Med Spa Reviews and HIPAA: How to Reply Safely

A med spa can reply to every Google review — the reply just cannot confirm the reviewer was a patient or reference their care. Consider the trap: a five-star review names their injector, their treatment, and how happy they are, and the natural reply — “Thank you! So glad you loved your results!” — has just confirmed, in public, that this named person is a patient of a medical practice.

That confirmation is the problem. U.S. regulators have reached settlements with practices over exactly this: review replies and social posts that disclosed patient information, sometimes in the course of defending the practice.

The rule underneath the caution

For a covered practice, protected health information includes the fact that someone is a patient at all. The reviewer talking about their own care is their right; it does not extend yours. The line to hold is simple to state: the reply may describe your practice in general; it may not describe them.

Replies that hold the line

The pattern that works, positive or negative:

Thank them, without confirming. “Thank you for the kind words” — not “we loved seeing you for your filler appointment.”
Speak in general terms about the practice. “Our providers take consultation time seriously” is safe; “your consultation” is not.
Take substance offline. For complaints: “We take feedback seriously — please call us directly so we can discuss.” No details, no rebuttal, no timeline of their visits.
Never argue the clinical facts. A public correction that cites what actually happened during a visit is the most expensive kind of reply there is.

The frustrating part is real: an unfair review sits there and the accurate rebuttal is the one thing you can’t post. The next reader isn’t scoring the dispute, though — they’re reading your reply as a sample of how you treat people, and a composed, general reply wins that reading.

Make it a system, not a judgment call

The mistake usually happens at 9pm, from a phone, in the heat of reading something unfair. The fix is deciding the wording before the moment arrives: standing reply patterns, reviewed once by your compliance counsel, used every time. (Reply templates by situation, and the profile setup for med spas.)

The short version

Reply to every review; disclose nothing — including the fact of being a patient. General warmth, specifics offline, templates decided in advance.

Answering reviews inside those lines is standing work we handle — every review, within one business day, in wording that never references a visit. See local SEO for med spas, or request a free game plan.

Common questions

Can a med spa reply to Google reviews under HIPAA?

Yes — replying is allowed and worth doing. What a covered practice cannot do is disclose protected health information in the reply, and confirming that the reviewer was a patient can itself be a disclosure. The standard approach is to reply in general terms about the practice's approach, without referencing the person's visit, treatment, or history, even when the reviewer described all three themselves.

What should a med spa say when replying to a negative review?

Thank the reviewer, state the practice's general standards, and invite the conversation offline — without confirming they were seen at the practice or discussing any specifics. The instinct to correct the record with details is exactly the instinct that creates a disclosure. What the reply loses in rebuttal it keeps in professionalism, which is what the next reader is actually judging.

Does it matter that the reviewer shared their own treatment details publicly?

The reviewer can say whatever they like about their own care — that is their information to share. The practice's obligations don't loosen because the patient spoke first. A reply should still avoid confirming the relationship or adding any detail, and the wording of a practice's standing reply templates is worth running past its compliance counsel once, so every future reply starts from safe ground.

Everything in this guide, done for you.

Start with a free rank check + game plan: exactly where you sit on Google today, what's quietly costing you calls, and what it takes to own your map. No cost, no card, no pitch-slapping. If you want it handled: from $349/mo plus a one-time $499 setup, three months to start then month to month. Every deliverable in writing — a month we don't deliver is free.

Get my free game plan →

Every deliverable on the card, guaranteed — or the month’s free · Or call Calvern: (512) 537-4481