Asking patients for Google reviews: wording you can copy, and what HIPAA, Google and your ethics code rule out

If you have held back from asking patients for Google reviews because of HIPAA, the request is the easy part: Google explicitly allows it, with a few conditions. The part that has cost practices money is what they wrote back.

What Google allows, and what it does not

Google's policy for Maps reviews says a business may "solicit or encourage the posting of content that does represent a genuine experience, without offering incentives to do so or attempting to influence the rating or the contents of the review."¹ It does not allow a business to:

• offer incentives, such as payment, discounts or free services, in exchange for a review, or for changing or removing a negative one;
• discourage or prohibit negative reviews, or "selectively solicit positive reviews from customers";
• require or pressure people to leave ratings or write reviews while on the premises;
• ask for specific content, including content that names a staff member, or ask staff to collect a certain number of reviews.¹

The FTC's rule on consumer reviews, in force since 21 October 2024, is narrower: it bans incentives that depend on the review being positive or negative, and the FTC says asking only satisfied customers "could violate the FTC Act" even though the rule does not name it.² For Google reviews, Google's policy is the stricter of the two, so it is the one to follow.

One check worth doing today: some review tools ask the patient to rate the visit first and send only the high ratings on to Google. That is the selective asking Google rules out. If your tool does it, switch that step off.

Where HIPAA comes in

The reply

A California dental practice paid $23,000 to settle an HHS investigation into disclosures of patients' information in its responses to online reviews, a practice HHS called "illegal under HIPAA."³ A North Carolina dental practice that disclosed a patient's information in reply to a negative review was given a $50,000 civil money penalty.⁴

Under the Privacy Rule, information that identifies a person and relates to the health care they received is protected health information.⁵ A reply that names the treatment, the visit or the bill does that. Our recommendation goes a step further: do not even thank a reviewer "for coming in", because that alone tells the public they are your patient.

The list you send requests from

Your patients' names, numbers and email addresses identify them and come from their care, so the list is protected health information too.⁵ Sending requests from your own practice software keeps the list where it already is. A review company that sends them for you is handling that information on your behalf, which is what HHS describes as a business associate,⁶ so it needs a business associate agreement before it gets the list.

Putting reviews on your own website

A review a patient posts on Google is theirs. Copying it onto your website or into an ad is different. When HHS settled with a group of care facilities in September 2025 over patient "success stories" on their websites, the director of its Office for Civil Rights said: "Generally, a valid, written HIPAA authorization from an individual is necessary before a covered entity or business associate can post that individual's PHI in a website testimonial or through a social media campaign." The settlement was $182,000.⁷

If you are a therapist

Three codes say much the same thing:

• Psychologists: "Psychologists do not solicit testimonials from current therapy clients/patients or other persons who because of their particular circumstances are vulnerable to undue influence." (APA Ethics Code, 5.05)⁸
• Marriage and family therapists: therapists "do not solicit testimonials or endorsements from current clients or from other persons who are vulnerable to undue influence." (AAMFT Code of Ethics, effective 1 January 2026, 9.2)⁹
• Social workers: no "solicitation of testimonial endorsements … from current clients or from other people who, because of their particular circumstances, are vulnerable to undue influence." (NASW Code of Ethics, 4.07(b))¹⁰

None of the three says whether an online review counts as a testimonial. Our suggestion: treat it as one. Put your Google review link on your website, where anyone can find it, and do not send review requests to clients. You will get fewer reviews, and you stay clearly inside the code. What the same codes say about fees is in our late-cancellation policy article.

Wording you can copy

For medical and dental practices, and for therapists only where your code allows it. Send the same request to every patient after a visit, not just to the ones the front desk thinks went well.

Avoid "If you loved your visit, please leave us a review." It asks only the happy patients, which is the selective asking Google's policy rules out. If you also send the request by text, send it only to patients who have agreed to texts from your practice, and stop when they reply STOP, as we describe in our appointment reminders article.

What can run by itself

• The request, sent from your practice software to every patient the day after a visit, once per patient, with no filter on how the visit went.
• An alert to the practice manager when a new review appears, so a negative one is seen the same day.
• Draft replies in the neutral wording above, waiting for a person to approve them.

The request fits alongside the other messages a front desk already sends, as in our front-desk automation guide and our no-show messages.

What stays with your team

• Every reply. A person approves each one before it is posted, and nobody replies in anger.
• The phone call. The unhappy patient who calls the practice manager deserves a real conversation, in private.
• Whether to ask at all. For a therapy practice, that is a decision for the clinician and their code, not for software.

More of what we write for practices is on the blog.

Questions practices ask