Compliance guide

HIPAA-Safe Med Spa Review Responses: What to Say and What to Avoid

A new Google review comes in. It names a treatment, maybe even a result. Your instinct is to reply the way you'd reply to any business review: thank the person by name, confirm they were in for the procedure they mentioned, say you're glad it went well.

That instinct can get a med spa in trouble.

This guide gives you a response framework you can use today, nine ready-to-adapt templates, and a plain list of what never belongs in a public reply. It's written for front desk staff and practice managers who answer reviews between patients, not for lawyers. For anything specific to your practice, talk to a healthcare attorney. This is not legal advice.

The short answer: don't confirm a patient relationship in public

Here's the rule in one sentence: never say or imply, in a public reply, that the reviewer was your patient.

That sounds strict until you see how easy it is to break by accident. "Thank you for visiting our clinic, Sarah, so glad your Botox went well!" looks like a friendly, normal reply. It also does three things a HIPAA-conscious practice shouldn't do in public: it uses the reviewer's name, it confirms she was a patient, and it names her treatment. A practical guide to med spa reputation work is direct about this: never confirm or deny that a reviewer was a patient, and never reference their treatment, results, appointment date, or any clinical detail in a public response, even if the reviewer got something wrong and you want to set the record straight.

That last part trips people up the most. If a reviewer publicly misstates what happened during their visit, the instinct is to correct them. Don't do it in the reply. Correcting the record by referencing their specific treatment is itself the disclosure. Move that conversation to a phone call or a private message instead.

A safer way to write every reply

Three moves cover almost every situation:

Acknowledge the feedback without identifying the person. "Thank you for taking the time to share this" works whether the review is glowing or scathing. It doesn't use a name, a treatment, or a date.

Speak in general terms about your standards. "We care about every patient's experience and take feedback like this seriously" is true and says nothing that could be tied to a specific chart.

Move anything specific to a private channel. "Please call our office at [number] so we can address this directly" hands the conversation to a phone line instead of a comment thread.

Three ways to reply to a good review

Example 1, five-star review, no details mentioned: "Thank you so much for the kind words! We're glad you had a great experience with us."

Example 2, five-star review that names a treatment. Reviewer wrote: "My lip filler with Dr. X was amazing!" Reply: "Thank you for the wonderful review! We appreciate you taking the time to share your experience." (Notice the reply doesn't repeat "lip filler" or "Dr. X".)

Example 3, five-star review with a name in the review text. Reviewer wrote: "Jessica at the front desk was so welcoming!" Reply: "Thank you for sharing this, we'll be sure to pass along your kind words to our team."

Three ways to reply to a bad review

Example 4, vague complaint, no specifics: "We're sorry to hear your visit didn't meet expectations. We'd like to understand more, please call us at [phone number] so we can make this right."

Example 5, complaint naming a treatment or result. Reviewer wrote: "My laser treatment left my skin worse than before." Reply: "We're sorry to hear about your experience. Patient care is our top priority, and we'd like the chance to discuss this with you directly. Please reach out to us at [phone number]."

Example 6, a review that's inaccurate or unfair: "We take all feedback seriously and would like to learn more about your visit. Please contact our office at [phone number] so we can look into this."

What never belongs in a public reply

The reviewer's name (unless simply repeating their own public username back). Any procedure, service, or product ("Botox," "the laser package," "your filler"). Appointment dates or visit counts. Clinical outcomes or before-and-after descriptions. Payment amounts or method. The name of the treating provider paired with any of the above. Any statement confirming or denying someone is a patient at all.

When to stop and get help

Escalate to a manager, owner, or attorney before replying when a review threatens legal action, alleges harm or a bad medical outcome, accuses the practice of a privacy breach, looks like part of a coordinated fake-review pattern, or comes from someone threatening to keep posting negative reviews unless paid (a documented extortion scam targeting small businesses).

Why a second pair of eyes helps

Even with a framework, review replies get written between patients, at the end of a long day, by whoever is free. That's exactly when a name or a treatment slips into a reply that shouldn't have one. ReviewOptimiser writes every reply to your practice's reviews using this same approach, and escalates anything that needs your input before anything gets posted. We also don't buy, incentivize, or filter reviews.

Running a clinic in Australia instead? Read AHPRA and Google reviews for cosmetic clinics, which covers a very different set of rules.

Frequently asked questions

Back to all resources.