Dental Practice Reputation Management: HIPAA-Safe 2026 Playbook

I am Perves. I run enterprise accounts at BGR Review and I have built reputation programmes for 240+ dental practices - solo GPs, DSOs with 60 locations, orthodontic groups, and two implant-focused specialty practices. Dental is the vertical where a single unanswered 1-star can cost you 15,000 dollars in lifetime patient value. This is the playbook we use to move ratings from 3.9 to 4.8+ without ever touching HIPAA.

Why dental reputation is different

Three constraints separate dentistry from general local business. First, patients are anxious before they arrive - a bad review confirms their fear, and 68% of prospective patients will not book a first appointment with a practice under 4.0 stars (SoftwareAdvice 2026 dental patient survey, n=1,200). Second, the response is HIPAA-regulated: 45 CFR 164.502 prohibits disclosure of protected health information, and simply confirming "yes, this person was our patient" is a disclosure. Third, dental purchases are high-consideration and often out-of-pocket - implants, veneers, and Invisalign run 3,000 to 40,000 dollars, so patients read every review carefully before scheduling a consult.

The platform priority stack

1. Google Business Profile. Highest volume, feeds the local pack for "dentist near me" queries, and now feeds AI Overviews. Every office needs its own claimed profile with a unique local phone number.
2. Healthgrades. The default second-opinion source for insured patients. Weighs heavily in "best dentist [city]" queries.
3. Yelp. Still significant in urban markets - especially LA, NYC, SF, Chicago. Under-indexed in the south and midwest.
4. Vitals, RateMDs, Zocdoc. Fill the second page of a dentist's name search. Zocdoc drives direct bookings; the others drive research.
5. Instagram and TikTok. Not review platforms but reputation surfaces. Before-and-after content is the primary conversion driver for cosmetic and orthodontic cases.

What HIPAA actually restricts in review responses

• Confirming a treatment relationship is PHI disclosure. "Thank you for choosing us for your cleaning" confirms the person was a patient - HIPAA violation regardless of whether they identified themselves first.
• Referencing treatment details is a bigger disclosure. "We understand your concerns about the crown" mentions both the relationship and the specific procedure. Two violations in one sentence.
• Even a positive response can breach. "So glad we could brighten your smile" confirms cosmetic treatment.

The Office for Civil Rights (OCR) has fined multiple practices for review responses that confirmed care. A 2022 OCR settlement with a New York dental practice ended in 30,000 dollars in penalties and a two-year corrective action plan - triggered by a single response that named the patient's procedure.

Response templates that pass HIPAA review

Negative review, no clinical details revealed

Thank you for taking the time to share your feedback. We take every patient experience seriously, and we would welcome the opportunity to speak with you directly. Please contact our office manager, [Name], at [phone] and we will address your concerns.

Negative review with clinical details disclosed by reviewer

Thank you for the feedback. Out of respect for patient privacy obligations under HIPAA, we cannot discuss any specific matter in a public forum. Please contact [Name] at [phone] and we will address your concerns.

Positive review

Thank you for the kind words. It means a great deal to our team.

Review from someone who was not a patient

Thank you for the feedback. We do not appear to have a record of a visit. Please contact [Name] at [phone] and we will look into this.

Asking for reviews the HIPAA-safe way

1. Trigger the review request through a HIPAA-compliant platform. Weave, Podium, NexHealth, and Birdeye Dental sign a Business Associate Agreement (BAA) - text-message tools without a BAA violate HIPAA when they carry patient identifiers.
2. Send the request within 24 hours of the visit. Two-hour follow-up converts at 34%; 24-hour at 22%; 72-hour at 8% (Patient Prism 2025).
3. Ask on a specific platform. Do not send to a "pick your platform" landing page - concentration prevents Google's spam filter from suppressing the burst.
4. Never ask patients who complained. Some states now flag "review gating" - sorting satisfied patients to public platforms and unhappy ones to private feedback - as a deceptive practice.
5. Do not offer discounts, cleanings, or raffle entries in exchange for a review. FTC Section 5 exposure plus platform violations.

What to flag and how

Google Business Profile

• Personal information. Reviews revealing patient names, medical conditions, or the dentist's home address.
• Off-topic. Complaints about insurance denials, third-party financing, or lab work the practice did not perform.
• Conflict of interest. Reviews from ex-staff, competing practices, or former partners.
• Spam and fake content. Identical wording across multiple practices, out-of-area IPs, brand-new accounts.
• Harassment. Threats, personal attacks, discriminatory language.

Flag via the review's three-dot menu, then follow up with the Google Business Profile support form. Flags citing a specific policy resolve at 34% versus 11% for unspecified flags (BGR internal data, n=6,200 dental removals).

Healthgrades

Healthgrades removes reviews containing personal attacks, PHI, or off-topic complaints. Submit through the practice dashboard with a screenshot and policy citation. Resolution takes 7-21 days.

The three metrics to track weekly

• Average star rating per location. Google shows per-location, not per-practice.
• Response rate. 100% target. Missed responses hurt local pack ranking.
• Recency. Reviews in the last 30 days. Google weighs recency heavily.

Specialty-specific notes

Cosmetic and implant practices

Instagram is the second review platform. Post before-and-after content weekly. Get every cosmetic patient to consent to a before-and-after photo release - the release is a HIPAA authorisation, and without it, no posting. Practices with 200+ Instagram before-and-afters convert consult-to-treatment at 62%; practices without at 34% (Patient Prism 2025 cosmetic segment).

Orthodontics

Reviews from parents outnumber reviews from patients 4:1. Parent-focused response templates outperform patient-focused ones. Ask for the review at the debond appointment, not mid-treatment.

Pediatric dentistry

Every review discusses child behaviour management. Keep responses focused on the family experience, never on the child's specific behaviour or diagnosis - HIPAA plus common courtesy.

DSO and multi-location practices

Central marketing teams cannot HIPAA-safely respond because they do not have the patient chart. Two-tier workflow: central team drafts template, local office manager reviews and posts.

HIPAA landmines to avoid

• Never confirm a patient's identity or visit. Even if they used their real name in the review.
• Never reference specific procedures. Not implants, not veneers, not root canals, not cleanings.
• Never disclose payment or insurance information. "Your insurance denied the claim" is PHI.
• Never respond from a personal account. Always the business account.
• Never let a non-BAA marketing agency see patient identifiers. Vet every vendor's BAA before granting review dashboard access.

Frequently asked questions

Can I ask a patient to remove a bad review?

Yes, once - through the office manager, in a phone call, without offering anything of value. If they refuse, do not persist.

Should the dentist respond, or someone else?

The office manager or owner should respond on behalf of the practice. Individual clinicians responding by name deepens the disclosure issue.

Can I sue a patient for a bad review?

Possible but rare and risky. Truth is a defence, statements of opinion are protected, and most states have anti-SLAPP laws that shift attorney fees to you if you lose.

How fast should we respond?

Within 24 hours for negatives, 48 for positives. Same-day responses lift consult-scheduling by 14% (Patient Prism 2025).

What review platforms should implant and cosmetic practices prioritise?

Google first, then Instagram (before-and-after content), then RealSelf for cosmetic-specific queries.

Bottom line

Dental reputation is a HIPAA compliance discipline as much as a marketing discipline. Stack Google, Healthgrades, and Yelp, ask every patient within 24 hours through a BAA-signed platform, respond within 24 hours using templates that never confirm a treatment relationship, and flag policy-violating reviews with specific citations. Practices that follow this playbook average a 0.7 star lift in 90 days without a single OCR complaint. For reviews that violate policy but Google will not remove, our removal team handles it on a pay-after-success basis with a 30-day guarantee.