Should a practice use AI to reply to online reviews?

A one-star review lands at nine at night, and it is unfair. The owner wants to set the record straight, and an AI tool will happily write a reply that does exactly that. The trouble is that setting the record straight usually means talking about the patient’s care, and HHS has fined practices for precisely that.

Can a practice get in trouble for replying to an online review?

Yes. HHS’s Office for Civil Rights has taken action against practices whose replies to reviews disclosed patient information. In 2023, Manasa Health Center in New Jersey agreed to pay $30,000 after HHS found it disclosed the protected health information of four patients in response to their negative Google reviews. The agreement also required new policies and staff training.

It is not a one-off. Dental practices in particular have shown up in these cases again and again, and the amounts are large for a small practice even before counting the corrective action plan that comes with them.

Look at what HHS acted on in the Manasa case. The reviews were negative Google reviews, and it was the practice’s replies to four of them that became the violation. The reviews themselves were never the problem. A calm reply that said nothing about the patient would have cost the practice nothing, and an AI tool can produce that reply in seconds if you tell it to.

What makes a review reply a HIPAA problem?

Anything that confirms the reviewer is a patient or says something about their care. HHS said of the New Vision Dental case that using social media to respond to reviews in a way that discloses protected health information is illegal under HIPAA. Even a reply that says “we have no record of you” gives something away about the people you do have records of.

The patient choosing to post about their own visit does not change your side of it. They can say what they like about themselves. The practice still cannot disclose their information without authorization, and a public reply is a disclosure to everyone who reads it.

Can AI write review replies safely?

It can draft them safely if you set it up so it never sees patient details and never posts on its own. Give it the review text only, plus your rules: no confirming the person is a patient, no mention of treatment, dates or billing, and an invitation to call the office manager. A person reads every draft before it goes up.

The risk with AI here is specific. Asked to write a helpful, detailed reply, a model will try to be helpful and detailed. If a staff member pastes in the chart note “for context,” the draft may use it. And a tool connected to post directly removes the one person who would have caught it. Both are setup choices, which means both are yours to get right.

There is a quieter benefit too. A drafted reply takes the heat out of the moment. The owner who would have typed an angry answer at nine at night reads a calm draft instead, approves it, and has the real conversation by phone the next morning, where it belongs and where nobody else is reading.

What should a safe review reply say?

Less than you want it to. Thank the person for the feedback, say the practice takes concerns seriously, and give a name and a phone number to call. Do not confirm or deny they were seen, do not correct their account of the visit, and do not mention insurance, billing or treatment. The same short reply works for five stars and for one.

• Safe: “Thank you for taking the time to write. We take every concern seriously and would like to talk with you directly. Please call our office manager, Dana, at the number on our website.”
• Unsafe: “We’re sorry you were unhappy with your crown, but as we explained at your visit, your insurance didn’t cover it.” That reply confirms the person is a patient, names a treatment and discusses coverage.
• Unsafe: “We have no record of anyone by that name.” That still discloses something about who is and is not a patient.

Put those three examples into the tool’s instructions, labelled safe and unsafe. In my experience a drafting tool follows a worked example more reliably than a list of rules, and the unsafe ones show it exactly which kind of helpful detail to leave out.

How do you set up AI review replies without risk?

Write the rules first, then the prompt. A one-page review policy covers who approves replies, what a reply may and may not say, and when a review goes to the owner instead. The AI tool gets only the review text and that policy. The approved reply gets posted by a person, and a copy is kept.

1. Write the review policy and a short list of approved reply templates.
2. Configure the AI tool to use only the review text. No chart access, no patient lookup.
3. Have a named person approve every reply before it posts, with no auto-posting.
4. Send any review that alleges harm or mentions a legal threat to the owner and your compliance lead instead of replying.
5. Train staff on the policy, and add it to the practice’s HIPAA training record.

Replying to reviews still matters for how you show up when patients ask an assistant about you, and I have written about that separately. A calm, short, identical reply to every review does that job fine. It does not need to win the argument.