Dentist Review Management: The Reply Is the Regulated Act

Dentist review management is usually sold as marketing: get more five-star reviews, reply quickly, watch the rating climb. For a dental practice that framing skips the part that actually carries risk. Most businesses can write whatever they like in a reply and the worst outcome is an awkward paragraph. A dental practice replying to a patient review is making a disclosure decision under federal law, and the Office for Civil Rights has published enforcement actions against three dental practices for getting it wrong. Every one of those cases was about the reply, not the review. The reviews themselves were ordinary complaints.

Why dentist review management is a compliance problem before it is a marketing problem

A patient posts a one-star review saying the crown took four visits and cost more than quoted. The instinct of almost every practice owner is to correct the record: explain that the patient missed two appointments, that the treatment plan changed because of a fracture found on the second visit, that the quote was an estimate. Every one of those corrections names a patient, a treatment and a payment. That is protected health information, and posting it publicly is a disclosure that no exception covers.

The awkward part is that the patient already revealed some of it. They said they were a patient. They mentioned the crown. Many practice owners reason that the information is therefore already public, so confirming it costs nothing. The Office for Civil Rights has not accepted that reasoning, and the published settlements say so plainly.

This does not make the review invisible or unanswerable. It means the reply has to be written to a different specification: acknowledge, invite the conversation offline, and say nothing that confirms or adds any clinical or billing detail. That is a narrower brief than most template libraries are written for, which is why the generic advice in responding to negative Google reviews needs a dental-specific pass before an office manager uses it under time pressure.

It also applies wherever the feedback lands. A practice that runs a patient booking app collects ratings in the App Store and on Google Play alongside its Google Business Profile reviews, and a developer response on an app store listing is exactly as public as a Google reply. The surface changes; the disclosure rule does not.

Three OCR actions, all dental, all about a reply

These are the published cases. All three are on the Department of Health and Human Services website, and all three were read on 25 September 2026. Read them before you write a review policy, because they are more specific than any summary of them.

In October 2019, OCR announced that a Dallas practice would pay $10,000 in a case the department titled Dental Practice Pays $10,000 to Settle Social Media Disclosures of Patients Protected Health Information. The title is the finding: the disclosures were made on social media, in the ordinary course of reputation management.

In March 2022, OCR imposed a $50,000 civil money penalty on a North Carolina practice. The department’s own enforcement page for that action states that the practice "impermissibly disclosed a patient’s PHI on a webpage in response to a negative online review". That sentence is worth reading twice. The trigger was a negative review; the violation was the response.

In December 2022, OCR settled with a California practice trading as New Vision Dental for $23,000 over disclosures made in responses to negative online reviews, which OCR says included patient names, treatment and insurance information. The announcement also carries the clearest statement the regulator has made on the subject.

“Providers cannot disclose protected health information of their patients when responding to negative online reviews. This is a clear NO.”

— Melanie Fontes Rainer, Director, HHS Office for Civil Rights, 14 December 2022

Three cases, three states, three different amounts, one pattern. The practice was trying to defend itself in public and used patient information to do it. The New Vision settlement also carried a corrective action plan monitored by OCR for two years, which is the part that costs a practice more than the penalty: two years of documented policy, training and oversight over something that started as a paragraph typed in a hurry.

None of this is a reason to stay silent. Silence has its own cost, and a profile where every complaint sits unanswered reads badly to the next patient searching your name. It is a reason to decide the wording in advance, when nobody is annoyed, rather than in the ten minutes after the notification arrives.

What a dental practice can say in a public reply, and what it cannot

The safe reply has four moves and no fifth. Thank the person for the feedback. State the practice’s general standard without reference to this case. Give a named route to continue privately. Stop. Anything that follows tends to be the sentence that causes the problem.

• Never confirm that the reviewer is a patient. "We are sorry your visit did not meet expectations" confirms a visit. "Thank you for the feedback" does not.
• Never name a treatment, a diagnosis, a date or an appointment history. Missed appointments feel like the strongest fact you hold. It is also patient information.
• Never discuss billing, insurance or what was quoted. Insurance information was explicitly among the disclosures in the New Vision case.
• Never correct the reviewer’s account of their own care in public. If the account is wrong, that is a conversation for a phone call, and the correction is worth nothing to the reader anyway.
• Do give a specific route offline. A named role, a direct number and a commitment to a timeframe. "Please call our practice manager on the number on our profile and we will call you back the same working day."

It helps to write two approved openings and forbid improvisation on the rest. One for a complaint about the clinical experience, one for a complaint about cost, front desk or waiting time. Both end at the offline invitation. An office manager under pressure will reach for whatever is already written, so the quality of your review management is mostly decided by what sits in that document months earlier.

The same restraint applies to a positive review, and it is easier to forget there. Replying to a five-star review with "so glad the implant healed well, see you in six months" is a disclosure too, made cheerfully. Keep the thanks general and the detail out.

What Google lets a dental practice ask for

Practices are heavily marketed to on review generation, and a good deal of that marketing suggests things Google prohibits. Google’s prohibited and restricted content policy, read on 25 September 2026, states that merchants must not "Offer incentives - such as payment, discounts, free goods and/or services - in exchange for posting any review". A whitening voucher for a review is exactly that.

The same policy states what is permitted, and it is more generous than most practices assume: merchants may "Solicit or encourage the posting of content that does represent a genuine experience, without offering incentives". Asking every patient at checkout is fine. Paying them, discounting them or entering them into a draw is not. The line sits at the incentive.

Two other clauses catch dental practices specifically. Google prohibits content based on a conflict of interest, which it defines to include "current or former employment, a contractual or consultory relationship, or other professional or personal affiliations". Reviews written by hygienists, associates or a practice’s own marketing agency fall inside that definition. And Google prohibits content "posted from multiple accounts by or at the request of one person", which is what a front desk tablet handed round the waiting room produces.

Google also prohibits merchants from selectively soliciting positive reviews. Asking only the patients who smiled on the way out is review gating, and beyond the policy problem it produces a rating that does not describe the practice. When a review really does breach policy, the removal route is narrow and slow, and reporting fake reviews for removal covers what works and what wastes a fortnight.

The approval workflow that makes a compliant reply fast

Most practices solve this badly in one of two ways. Either one clinician personally writes every reply, which is safe and takes three weeks, or the front desk replies immediately, which is fast and is how the three OCR cases started. The workable answer is separation: whoever is closest to the patient drafts, and a single reviewer with the policy in their head approves before anything is published.

That is what an approval workflow is for in a regulated setting. It is not bureaucracy for its own sake; it is the control that keeps the drafting fast and the publishing checked. The cost of the extra step is measured in minutes, and the thing it prevents is measured in a two-year corrective action plan.

1. Write the policy once: the four permitted moves, the five forbidden ones, and the two approved openings. One page, not a manual.
2. Name one approver and one deputy. A reply that cannot be approved because someone is on leave is a reply that gets published unapproved.
3. Set a target for time to publish rather than time to draft, because the patient and the next reader only see the published reply. Two working days is realistic for a single site.
4. Log the review, the draft, the approver and the publish time. If OCR ever asks how the practice controls this, that log is the answer.
5. Review the log monthly and count how many drafts were edited at approval. If the number never falls, the policy is not being read.

Groups and DSOs have the same problem multiplied. A regional marketing lead replying on behalf of nine practices produces generic apologies that readers discount, and gives one person the ability to make a disclosure on behalf of every site. Delegate drafting to the practice and keep approval central, which is the same split that multi-location review management sets out for any portfolio. ReviewMankey’s draft and approval workflow exists for this shape of problem, and it applies the same controls whether the review arrived on Google, the App Store or Google Play.

One more thing worth setting deliberately: the clock. A clinical complaint and a parking complaint do not deserve the same urgency, and a single blanket target flattens the difference. The review response time SLA playbook covers how to set a target that survives contact with a busy surgery, and the dental version simply adds the approval step inside the target rather than after it.

The numbers a dental practice should track

Star rating is the number every practice watches and the one that moves slowest. These five say more about whether the practice is actually improving, and every one of them can be counted in a spreadsheet before it is worth paying for a dashboard.

• Response rate, and time to publish. Measure to publication, not to draft. The gap between the two is the real size of your approval bottleneck.
• Review velocity. New reviews per month per site. A stable rating with collapsing review velocity is a profile going quiet, which is a slower version of the same problem.
• Top three complaint causes by count. Waiting time, cost communication, front desk manner, pain management, rebooking. Count causes, not stars.
• Share of reviews naming a team member. Patients volunteer this without being asked, and it is the cheapest leading indicator of service quality a practice has.
• Drafts edited at approval. The only number here that measures the compliance control rather than the reputation. A rising number means the policy needs retraining, not rewriting.

For the wider context on how much of this matters to a patient choosing a practice, the review management statistics page collects the published consumer research with each figure attributed to its source. Use it to set expectations with a principal or a board, not as a substitute for your own five numbers, which are the only ones that describe your practice.

Cost communication deserves a special mention because it is the complaint most likely to tempt a public correction, and the one where a public correction is most clearly a disclosure. If the same billing complaint appears three times in a quarter, the fix is in the treatment plan conversation at the chair, not in the reply box.

Dentist review management done well looks unglamorous: two approved openings, one named approver, a two-day publish target, and a monthly count of causes. It is less exciting than a dashboard and it is the version that does not end in a settlement announcement. If you want the industry view with the platforms and the workflow laid out together, the dental review management use case covers how the pieces fit, and the healthcare review management use case covers the same controls for a wider clinical group.