How to get more Google reviews without breaking HIPAA or Google's rules

Reviews shape which clinic a patient chooses, and they help your visibility on Google. But clinics face two sets of rules that many other businesses don’t: Google’s policies on how reviews may be requested, and the privacy obligations that come with healthcare.

The good news is that doing it properly isn’t complicated. This guide covers how to ask, what to avoid, and how to reply safely.

Why reviews matter so much for clinics

Reviews do two jobs at once.

They help patients decide. A patient comparing three clinics will often read recent reviews before choosing one. Specific, recent comments about friendly staff, short waits or clear explanations are very persuasive.

They help you get found. Google says local results are based on relevance, distance and prominence, and that the number of reviews and your rating are part of prominence. (Google Business Profile Help: Tips to improve your local ranking) Reviews also give AI assistants more to work with when they summarize a clinic.

The catch: happy patients rarely post on their own. Unhappy ones are more motivated. Without a simple, consistent way to ask, your reviews may not reflect the care you actually provide.

How to ask (the right way)

Ask everyone, every time

The single most effective habit is consistency: ask every patient, shortly after their visit, in the same friendly way. Asking everyone is also how you stay within Google’s rules (more on that below).

Ask at the right moment

A short text or email a little while after the visit works well. The experience is still fresh, and the patient has a minute to respond. Avoid asking while they are still in pain, waiting on results, or upset about a bill.

Make it one tap

Send a direct link to your Google review form. Google itself suggests sharing a link or QR code with customers. (Google Business Profile Help: Tips to get more reviews) Every extra step loses people.

Keep health information out of the request

The request should not mention the treatment, the condition or anything about the visit beyond “thank you for visiting”. For example:

Thanks for visiting Northside Family Clinic today. If you have a moment, we’d be grateful if you shared your experience: [link]

That keeps the message useful to the patient and private if someone else sees their phone.

Give patients a private option too

Some clinics add a short private feedback page, so patients with a concern can reach the practice manager directly. That’s a good idea, as long as it is offered alongside the public review link, never instead of it.

What Google does not allow

Google’s policy on prohibited and restricted content is clear on a few points that trip up businesses. (Google Maps user contributed content policy: Prohibited & restricted content)

• No selective asking (“review gating”). Businesses may not discourage negative reviews or selectively ask only happy customers for reviews. A system that sends unhappy patients to a private form and only happy ones to Google is exactly what this rule targets.
• No incentives. You can’t offer payment, discounts or anything else in return for a review, or for changing or removing a negative one.
• No conflicts of interest. Reviews from staff, former staff, contractors, family members or competitors aren’t allowed.
• No pressure on staff. Google also says employees shouldn’t be pressured to collect a set number of reviews or reviews with specific content, such as naming a particular staff member.

What is allowed: asking customers to review their genuine experience, as long as you don’t offer incentives or try to influence the rating or content.

In short: ask everyone, offer nothing in return, and let patients say what they want.

How to reply without revealing patient information

This is where healthcare differs most from other businesses. Under HIPAA, the fact that someone is your patient is itself protected health information. A reply that confirms they were seen, mentions their treatment or discusses their visit can disclose information the patient never shared themselves, even if they mentioned it in their own review.

A few rules keep replies safe:

1. Never confirm the reviewer is a patient. Avoid phrases like “We’re glad your procedure went well” or “Sorry about the wait at your appointment”.
2. Never mention treatment, conditions, dates or billing.
3. Speak about your clinic’s general standards instead. Describe how you aim to treat everyone.
4. Take concerns offline. Invite the person to contact the practice manager directly.

Replying to a positive review

Thank you for taking the time to share this. Our team works hard to make every visit welcoming, and kind words like these mean a lot to us.

Replying to a negative review

We’re sorry to read this. We take every concern seriously and would welcome the chance to talk. Please call our practice manager at [number] so we can look into it.

Notice what these replies don’t say. There’s no confirmation of a visit, no detail, and no argument. Calm, brief replies also reassure the next patient reading them, which is the real audience.

Google’s own advice points the same way: keep replies brief, personal and relevant, respond to negative reviews constructively, and reply promptly. (Google Business Profile Help: Tips to get more reviews)

What about removing reviews?

You can flag a review that breaks Google’s policies, such as spam, off-topic content or a review from someone with a conflict of interest. A review that is simply negative, but genuine, isn’t a policy violation. The better response is a calm public reply and a steady flow of new reviews from other patients.

Testimonials on your website

Showing your best reviews on your website is a nice touch. Use only reviews that patients have already posted publicly, without adding any details. For patient stories, photos or quotes written for your own marketing, get written authorization first. For some specialties, such as mental health, it is wiser not to use patient testimonials at all.

This guide is general information, not legal advice. If you are unsure about a specific situation, check with your compliance adviser.

A simple routine that works

• After every visit, send one short, friendly request with a one-tap link.
• Offer the private feedback page alongside the public link, never instead of it.
• Check new reviews a few times a week.
• Reply to every review within a few days, using privacy-safe wording.
• Look at the trend monthly: how many new reviews, the average rating, and any recurring themes worth fixing inside the clinic.

Review requests, a private feedback page, monitoring and privacy-safe replies are part of the Reputation & reviews service in our Growth and Premium plans. If you’d like to see how your reviews compare with your top three local competitors, start with a Clinic Growth Plan.