Answer · Healthcare
Can a practice use AI to reply to a patient review?
To draft, yes. The danger is not the drafting — it is that confirming somebody is a patient is itself a disclosure.
To draft, yes. But a reply that confirms the person was a patient, or engages with the clinical detail they posted, is a disclosure — and the patient posting first does not authorise the practice to respond in kind.
This is the most reliably breached rule in a medical practice's public communications, and it was breached long before any drafting tool existed. Enforcement actions have repeatedly concerned practices responding to online reviews with details about the complainant's treatment, appointments or payment history. The reasoning is not subtle: protected information includes the fact that a person received care, so a reply that engages with the substance of a review confirms it and usually adds to it.
The asymmetry is what people find counter-intuitive and it holds absolutely. A patient may disclose their own information to anyone, including the internet. That disclosure is theirs to make and it grants the practice nothing. A public complaint therefore leaves the practice with less room to respond than any other business has, which is a genuinely unfair position and is nonetheless the position.
So the reply that is safe is one that would be identical if the reviewer had never been a patient. An acknowledgement that feedback is taken seriously, a statement of the practice's general approach, and an invitation to make contact through a named route. It says nothing about the person, confirms nothing, and corrects nothing. It is also, unhelpfully, the reply that reads as evasive — which is precisely why practices deviate from it under provocation.
A drafting tool changes the risk in one specific way and it is worth naming. Asked to reply to a review, a model will use everything in front of it, and it is good at sounding reasonable. Given the review text, it will engage with the review's claims, because that is what a helpful reply does. Given access to the record, it will correct them. Both outputs read as measured and professional, and both are disclosures. The tool is not being careless; it is doing the task as stated, and the task as stated is the problem.
The construction that works is to change the task rather than to review the output. Ask for a reply that does not reference any specific fact from the review, or draft from the practice's approved response patterns rather than from the review text at all. Not giving the tool the record is the other half, and it is the easier half. A drafting workflow that never sees the chart cannot correct the reviewer with it.
Two other things are worth settling once, because both come up under the same pressure. Requesting reviews from patients is permitted but marketing rules govern how it is done and what it may say. And responding privately is not automatically safer — a message through a review platform, or an email, still passes through a third party and still confirms the relationship to whoever handles it. The correct escalation route is one the practice already uses for patient communication, and inviting the reviewer into it is the whole content of a good public reply.
The patient may publish whatever they like about their own care. The practice may not confirm a word of it, and the asymmetry is the entire rule.
Siddharth Sharma, Context Theory
Related questions
Can we correct a review that is factually wrong?
Not publicly, and this is the case where practices most often decide the rule cannot mean what it says. It does. The available responses are the generic public reply, an invitation to a private channel the practice already uses for patient communication, and where the review breaches the platform's own rules, a report to the platform. None of them feels adequate against a false public statement, and all of them are better than the outcome of correcting it.
Does an anonymous review change anything?
It changes what the practice knows, not what it may say. If the practice cannot tell whether the reviewer was a patient, a reply engaging with the detail either confirms a relationship or invents one, and the first is the problem. It also removes any temptation to look the person up, which is worth stating explicitly to staff, because searching the record to identify a reviewer is an access with no treatment or operations purpose behind it.
METHOD
Every figure below carries its source and the date it was verified. Nothing on this page is asserted.
The numbers on this page.
| What | Value | Specific to |
|---|---|---|
| Dentists & dental services CPC | $8.00 | Category-wide |
| Firms that never responded to a web enquiry at all | 23% | Category-wide |
LocaliQ / WordStream Search Advertising Benchmarks 2026 · Google + Microsoft Ads, 20 industries · Apr 2025–Mar 2026 · verified
Oldroyd, McElheran & Elkington, "The Short Life of Online Sales Leads", Harvard Business Review (March 2011) · 1.25M inbound leads across 2,241 US firms · verified
What is specific to this page.
| Kind | Claim | Check it against |
|---|---|---|
| Regulation | The fact that a person received care is itself protected information, so a public reply engaging with the substance of a review confirms a treatment relationship and typically elaborates on it, which is a disclosure regardless of what the reviewer published first. | Federal enforcement actions concerning practices' responses to online reviews, and the definition of protected health information they apply. |
| Constraint | A patient's own disclosure of their information grants the practice no corresponding permission, which leaves a medical practice with materially less room to answer a public complaint than an unregulated business has. | The authorisation requirements for disclosure, checked against whether anything in a public review constitutes one. |
| Workflow | A drafting tool given the review text will engage with its claims and one given record access will correct them, because both are what a helpful reply looks like, so the failure comes from the task as stated rather than from carelessness in the output. | Asking a configured tool to reply to a sample review and marking every sentence that confirms or contradicts a fact about the reviewer. |
| Software | Replying through a review platform's private messaging or by email is not automatically safer, since the message still passes through a third party and still confirms the relationship to whoever handles it. | Identifying which channels the practice already uses for patient communication under an existing agreement, and whether the review platform is one of them. |
Each row would be wrong on another industry's page. Where a sourced figure exists it is in the table above instead; these are the constraints that shape the work and do not happen to be numbers.
Start with the measurement.
Reading about a benchmark is not the same as knowing your own number. The audit produces yours, measured rather than estimated.
$497 · delivered in 5 business days · credited against month one