Responding to reviews you’re not allowed to discuss

Count the words before the violation. A med spa owner in Boise sits down to answer a one-star review and types: “Tara, we’re so sorry your September 3rd appointment didn’t meet expectations.” She has not yet said anything about the treatment, the price, the outcome, or the dispute. She has already published the reviewer’s legal name, confirmed that the reviewer is her patient, and pinned the visit to a date.

That is the whole problem, and it is the same problem in five different industries with five different rulebooks. Healthcare has HIPAA. Lawyers have their state bar. Tax preparers have a criminal statute in the Internal Revenue Code. Childcare has state licensing and a client who is legally a minor. Veterinarians have practice acts and a professional ethics code. Nothing in those five regimes looks alike on paper, and all five collapse to one sentence: confirming that the reviewer is your client is itself the disclosure. Everything after that is just aggravating detail.

This is the hub post for that idea. The general pattern first, then how each regime bites differently, then the uncomfortable conclusion: in a regulated trade, the correct reply is shorter and blander than the one a pizza place would send, and that is not weakness. That is the job.

Why the standard review advice is wrong here

Every review-response guide on the internet tells you to personalize. Use their name. Reference the specific issue so the reader knows you actually read it. Show you remember them.

That advice is good, and in a regulated trade it is close to malpractice. “Use their name” is a disclosure. “Reference the specific issue” is a disclosure. “Show you remember them” is literally the thing you are prohibited from doing, because remembering them in public means confirming they were here.

The confusion comes from where the advice was written. Review response as a discipline grew up in restaurants, hotels, and retail, where the customer relationship is not confidential and the worst outcome of a clumsy reply is that you look defensive. Then the same playbook got copy-pasted into dental, legal, accounting, childcare, and veterinary marketing, and nobody stopped to notice that the foundational move of the playbook is prohibited in all five.

Here is the test that actually matters, and it has nothing to do with tone. Read your draft reply and ask: could a stranger, reading only this reply and the review above it, conclude that this person was a client of mine? If yes, you have made a disclosure. Then ask the second question: was I permitted to make it? In most of these regimes, the answer is no, not without written consent you almost certainly do not have.

Note what the test does not ask. It does not ask whether the review is fair. It does not ask whether the reviewer already revealed the relationship themselves. That second one trips up more owners than any other: the reviewer saying “I was a patient here” does not give you permission to say it back. Their disclosure is theirs to make. Yours is governed by a rule they cannot waive by accident in a Yelp post.

Three moves that work in every one of the five

The compliant reply is built from three moves, in this order. They work across all five regimes because they are constructed to be true regardless of whether the reviewer is your client.

One: acknowledge without confirming. You are allowed to thank a person for feedback. You are allowed to say your practice takes concerns seriously. You are not allowed to characterize their experience, because characterizing it presumes they had one with you. “Thank you for taking the time to write this” is safe. “We’re sorry your visit was disappointing” is not, and the difference is four words deep.

The phrasing that does the most work: a plain statement that you are not able to discuss individual matters publicly. Say it early, say it as a rule rather than a dodge, and do not apologize for it. “We can’t discuss any individual’s care in a public forum” tells the next reader two things at once, that you have a compliance posture and that the silence is not evasion. Readers understand this better than owners expect. Most people have been on the other end of a pharmacist who would not confirm whether a prescription existed.

Two: move it off the platform, in one sentence, with a real human attached. Not “please contact us.” A name, a role, and a direct line or email. The reason is partly practical and partly evidentiary: a named contact converts complaints at a far higher rate than a generic inbox, and it also demonstrates, in writing, that you offered a private channel. If this ever becomes a licensing complaint, that public offer is the most useful sentence in the thread.

Three: never correct the facts in public. Not the date, not the price, not the sequence of events, not whose fault it was. This is the hardest one, because the review is often wrong and the correction is often easy. Resist it. Correcting a fact requires knowing the fact, knowing the fact requires having the file, and having the file confirms the relationship. Every factual correction is a confession that you hold records about this person.

What you can talk about, freely and at length, is policy in the abstract. Your refund window. Your callback standard. Your escalation path. Your credentialing. This is the release valve, and it is the reason a constrained reply can still sell. You are not defending the case. You are describing the machine.

The same review, two replies

Lumen Aesthetics is a med spa in Boise with 212 Google reviews and a 4.6 average. This lands on a Tuesday, from “T. R.”:

“Paid $1,400 for filler that left me lumpy and asymmetric. They told me it would settle. Six weeks later it hasn’t, and nobody will return my calls. Save your money.”

Here is the reply the owner wrote that night, which is polite, factually accurate, and detonates on contact:

“Tara, we’re so sorry your September 3rd appointment didn’t meet expectations. You were advised at your consult that results take up to 12 weeks to settle, and you signed a consent form acknowledging that asymmetry is a known outcome. Our injector has 11 years of experience. We also left you voicemails on the 14th and the 16th.”

Count what got published. Her legal name, when she chose initials. A treatment date. The category of treatment. The content of her consent form. Clinical advice given to her specifically. A call log proving an ongoing relationship. And the motive implication at the end, that she is lying about nobody calling her back, which is a factual claim about a person that the clinic has now made in public under its own name.

Six separate exposures, and the tone is impeccable. That is the pattern worth internalizing: in regulated trades the dangerous sentences are the helpful ones. The angry replies get caught by every owner’s own instincts. The helpful ones sail straight through.

Here is what the clinic posted instead, six hours after the review went up:

“Thank you for taking the time to write this. We can’t discuss any individual’s treatment, or confirm who has or hasn’t been to the clinic, so this reply is shorter than we’d like it to be. What we can say is our policy: any injectable concern raised within 90 days gets a no-charge follow-up assessment, and our clinical director, Marisol, handles those herself at (208) 555-0163. If someone has called us and not heard back, that’s our failure and she is the person who fixes it.”

Thirteen seconds of reading, zero disclosures, and it still does three things for the next prospect: it names a policy with a number attached, it names a human with a phone number, and it concedes a failure mode without conceding this failure. The reviewer called Marisol the next morning. The review was edited to three stars eleven days later. And in the following month, four consult forms came in referencing the 90-day follow-up policy, which the clinic had been running for two years and had never written down anywhere a customer could see it.

That is the underrated part. The constraint forces you to market your policies instead of arguing your cases, and your policies are the more persuasive material anyway.

How each rulebook bites differently

Same rule, five mechanisms, and the differences matter because they change who enforces it and what it costs you.

Healthcare, dental, and the med spa question

If you are a HIPAA covered entity, the reviewer’s name, their appointment, their treatment, and their balance are all protected health information, and the fact of their being your patient is protected too. The Office for Civil Rights has said so in the plainest possible language attached to the plainest possible fact pattern, which we walk through in the dental reputation guide.

The med spa case is more interesting, because a lot of med spas are not covered entities and the ones that are usually do not know it. Covered-entity status turns on two things together: you provide health care, and you transmit health information electronically in connection with a standard transaction, which in practice means billing insurance, running electronic eligibility checks, or requesting prior authorization. A strictly cash-pay aesthetics practice that never touches a payer may fall outside HIPAA on that second prong.

Do not celebrate. Falling outside HIPAA does not leave you unregulated, it leaves you regulated by a patchwork that is harder to research: state medical privacy statutes, your medical director’s own licensing board, state consumer privacy law, and the plain old duty of confidentiality that attaches to a physician-supervised practice. One Botox appointment billed to a plan for a migraine patient can pull a whole practice into covered-entity status too. The practical advice for med spas is to write replies as though HIPAA applies, because the drafting discipline is identical and the research bill for finding out otherwise is larger than the benefit. We go through the aesthetics-specific version in the salon and med spa guide.

Law firms: the self-defense exception that isn’t one

Lawyers get the cleanest answer of the five, and the one most lawyers have wrong. Model Rule 1.6(b)(5) lets you reveal client information to defend yourself in a controversy with a client, and an unhappy ex-client trashing you on Avvo feels exactly like a controversy.

It isn’t. In ABA Formal Opinion 496, issued January 13, 2021, the Standing Committee on Ethics and Professional Responsibility concluded that a negative online review, because of its informal nature, is not a controversy between lawyer and client within the meaning of the rule. Even if it were, a public reply that discloses information relating to the representation, or that could reasonably lead others to discover it, would exceed what the exception permits.

What the opinion leaves you is narrow and worth memorizing. You may ask the platform to take the post down. You may reply privately. You may, where the poster is not a client, say that no such representation occurred. You may post a non-disclosing invitation to discuss the matter privately. And you may say that your professional obligations prevent a fuller response. The committee suggests wording to roughly that effect, along the lines of professional obligations not allowing the lawyer to respond as they would wish. Check the opinion for its exact phrasing before you adopt it as your standard line. Its first recommendation, though, is that you consider not responding at all, on the theory that a reply feeds the post more oxygen than it costs you to ignore it.

State rules vary on top of this, sometimes meaningfully, which is why we keep a separate breakdown of bar association rules rather than pretending the ABA opinion is binding anywhere by itself. It is persuasive guidance, not law, and your state is the one with the grievance committee.

Tax preparers and CPAs: the one with a criminal statute

This regime surprises people, because accounting does not feel like a privacy-regulated trade the way medicine does. It is, and the teeth are unusual. IRC section 7216 is a criminal provision, enacted in 1971, that makes it a misdemeanor for a tax return preparer to knowingly or recklessly disclose or use tax return information for a purpose other than preparing the return. The maximum is a fine of up to $1,000 or up to one year in prison, or both, per violation, plus costs of prosecution. Section 6713 adds a civil penalty of $250 per disclosure, capped at $10,000 in a calendar year, and it has no knowledge requirement at all.

The trap is the definition. “Tax return information” is not limited to the numbers on the form. It covers information furnished for, or in connection with, the preparation of a return. Whether that reaches the bare fact that someone engaged you at all is the question a public reply turns on, and we could not find a source answering it squarely either way, so treat the conservative reading as the working rule and ask your own counsel rather than taking ours. Separately, AICPA Rule 1.700.001 sweeps wider than section 7216 does: it covers any information obtained from the client that is not already public, which a client relationship plainly is not. Consent has to be knowing, voluntary, written, specific about what is disclosed and to whom, and signed before the disclosure. A Google reviewer has given you none of that.

Layered on top, for CPAs, AICPA Rule 1.700.001 covers confidential client information generally, meaning anything obtained from the client that is not publicly available. Its scope is different from section 7216, not identical, and the practical effect is that a disclosure can clear one standard and fail the other. For a reply box, the merged rule is simple: you cannot say the reviewer is a client, and you cannot describe the engagement. Say the firm does not discuss client matters publicly, name a partner, give a number. Not the season, not the form type, not the fee dispute, and emphatically not “we filed exactly what you gave us,” which is a sentence that only a preparer with the file could write.

Childcare: the client can’t consent for herself

Childcare has no single federal privacy statute covering private centers, which makes owners assume the constraint is looser. It is tighter, for a structural reason the other four do not share: the person whose information you would be disclosing is a child who cannot consent, and the person writing the review is her parent, whose post is a disclosure about the child rather than a waiver of your duty to her.

The rules are in your state licensing regulations, usually under headings like confidentiality of child records or parent rights, and in the enrollment and media-release forms your families signed. Programs attached to a school district’s pre-K, or receiving Title I funding, can also fall under FERPA. State-by-state variation here is wide enough that generic advice is nearly useless, so check your own licensing handbook rather than a blog, including ours.

What does not vary: a reply that says “Mason was only in timeout once that week” has published a disciplinary record about a named minor, on a permanent public page, indexed by search engines, findable by that child at seventeen. Licensing investigators read reviews. They read your replies too, and the reply is the part you wrote. The childcare reputation guide covers the enrollment-form and photo-consent mechanics that sit behind this.

Veterinary: no HIPAA, which is not the same as no duty

HIPAA does not cover animals, and this is the single most commonly misapplied fact in veterinary marketing. What covers you instead is your state practice act, most of which require veterinary medical records be kept confidential and released only as law allows or the client consents, plus the AVMA Principles of Veterinary Medical Ethics, which state that a veterinarian must protect the personal privacy of clients and must not reveal confidences unless required by law or necessary to protect the health and welfare of other people or animals. The AVMA Model Veterinary Practice Act takes the same line on patient information and express client consent.

There is a wrinkle worth knowing. Several practice acts contemplate that when the owner of a patient initiates a proceeding questioning the care given, the confidentiality position changes. A one-star Google review is not a proceeding, and treating it as though it were is how veterinarians end up in front of their board. If a complaint is actually filed, that is a conversation with your carrier, not a reason to publish the chart. More in the veterinary practice guide.

What enforcement has actually looked like

The clearest case on the record is New Vision Dental in California. A complaint filed with the HHS Office for Civil Rights in November 2017 alleged the practice owner had been responding to Yelp reviews with protected health information, including patient names where the reviewers had used only Yelp handles, plus treatment and insurance details the reviewers themselves had never mentioned. OCR described the disclosures as habitual. The settlement, announced December 14, 2022, was $23,000, a corrective action plan, and two years of OCR monitoring. OCR Director Melanie Fontes Rainer’s statement at the time is about as unambiguous as regulators get: providers cannot disclose protected health information of their patients when responding to negative online reviews, and she called it a clear no.

It was not the first. Elite Dental Associates in Dallas settled for $10,000 in 2019 over a Yelp reply that confirmed a patient’s name, described her treatment, and disclosed her outstanding balance. Two cases, three years apart, the same five minutes of typing.

The legal side has a longer discipline record, because bars have been at this longer. Illinois reprimanded a Chicago attorney who answered an ex-client’s Avvo review by revealing that the client had beaten up a co-worker. Georgia publicly reprimanded an attorney for revealing personal and confidential client information in a reply to a review on a public site. Colorado suspended an attorney over replies to reviews from two separate clients. An Oregon trial panel found a rule 1.6 violation and suspended the lawyer for 30 days. In every one of those, the disclosure was made in the course of defending accurate professional work against an unfair post. Being right about the underlying facts was not a defense, and in a couple of them it was the reason the lawyer felt safe posting.

For the broader picture of privacy, defamation, and FTC exposure that sits underneath all of this, including the newer FTC review rule, our guide to the legal line on review responses is the longer treatment. This post is the confidentiality slice of it.

The five-star reviews are the same problem

Nobody thinks about this one, and it is the most common violation by volume.

“Thank you so much, Deborah! So glad the crowns are working out. See you in March!” is a warm, human, completely ordinary reply to a glowing review. It is also a patient’s name, a procedure, and a future appointment, published by a covered entity without authorization. The rule does not have a sentiment carve-out. Praising a client in public is the same disclosure as disputing one, and it is more frequent, because a practice might get three complaints a year and eighty compliments.

Your positive-review replies in a regulated trade should be short, warm, and empty of specifics. “Thank you, this means a lot to the whole team” is the ceiling. If that feels like leaving warmth on the table, remember you are still allowed to be enthusiastic. You are just not allowed to be enthusiastic about a particular identifiable person’s care.

The part nobody tells you: bland is the strategy

Owners in regulated trades resist the constrained reply because it reads, to them, as weak. The reviewer made a specific accusation and the reply does not answer it. Surely that looks like a concession.

It does not, and the reason is that you are not writing for the reviewer. You are writing for the person who will read this thread three months from now while choosing between you and two competitors. That reader is not adjudicating. They are pattern matching on composure. A reply that refuses to argue, states a policy, and hands over a named human reads as the more institutional of the two parties on the page. The reply that litigates the September 3rd appointment reads as a business that will one day discuss them on the internet.

Which is the actual competitive argument for compliance, and it is not a compliance argument at all. Your discretion is visible. Every prospective patient who reads a reply that says “we can’t discuss anyone’s care publicly” is being shown, at no cost to you, that their own file is safe here. There is no other place in your marketing where you get to demonstrate that.

The practical build is the same one we recommend everywhere: stop writing replies from scratch. Draft four skeletons, clinical or service complaint, billing dispute, suspected non-client, and positive review, get them reviewed once by someone who knows your specific regime, and then every future reply is a fill-in rather than a fresh legal decision at 11pm. Your malpractice or liability carrier probably has a free risk-management line that will read them for nothing. If you want a floor to start from, the HIPAA-compliant response templates on replysmith.net are built on exactly this acknowledge, redirect, never-confirm structure, and they adapt cleanly to the non-HIPAA regimes because the structure is what transfers, not the vocabulary.

What this post is not

This is not legal advice, and it is not close enough to be treated as any. We are a review response company, not your counsel. Every regime described above varies by state: bar rules differ from the ABA model, veterinary practice acts differ wildly, childcare licensing is written agency by agency, and covered-entity status under HIPAA is a determination about your specific practice that depends on facts we cannot see from here. Several of the enforcement matters summarized above are described from secondary reporting rather than the underlying orders.

Treat all of it as the reason to ask a real question of a real lawyer, once, about your own trade. That conversation costs an hour. It is cheaper than the version where you find out from a licensing investigator holding a printout of your reply.

The thing worth carrying out of here is smaller than any of the five rulebooks. Before you publish, delete the reviewer’s name, delete every date, delete anything only your records could tell you, and see what is left. If the reply still works, it was always going to. If it collapses, it was never a reply. It was testimony.