Dental Reputation Management: What Dentists Can and Cannot Legally Do

Search for advice on this topic and almost everything you find was written by a company selling review-request software. That is not a conspiracy, it is just how the page got built. But it leaves a blind spot, and the blind spot happens to be the part that carries a dollar figure.

The demand-side numbers get quoted a lot and they do not agree. Depending on whose survey you read, the share of patients who consult reviews before choosing a dentist lands anywhere from roughly 43% to 86%, with general local-business figures quoted as high as 98%. They all point the same direction and none of them tells you what to do on Monday.

This one is more useful. In an American Dental Association Health Policy Institute survey, 88% of dentists reported receiving online reviews. Of those, 52% had responded, and 39% said they were unable to respond because of HIPAA. Four in ten practices are sitting on reviews they will not answer, because nobody has told them what a safe answer looks like.

Source: American Dental Association, best practices for responding to online reviews.

If you are here because of a review that landed this morning, skip to answering a review without breaking HIPAA. Two instincts do the most damage in that first hour: replying with the details to set the record straight, and telling the team to go and collect five-star reviews this week. Both are covered below, and both are violations.

Why reviews decide your map pack position

Reviews do two jobs at once. The obvious one is persuasion: a patient comparing three practices reads the reviews before they call. The less obvious one is ranking. Google treats review signals as part of a business profile’s prominence, which is one of the inputs behind who appears in the three-result map pack for a search like “dentist near me.”

The part practices get wrong is chasing the rating instead of the pattern. A 4.7 with a couple of hundred reviews arriving steadily usually beats a spotless 5.0 built on nine reviews from three years ago. Recency and consistency say more about a working practice than a perfect average does, and a perfect average across a small sample is exactly the shape that draws scrutiny.

We cover the volume question separately in how many Google reviews you need to rank, and where reviews sit among the other inputs in our guide to local SEO ranking factors for dentists. This post is about the process, not the number.

One honest expectation to set before you start: review signals compound. Three to six months is a realistic window for a steady flow of new reviews to show up as movement in local rankings. Anyone telling you otherwise is selling something.

The advice Google prohibits

Review gating is the practice of screening patients by sentiment before deciding who gets asked for a public review. It usually looks harmless: a short satisfaction survey after the appointment, happy patients get the Google link, unhappy patients get an internal feedback form instead.

Google’s Maps content policy prohibits this directly. Merchants are not allowed to discourage or prohibit negative reviews, or to selectively solicit positive reviews from customers. The policy also rules out incentives of any kind, including offering something in exchange for revising or removing a negative review, and it treats reviews from anyone with a conflict of interest, current or former employees, contractors, family, as prohibited content.

Two further clauses catch practices that think they are compliant. Google prohibits merchants from asking staff to bring in a set number of reviews, and from asking staff to solicit reviews containing specific content, including content that names a staff member. Monthly review targets for the front desk and “please mention Dr. Sarah by name” are both violations as written.

Source: Google, Prohibited and restricted content, Maps User Generated Content Policy.

Enforcement is not theoretical. Google removes non-compliant reviews, and repeated rating manipulation can lead to restrictions on the profile itself. If that happens, the reviews are the smaller problem: we wrote about what recovery looks like in what to do when a dental Google Business Profile is suspended.

What if we have been doing this for years?

Common, and less alarming than it feels. There is no self-reporting obligation and nothing to confess. Turn the filter off, stop any staff target or scripted request, and carry on. Reviews you already collected stay where they are, you cannot remove them and Google is not asking you to, since what the policy governs is how you collect from here. The exposure comes from continuing after you know, not from having done it before you did.

The FTC rule that made this fineable

Google can remove your reviews. The Federal Trade Commission can fine you.

The FTC’s Rule on the Use of Consumer Reviews and Testimonials is already in force. It prohibits buying or selling fake reviews, reviews written by insiders without a disclosed connection, and the suppression of honest negative reviews. Because it is a trade regulation rule rather than case-by-case guidance, the FTC can seek civil penalties for knowing violations, and the per-violation maximum is adjusted for inflation each year. The agency has already sent warning letters to companies over review practices under it.

Source: FTC, Consumer Reviews and Testimonials Rule: Questions and Answers.

For a dental office, the three things most likely to catch you are small and ordinary. A hygienist writing a glowing review without disclosing that they work there. A spouse posting one to get the profile started. A gift card raffle for anyone who leaves feedback this month. None of those feel like fraud from the inside. All three are covered.

Answering a review without breaking HIPAA

This is the section that has nothing to do with marketing and everything to do with why dental practices cannot follow generic reputation advice.

When a patient leaves a review, they choose what to disclose about themselves. You do not get to match them. Confirming that the reviewer is a patient, naming them, or referencing their treatment, their appointment, their insurance, or their balance, is a disclosure of protected health information. It does not become permissible because they mentioned it first, and it does not become permissible because the review is unfair.

The Office for Civil Rights has enforced this against dental practices specifically. A Dallas practice paid $10,000 after responding to Yelp reviews with patient names, treatment details, and insurance and cost information. A California practice paid $23,000 for disclosing patient names, treatment, and insurance information in responses to online reviews. A North Carolina practice drew a $50,000 civil money penalty over a review response, having not contested the findings. In each case OCR also found the practice had no policy governing disclosures on social platforms.

Sources: HHS OCR press release and the HHS resolution agreements index.

The safe response is shorter than the one you want to write, and it is short on purpose.

The same rule applies to good reviews, and almost nobody follows it

This is where most practices actually slip, because a warm reply to a kind review feels like the opposite of a compliance problem.

The ADA’s guidance is explicit: do not acknowledge a reviewer was a patient whether the review is positive or negative, and offer no hint as to their identity. “Thanks so much, Sarah, we’re thrilled the implant healed up well” confirms patient status and names the treatment. Same disclosure as the negative example above. The difference is that nobody complains about it, which is why it goes unnoticed until someone does.

If your profile already carries a run of replies using patient first names, go back and edit them. Google lets you change a response at any time and the edit replaces the original publicly. Work backwards from the most recent, swap each one for the generic version, and it is an hour of work rather than a project.

Is the review request itself a HIPAA problem?

Reasonable question, and the one that stops careful practices from sending anything at all. Asking a patient for a review is not a disclosure to the public. But routing that request through outside software hands a vendor a name, a number, and the fact that this person was treated at your office, which is what a business associate agreement exists to govern.

The practical version: if a review tool touches your patient list or practice management software, ask for a signed BAA before you turn it on. Established dental vendors expect the question. One that treats it as unusual is telling you something. Keep the message itself generic, a thank-you and a link with no treatment detail, and confirm with your compliance officer that your notice of privacy practices covers it.

Getting a review taken down, and what is realistically removable

You cannot pay to remove a review, and any service offering to is selling you either nothing or a policy violation. What you can do is flag content that breaks Google’s rules, which is a narrower set than most practices hope.

Genuinely flaggable: reviews containing personal information, off-topic content and personal rants, profanity used to attack, impersonation, content from someone with a conflict of interest such as a competitor or a former employee, and fake engagement from accounts with no real experience of your practice. Not flaggable: a real patient describing a real visit in terms you find unfair. Google does allow content that describes negative experiences in a respectful manner, and a one-star review of an appointment that genuinely happened is exactly that.

To flag one, open the review in your Business Profile, use the report option, and name the specific policy it breaks rather than saying it is unfair. Then wait. Flags are not resolved instantly, the first outcome is often no action, and an appeal is available after that. Treat removal as a long shot, not a plan.

Why your reviews keep disappearing

The opposite complaint is more common than the removal request: six patients leave reviews and three are gone by Friday. Google filters automatically, and the trigger is usually the collection pattern rather than any individual review. Several arriving in a short burst, several from the same office IP or a shared tablet at the front desk, several with wording that repeats because someone was handed a script, a cluster of accounts with no other review history. None of that requires bad intent, and the policy flags unusual volume or patterns regardless of intent.

Which makes this the same problem as the rest of the post, arriving from the other direction. A steady trickle of genuine reviews from patients’ own phones survives. A campaign does not, and there is no appeal for a filtered review the way there is for a rejected flag.

Reviews from people who were never your patients

Mistaken identity between similarly named practices, a review left on the wrong profile, an ex-employee, a competitor. These are the most winnable removals because they fall squarely inside the conflict-of-interest and fake-engagement rules, and they are worth flagging properly with a clear explanation.

Two cautions. You still cannot say “this person was never a patient here” in a public reply, because denying patient status still discusses an identified person’s relationship with a provider. Make the case through the flag, not the comment box. And on legal action, the ADA’s position is that it should be a last resort, since the publicity can do more damage than the original post.

A review process that is compliant and works

Removing the filter does not mean giving up control. It means moving your effort from screening patients to fixing the reasons they would complain, which is the harder and more useful version of the same job.

1. Ask every patient, without exception. Same message, same timing, no judgment call at the desk about who “seems happy.” This is the one change that makes the rest of the process compliant.
2. Ask soon, and ask by text. The window right after an appointment is when the visit is still fresh. Text response rates generally beat email for this, which is why most practice software defaults to it.
3. Run service recovery in parallel, not in front. Call patients you know had a rough visit and fix it directly. That is good practice and entirely allowed. What is not allowed is making that call a condition of whether they get asked for a review.
4. Keep the message plain, at the desk and in the text. No incentive, no requested wording, no staff name to mention, no target number for the team. Give the front desk one sentence and let them use it every time: “We’ll text you a link in a bit, if you have a minute to leave a review it really helps us.” That is compliant, it asks everyone, and it steers nothing.
5. Respond to everything, and keep both kinds generic. One neutral thank-you line for positives, the disclosure-free pattern above for negatives. No names, no treatments, no “great to see you again,” on either. Consistency matters more than warmth here, and a template removes the judgment call from whoever is covering the desk that day.
6. Watch more than Google. Google drives the map pack and deserves the effort, but patients also land on Yelp and Healthgrades, and those profiles often exist whether you created them or not. Claim them, make sure the name, address, and phone match your Business Profile exactly, and set an alert so a review there does not sit unanswered for four months.
7. Read the themes, not the stars. Three reviews mentioning the wait and two mentioning the phone is an operations report. The wait time, the hold music, the front desk on a Monday: fix the cause and the rating follows without anyone managing it. This is the part that actually replaces gating, because a filter only ever hid the problem you are now solving.

Software, agency, or your front desk

All three work. The right answer depends on patient volume and whether anyone will own the process when the week gets busy.

Past that disqualifier, the features worth paying for are unglamorous: requests that send automatically so nobody has to remember, monitoring and alerts across every profile you claimed, a shared response template library so replies stay consistent and disclosure-free, reporting by location if you run more than one site, and a signed BAA. Everything else is packaging.

If you run more than one location

Multi-location practices have a different problem, and it is rarely volume. One site quietly drags the group average while blended reporting looks healthy, and a request process built for one front desk stops being followed at the third office. Report by location, not in aggregate, and note that a group-wide review target is exactly the staff quota Google names as a violation.

Reviews, AI search, and why manipulation is a bigger risk than it was

AI assistants are increasingly part of how people find a local provider, alongside the map rather than instead of it. That changes the stakes on this topic in a way none of the older advice accounts for.

A human skimming reviews forgives an odd pattern. A system summarizing a business looks at the shape of the whole profile, and an unnatural shape is a reason to recommend somebody else. Near-identical five-star reviews arriving in the same week, a spotless average with no critical feedback anywhere, wording that repeats across reviewers: those read as engineered. Being filtered quietly is worse than ranking poorly, because nothing in your reporting tells you it happened.

The reassuring part is that there is no second workflow to run. A genuine review flow with a real spread of ratings and consistent, disclosure-free responses is what earns trust from a person, from Google, and from an answer engine at the same time. That overlap is most of what our AI search visibility work depends on.

Where reviews stop being enough

Reviews are one prominence signal. They cannot compensate for a profile in the wrong primary category, an address and phone number that disagree across directories, or a website Google struggles to associate with the treatments you actually sell. We have watched practices grind out a hundred genuine reviews and stay stuck at position seven, because the thing holding them back was never review volume.

That work sits in Google Business Profile management and local SEO and the map pack. Reviews and reputation management is not something we sell, deliberately, because a compliant review process is mostly a front desk habit and you should not be paying an agency a monthly fee for it.

Questions dentists actually ask

Can a dentist respond to a Google review?

Yes, and it is worth doing. The response just cannot confirm the reviewer is a patient or reference their care, billing, or visit. Thank them, respond in generalities, and move specifics to a private channel. This applies to positive reviews too.

Can we thank a patient by name for a good review?

No. Using their name in your reply confirms they are a patient, and the ADA’s guidance is to avoid acknowledging patient status whether the review is positive or negative. A generic thank-you carries the same warmth without the disclosure.

Is it illegal to ask only happy patients for reviews?

It violates Google’s Maps content policy, which prohibits selectively soliciting positive reviews, and it falls under the FTC’s rule on review suppression. Google can remove reviews or restrict the profile. The FTC can seek civil penalties for knowing violations.

Can we offer a discount or a raffle entry for a review?

No. Google prohibits incentives of any kind in exchange for a review, including anything offered for revising or removing a negative one. The FTC rule covers the same ground.

Can our team members leave reviews for the practice?

No. Google treats current or former employment as a conflict of interest, and the FTC rule requires insiders to disclose their connection. Family members fall under the same conflict-of-interest language.

Can you pay to have a negative review removed?

No, and any service claiming otherwise is worth avoiding. You can flag a review that breaks Google’s policies: personal information, an off-topic rant, or a conflict of interest. An unflattering review of a real visit is not removable, and Google explicitly allows negative experiences described respectfully.

Someone who was never our patient left a review. What now?

Flag it and name the policy, since conflict of interest and fake engagement are the more winnable grounds. Do not deny patient status in a public reply, that still discusses an identified person’s relationship with a provider.

Do we need a business associate agreement with our review software?

If the tool touches your patient list or practice management system, ask for one before switching it on. Established dental vendors expect the question. Confirm the specifics with your own compliance officer, since this depends on how the tool is configured in your practice.

Should we sue over a defamatory review?

The ADA’s position is that it should be a last resort, partly because the publicity can do more damage than the review did. Exhaust flagging and a calm public response first, then take the question to your attorney rather than deciding it in the moment.

We have been screening patients for years. Are we in trouble?

There is no self-reporting obligation and nothing to disclose. Switch the filter off, drop any staff target, and leave the reviews you already have alone. The risk sits in continuing, not in having done it before you knew.

Our reviews keep disappearing. Why?

Usually automatic filtering triggered by the collection pattern rather than by any one review: a sudden burst, a shared device at the front desk, or repeated wording from a script. Google flags unusual volume and patterns regardless of intent, and filtered reviews have no appeal route.

How long before new reviews affect our ranking?

Three to six months for a steady flow to show up as meaningful movement, and longer in a competitive metro. Review signals compound rather than switching on.

Everything above is something a practice can run itself, it just needs someone to own it when the week gets busy. If the profile underneath it is the part that is actually holding you back, that is what our Google Business Profile management work is built around.

Shubham Gupta

Founder, Elvora

Shubham has worked in SEO since 2020, with time spent on consumer brands, inside agencies, and directly with dental practices, before building Elvora around dental and orthodontic practices exclusively. That background shapes how Elvora runs: honest, plain-English reporting, clients keeping full ownership of their own accounts, and success measured in booked appointments and revenue rather than vanity metrics. He is the person you actually work with, not a rep who hands you off after signing.

Connect on LinkedIn