Guide
How Dental Practices Can Collect Reviews Without HIPAA Headaches
TrustShelf Blog · Updated 2026-09-15
Dental and medical practices can't approach review collection the same way a restaurant or salon does, because patient privacy law changes what you and your staff can safely say — both in review requests and in any public response to a review. None of this means you should avoid asking for reviews; it means the wording needs a bit more care.
Why this is different from most businesses
Under HIPAA, disclosing that someone is a patient, describing their treatment, or even confirming they visited your practice in a public setting can constitute a privacy violation — even in a well-meaning response to a nice review. This mostly affects how staff respond publicly, but it's worth keeping in mind at every stage, including the review request itself, which should stay general rather than referencing specific treatment.
How to invite reviews safely
Keep the request itself generic — thank the patient for their visit without naming the specific procedure, and send it through a personal channel (text or email to that individual patient) rather than anything that could be seen by others.
Example, sent privately by text or email
"Hi [Name], thank you for coming in today. If you have a minute, we'd really appreciate a quick review of your visit: [link]."
This keeps things simple and avoids referencing any specific treatment, timing pattern, or health detail. For more on timing this well, see when to ask for a review.
What staff should never do publicly
- Never confirm, in a public review response, that someone is or was a patient — even replying "Thank you for visiting us, [Name]!" to a positive review can be read as confirming a treatment relationship in some interpretations, so keep public responses generic ("Thank you for the kind words!") rather than personalized with identifying detail.
- Never reference a specific procedure, diagnosis, or outcome in a public response, even to correct a factual error in a negative review.
- Never share appointment dates, insurance details, or any other identifying information in a public reply, even to defend the practice.
Handling a negative review that includes health information
If a patient posts a negative review that includes their own treatment details, you're generally allowed to respond to what they've shared about their own care — but you should still avoid adding anything on your end, confirming details they didn't state, or arguing about their diagnosis or treatment in public. A safe general-purpose response:
Safe general response
"We take feedback about every patient's experience seriously and would like to understand more about what happened. Please contact our office directly at [phone/email] so we can address this properly."
This works for essentially any complaint without confirming or adding any protected information. See how to respond to a negative review for the broader framework this fits into.
When in doubt, ask a professional
This article is general guidance, not legal advice — HIPAA and related state privacy rules have specific requirements, and a practice's compliance officer or healthcare attorney should sign off on your exact review request and response templates before they go into regular use.
The upside is still real
None of this should discourage you from collecting reviews — a steady stream of general, positive patient feedback is one of the strongest trust signals for someone choosing a new dentist, and the extra care in wording is a small cost for a genuinely valuable outcome.
Training front desk staff on what not to say
Front desk and hygiene staff are often the ones actually mentioning reviews to patients as they check out, which means they need the same awareness as whoever manages your online listings. A short training point is enough: never confirm a specific patient's visit or treatment in writing anywhere that could become public, and always route the actual review request through a private channel — a text or email sent directly to that patient — rather than anything posted or visible to others in the waiting room.
Using patient portals and appointment systems
If your practice management software has a patient portal or automated appointment-reminder system, it's often possible to trigger a private, generic review request through that same system right after a visit is marked complete. This keeps the request consistent without relying on front desk staff to remember every single patient, and keeps it appropriately private since it's delivered through a channel the patient already uses for their own care.
A note on review platforms built for healthcare
Some review and reputation platforms are specifically built with healthcare privacy requirements in mind, offering more built-in guardrails than a general-purpose review tool. If your practice collects a high volume of reviews, it may be worth evaluating whether a healthcare-specific option better fits your compliance needs — but the core principles in this article (keep requests generic, keep responses generic, never confirm details publicly) apply regardless of which platform you use.
What patients themselves control
It's worth remembering that all of the caution above applies to what your practice says, not what a patient chooses to share about their own care voluntarily. A patient is entirely free to mention a specific procedure, praise a specific provider by name, or describe their own treatment in detail in a public review — that's their own information to share, and you're not obligated to ask them to remove it. The compliance concern is specifically about your practice confirming, adding to, or responding to that information in a way that goes beyond what the patient themselves already disclosed.
TrustShelf gives you a simple, private collection link you can send to each patient individually, keeping the request personal without exposing anything you shouldn't.