One Review Reply Cost a Practice $30,000. Yours Is a HIPAA Test Too

The settlement that should be taped to the front desk

In 2023, a New Jersey psychiatry practice, Manasa Health Center, paid $30,000 to the HHS Office for Civil Rights and accepted a corrective action plan after staff responded to negative Google reviews by disclosing details about the reviewers and their conditions. A Texas dental practice had earlier paid $10,000 for the same behavior on Yelp. The pattern in both cases is identical: the practice thought it was defending itself, and every fact it used in its defense came from the patient's own record.

A med spa sits in the same legal posture with extra temptation, because aesthetic results are visible and disputed in public. The injector who replies that a reviewer's filler was placed correctly has just confirmed the person was a patient and disclosed their treatment. Two violations in one sentence, in public, permanently.

The three-line reply that cannot hurt you

The safe reply has a fixed anatomy. Thank the reviewer for the feedback. State, in general terms, that the practice takes patient experience seriously and follows up on concerns privately. Invite them to contact the office directly. That is the whole reply, for a one-star review exactly as for a five-star one. It confirms nothing, discloses nothing, and reads as composed to the next prospective patient, which matters because BrightLocal's survey found 37 percent of consumers weigh whether the business responded.

Ban the phrases that leak: your appointment, your treatment, when you came in, your results. Each one confirms the relationship. If a review is fabricated or violates platform policy, flag it through the profile and say nothing underneath it. Silence plus a flag is a strategy; a rebuttal is an exhibit.

Why the flow matters more than any single reply

Med spa discovery runs on fresh proof. BrightLocal's 2026 survey of 1,002 American adults found three in four consumers want reviews from the last three months, and 31 percent will only book with a business rated 4.5 stars or higher, nearly double the share a year earlier. A practice whose reviews stall for a quarter does not just look quiet. It falls under the freshness window its next patient is filtering by.

Build the ask into checkout and the two-week follow-up, the same neutral ask to every patient. Never screen for satisfaction first: selective solicitation is review gating, which Google prohibits and the FTC treats as deceptive, and in a medical setting it invites a second regulator into a conversation that only needed one.

Assign the keyboard

Most disclosure disasters are staffing accidents: whoever holds the phone answers the review. Fix it structurally. One named person replies, using the approved three-line form, with anything unusual held for the practice manager. Turn on new-review alerts so replies happen within a day while the discipline is fresh. The goal is boring: every reply identical in posture, every patient relationship unconfirmed, every month a fresh set of reviews the practice earned without filtering.

Related reading

Keep going with Should your med spa site explain weight management programs so AI assistants cite you?, Should your med spa site explain vitamin injections so AI assistants cite you?, and Should your med spa site explain dark circle treatments so AI assistants cite you?.

Frequently asked questions

Can a med spa confirm someone was a patient in a review reply?

No. Confirming the relationship discloses protected health information. Manasa Health Center paid $30,000 to the HHS Office for Civil Rights in 2023 after replies disclosed patient details. The safe reply thanks the reviewer in general terms and invites private contact, confirming nothing.

What should a med spa write back to a one-star review?

Three lines: thanks for the feedback, a general statement that patient experience is taken seriously and followed up privately, and an invitation to contact the office. No treatment names, no visit details, no corrections from the chart, and no offers in public.

How fresh do med spa reviews need to be?

Inside three months for most bookers. BrightLocal's 2026 survey found three in four consumers want reviews from the last three months, and 31 percent will only book a business rated 4.5 stars or higher. Keep a steady, unfiltered ask running at checkout and follow-up.

Is it legal to ask only happy patients to review us?

No. Sending only satisfied patients to Google is review gating, prohibited by Google and treated as deceptive by the FTC. Ask every patient the same way. The mix you get is the price of a review profile regulators and readers both trust.