohibits businesses from writing, buying or knowingly spreading fake reviews; from offering incentives conditioned on a review being positive (or negative); from undisclosed reviews by owners, managers or employees and their relatives (Google goes further and doesn't accept them at all); and from suppressing reviews through unfounded legal threats, intimidation or false accusations. The FTC can seek civil penalties from knowing violators (FTC's questions and answers on the rule).
Asking for reviews raises no HIPAA issue on its own. Replying to them can. Confirming that a reviewer is your patient, or mentioning their treatment, discloses protected health information — even if the reviewer described it first. HHS has settled with dental practices over exactly this: New Vision Dental in California paid $23,000 after disclosing patient information in responses to online reviews (HHS: New Vision Dental settlement), and Elite Dental Associates in Dallas paid $10,000 over the same kind of Yelp replies (HHS: Elite Dental Associates settlement).
The rule that keeps you safe with Google is also the rule that gets results: ask every patient, the same way, at the same moment. No judgment about who might be happy, no special treatment for the patients who chatted at the desk.
Thanks for coming in today. We'll text you a short link afterwards — if you have a minute, an honest review on Google really helps other families find us.
[Practice]: Thanks for visiting us today, [First name]. If you have a moment, we'd value your honest review: [link]. Reply STOP to opt out.
[Consultorio]: Gracias por su visita de hoy, [Nombre]. Si tiene un momento, nos ayudaría mucho su opinión sincera: [enlace]. Responda STOP para salir.
Notice what these don't say: "five stars," "if you were happy," "we'd love a great review." Asking for a particular rating is the line both Google and the FTC draw.
Reply to every review, positive and negative, within a couple of business days. Readers look at the replies as much as the stars. The HIPAA-safe pattern is the same for both: thank the reviewer, speak in general terms about the practice, and never confirm that the person is a patient or refer to any visit, treatment or bill.
Thank you for taking the time to write this — it means a lot to our whole team. We're glad to hear it.
Thank you for sharing this. We take every concern seriously and would like to understand what happened. Please call our office manager, [Name], at [number] so we can talk directly.
Gracias por compartir su opinión. Tomamos cada inquietud en serio y queremos entender lo que pasó. Por favor, llame a [Nombre], nuestra gerente, al [número] para hablar directamente.
Thank you for your feedback. We're not able to discuss any individual in a public forum, but we'd welcome a call at [number] so we can look into this.
Things to leave out of every reply, however tempting: "we checked your chart," "you were here on Tuesday," "as we explained during your treatment," "your balance," and anything that suggests the review is unfair because of something the person did. Take the conversation offline.
Some reviews aren't from patients at all, or break Google's policies — spam, conflicts of interest, off-topic rants, personal information. Report them through your Business Profile; Google reviews reports against its policy. Don't reply with accusations, don't contact the reviewer with legal threats, and don't offer anything to have a review removed: under the FTC rule, unfounded threats and intimidation to suppress reviews are themselves prohibited.
A negative review that is genuine but unfair is still best handled with the calm reply above. A good response under a bad review often persuades the next reader more than another five-star review would.
Everything above is about Google. Yelp takes a stricter line: its guidance to businesses is not to ask customers for Yelp reviews at all, and its software may not recommend reviews it believes were solicited (Yelp, "Don't Ask for Reviews"). The practical approach: point your review requests to Google, add a "find us on Yelp" mention where patients would see it anyway, and reply to Yelp reviews with the same HIPAA-safe templates.
If a patient writes a review in Spanish, reply in Spanish. It tells every Spanish-speaking reader that someone at the practice will understand them on the phone — which is often the deciding question for a family choosing a dentist. Keep the same rules: thank, stay general, invite a call. And send your review request in the language the patient uses with you; a request they can't comfortably read is a request they ignore.
¡Muchas gracias por tomarse el tiempo de escribirnos! Su comentario significa mucho para todo nuestro equipo.
Reviews sit inside a Google Business Profile that does a lot of quiet work before anyone calls. A few things worth checking while you're there:
The practices with hundreds of reviews almost never ran a campaign. They built the request into checkout and left it there. Who sends it matters less than that it always goes out — the same message, to everyone, every day. Many practice management and patient communication systems can send it automatically after a completed appointment; check that yours sends to every patient rather than filtering by a satisfaction score first.
A practice's reviews start before the visit — with whether anyone answered the phone. What happens to the calls that don't get answered is walked through in a day of calls at a dental office, and what HIPAA allows on the phone itself is in HIPAA on the phone.
Not for Google reviews. Google's policy prohibits any incentive — discounts, free services, gifts — for a review. The FTC's rule is narrower: it bans incentives conditioned on a review saying something positive (or negative). Following Google's rule keeps you within both: ask for honest reviews and offer nothing.
No. Google prohibits selectively soliciting positive reviews, which includes surveys that send only satisfied patients on to Google. Ask every patient the same way.
Yes, but the reply must not confirm that the reviewer is a patient or mention any treatment, visit or bill — even if the reviewer did. Thank them, speak generally and invite them to call. HHS has settled with dental practices that disclosed patient information in review replies.
No. The FTC's rule prohibits undisclosed reviews by owners, employees and their relatives, and Google's policy goes further: it treats reviews from people with a conflict of interest as a violation even if they are disclosed. Don't ask them to.
Report it from your Business Profile as a policy violation. Don't threaten the reviewer or offer anything for removal; unfounded threats to suppress reviews are prohibited under the FTC rule.
Create an account free — no card — build your receptionist, and hear it handle a call on the spot. Your own number activates when you start a plan.