Can a dental practice reply to a review without a HIPAA violation?
Two dental offices learned this from federal resolution agreements, and in both cases the damage was done in the reply, not the review.
A dental practice can reply to online reviews without violating HIPAA, as long as the reply contains nothing that identifies the reviewer as a patient or describes their care. Two dental offices settled with the HHS Office for Civil Rights after replies on Yelp did exactly that. Because owner replies are public text sitting next to every review, they are also part of what search engines and AI assistants read about the practice.
What the two dental replies contained
The details come from the resolution agreements themselves, which are more specific than the headlines.
Elite Dental Associates, Dallas
A patient complained to OCR in June 2016. Her complaint, as the resolution agreement records it, was that the practice answered her Yelp post with "her last name, details of her treatment plan, insurance and cost information." Reviewing the page, OCR found the practice had also disclosed other patients' information in replies. The practice paid $10,000 and took on a corrective action plan, according to the HHS summary.
New Vision Dental, California
The complaint here described a habit rather than a slip: replies "sometimes providing full names where only Yelp monikers were used by the patients" and adding visit and insurance details the reviewers had not mentioned, according to the resolution agreement. The practice paid $23,000 and accepted a corrective action plan, per HHS. Among its obligations: remove the postings, send breach notices, and post a substitute notice on its Yelp page.
The second case is the one to study. The reviewers had chosen anonymity. The practice's replies removed it.
Why dental replies drift into patient detail
Dental complaints are often about money and insurance: a surprise balance, a claim that was denied, an estimate that changed. The instinct is to explain the bill. Every explanation of that kind is information about a specific person's care and coverage. The ADA's marketing and advertising guidance puts the boundary further out than most offices expect: "Even merely revealing that an individual is a patient may violate privacy laws," and a photo of a patient "even just sitting in the waiting area, may constitute PHI."
The reply is part of the public record
Review pages are not a closed conversation between two people. Yelp's August 2026 announcement says Yelp content powers recommendations inside ChatGPT and other assistants. We cannot tell you whether a given assistant quotes owner replies, because none says. What is certain is that the reply is indexed text, attached to your practice name, and written by you. A calm, identical, detail-free pattern across a hundred replies describes a practice that handles complaints properly. One reply that argues a patient's balance describes the opposite.
A reply that works for any review
For praise: "Thank you for taking the time to write this. We will share it with the team." For criticism: "Thank you for the feedback. We take concerns like this seriously and would like to talk with you directly. Please call our office manager at the main number." Neither confirms a visit, names a dentist who treated anyone, or mentions a procedure, a date, a balance or a carrier. Both are invented for this page and are starting points, not legal language.
Setting the practice up to reply safely
- Name one or two people who may reply, and give them the two templates.
- Read every existing reply on Google, Yelp and any directory. Edit or remove those that confirm treatment or mention money.
- Keep the review request process clean too: Google's Maps content policy bans incentives for reviews and selectively soliciting positive ones.
- Ask your counsel whether your practice is a HIPAA covered entity and what your state adds. A provider that bills insurance electronically generally is one.
How reviews and replies fit the wider picture is covered by the reputation signals pillar, and the other dental questions are on the dentist AI visibility guide.
Not dental, legal or medical advice. This describes how AI systems can read a dental practice in public; your state dental board and your own counsel set the rules for your practice.
Questions
What did Elite Dental Associates disclose in its Yelp replies?
According to the HHS resolution agreement, a patient complained in 2016 that Elite Dental Associates in Dallas responded to her Yelp review with her last name, details of her treatment plan, and insurance and cost information, and OCR found the practice had replied to other patients' reviews the same way. Elite agreed to pay $10,000 and adopt a corrective action plan.
Can a dentist confirm that a reviewer is a patient?
The ADA's marketing guidance warns that even revealing that an individual is a patient may violate privacy laws. A safe reply therefore neither confirms nor denies the person was treated, and invites them to contact the office privately instead.
More questions from dentists
This page is part of AI visibility for dentists, the AIOInsights guide to how AI systems find, read and describe this kind of practice.
- Which public records can confirm a dentist is licensed, and what do they show?
- Should the practice or each dentist have the Google Business Profile?
- What happens to AI answers about your practice when an associate dentist leaves?
- Can an AI call your general dentist an "implant specialist", and whose fault is it if it does?
- Why does AI get your accepted insurance wrong?
- Which schema.org type fits a dental practice, and what can it not say?
- DSO and multi-location: which name should AI know you by?
- How does an assistant decide a dental practice is open for an emergency right now?
- What can a practice publish about implant or crown cost so an AI can quote it?
- Before-and-after photos and testimonials: what the board allows and what AI can reuse
- Where AIO falls short for dental practices