How can a med spa reply to reviews without breaking HIPAA?
An owner's reply to a review is public, crawlable and permanent, and it is the one piece of the review page the practice writes itself.
A med spa can reply to any review, positive or negative, as long as the reply never confirms the reviewer was a patient or mentions their treatment. Federal regulators have penalized healthcare practices for revealing patient details in replies to online reviews, and those replies are public, indexed, and now part of what AI assistants read about a business. The safe reply talks about your policies, not their visit.
Three penalties, all from review replies
All three cases below involve dental practices, because that is where the enforcement record is. The rule they applied, the HIPAA Privacy Rule, is the same for any covered healthcare provider.
Dr. U. Phillip Igbinadolor, D.M.D. and Associates
The HHS Office for Civil Rights imposed a $50,000 civil money penalty after the practice disclosed a patient's protected health information on a webpage in response to a negative online review. HHS enforcement record.
New Vision Dental
A California practice that paid $23,000 and accepted a corrective action plan over disclosures of patient information in responses to online reviews. HHS enforcement record.
Elite Dental Associates
A Dallas practice that paid $10,000 after replying to Yelp reviews with patients' names and details of their conditions. HHS enforcement record.
The full list of settlements is on the HHS resolution agreements page. The pattern is consistent: a practice felt a review was unfair, replied with the facts of the visit to set the record straight, and in doing so disclosed health information.
Why aesthetics makes this easier to get wrong
Aesthetic reviews are unusually specific. "My lips were uneven after filler." "The laser burned my cheek." The natural reply is equally specific: "Your treatment used two syringes and we offered a free touch-up." Every clause of that reply is health information about an identifiable person, attached to their public name, on a page that search engines and AI assistants read.
Whether HIPAA reaches your practice depends on whether you are a covered entity, which usually turns on electronic billing transactions, so ask your counsel. The California Medical Board's medical spa guidance is clear that physician-patient confidentiality applies to cosmetic treatment exactly as it does to any other medicine. The practical answer does not change: reply as if HIPAA applies.
What a safe reply leaves out, and what it keeps
Two replies to the same critical review about bruising after filler, both invented for this page:
Unsafe: "We are sorry you were unhappy with your lip filler on the 12th. As we explained at your follow up, bruising is normal and your injector noted you had taken aspirin."
Safe: "Thank you for taking the time to write. We take every concern seriously, and our policy is to review any post-treatment question with our medical director directly. Please call our office manager so we can talk privately."
The safe reply confirms nothing: not the visit, not the treatment, not the injector, not the date. It shows the reader a practice with a process, which is the thing a prospective patient, and an assistant summarizing the page, actually needs to see.
Replies are part of your reputation record now
Owner replies sit right under the reviews, and reviews are no longer confined to the review site. Yelp says its reviews and business details now appear inside ChatGPT. A calm, consistent reply pattern across dozens of reviews reads as a practice that handles problems well. One defensive reply with a patient's details reads as the opposite, and it stays. Our reputation signals pillar covers how that record is read.
What to do
- Write two templates: one for praise, one for criticism, both free of any patient detail. Personalize the warmth, never the facts.
- Decide who may reply, and make it one or two people who have read this page.
- Read your past replies on Google, Yelp and RealSelf. Edit any that confirm a visit or describe a treatment.
- Keep the review program itself clean, per the FTC fake reviews rule.
The rest of the questions are on the med spa guide.
Not medical or legal advice. This is how AI systems read a med spa in public; the rules that bind your practice come from your state board and your own counsel.
Questions
Can a med spa confirm that a reviewer was a patient when replying to a review?
A med spa that is a HIPAA covered entity should not confirm in a public reply that a reviewer was a patient, or mention the treatment, the visit or any health detail. Federal regulators have penalized practices for exactly that kind of disclosure in replies to online reviews. A safe reply speaks about the practice's policies in general and invites the person to call, without acknowledging the relationship.
Does HIPAA apply to every med spa?
HIPAA applies to covered entities, which for providers generally means those that transmit health information electronically in standard transactions such as insurance billing. Some cash-only aesthetic practices may not be covered entities. Whether a particular med spa is covered is a question for its counsel, and physicians remain bound by medical confidentiality regardless, so the safe reply pattern is the same either way.
More questions from med spas
This page is part of AI visibility for med spas, the AIOInsights guide to how AI systems find, read and describe this kind of practice.
- Should a med spa choose "Medical spa" or "Day spa" as its Google category?
- How does naming your medical director help AI verify a med spa?
- What should a med spa publish about each injector so AI can confirm who they are?
- When the brand on the door is not the legal owner, how does AI get your med spa wrong?
- "Botox" or "neurotoxin": why the brand name decides what AI thinks your med spa offers
- FDA-cleared or FDA-approved: which words can a med spa use for its lasers and fillers?
- Should a med spa publish prices, and how should they be written so AI quotes them correctly?
- What the FTC fake reviews rule means for med spa review programs, and for what AI summarizes
- Before and after photos: what a med spa must say next to them, and what AI drops
- How should a med spa describe semaglutide so AI does not repeat a claim the FDA calls misleading?
- Where AIO falls short for med spas