Med Spa Reviews and HIPAA: How to Reply Safely

A med spa can reply to every Google review. The reply just can’t confirm the reviewer was a patient or reference their care. Here’s the trap: a five-star review names the injector, the treatment, and how happy they are. The natural reply (“Thank you! So glad you loved your results!”) has just confirmed, in public, that this named person is a patient of a medical practice.

That confirmation is the problem. U.S. regulators have reached settlements with practices over exactly this: review replies and social posts that disclosed patient information, sometimes while defending the practice.

The rule underneath the caution

For a covered practice, protected health information includes the fact that someone is a patient at all. The reviewer talking about their own care is their right. It doesn’t extend to you. The line is simple: the reply may describe your practice in general. It may not describe them.

Replies that hold the line

The pattern that works, positive or negative:

Thank them, without confirming. “Thank you for the kind words,” not “we loved seeing you for your filler appointment.”
Speak in general terms about the practice. “Our providers take consultation time seriously” is safe. “Your consultation” is not.
Take substance offline. For complaints: “We take feedback seriously. Please call us directly so we can discuss.” No details, no rebuttal, no timeline of their visits.
Never argue the clinical facts. A public correction that cites what happened during a visit is the most expensive kind of reply there is.

Yes, it’s maddening. An unfair review sits there and the accurate rebuttal is the one thing you can’t post. But the next reader isn’t scoring the dispute. They’re reading your reply as a sample of how you treat people, and a calm, general reply wins that.

Make it a system, not a judgment call

The mistake usually happens at 9pm, from a phone, right after reading something unfair. The fix is deciding the wording before that moment: standing reply patterns, reviewed once by your compliance counsel, used every time. (Reply templates by situation, and the profile setup for med spas.)

The short version

Reply to every review. Disclose nothing, including the fact of being a patient. General warmth, specifics offline, templates decided in advance.

Answering reviews inside those lines is standing work we handle: every review, within one business day, in wording that never references a visit. See local SEO for med spas, or request a free game plan.

Common questions

Can a med spa reply to Google reviews under HIPAA?

Yes. Replying is allowed and worth doing. What a covered practice cannot do is disclose protected health information in the reply, and confirming that the reviewer was a patient can itself be a disclosure. The standard approach is to reply in general terms about the practice, without referencing the person's visit, treatment, or history, even when the reviewer described all three themselves.

What should a med spa say when replying to a negative review?

Thank the reviewer, state the practice's general standards, and invite the conversation offline, without confirming they were seen at the practice or discussing any specifics. The urge to correct the record with details is exactly the urge that creates a disclosure. What the reply loses in rebuttal it keeps in professionalism, which is what the next reader is judging.

Does it matter that the reviewer shared their own treatment details publicly?

The reviewer can say whatever they like about their own care. It's their information to share. The practice's obligations don't loosen because the patient spoke first. A reply should still avoid confirming the relationship or adding any detail. Run the wording of your standing reply templates past compliance counsel once, so every future reply starts from safe ground.

Everything in this guide, done for you.

Start with a free rank check + game plan: exactly where you sit on Google today, what's quietly costing you calls, and what it takes to own your map. No cost, no card, no pitch-slapping. If you want it handled: from $697/mo plus a one-time $1,500 setup, month to month with 30 days' notice. Every deliverable in writing. Never a ranking promise.

Get my free game plan →

Every deliverable named on the card · Or call Calvern: (512) 537-4481