Never confirm someone is a patient in a public reply. Stay generic: thank the reviewer for the feedback, acknowledge the topic without confirming any clinical detail, say the feedback has been shared internally. Avoid any names, treatments or appointment details, ever.
Dental practices play this on harder mode than other businesses. HIPAA in the US and equivalent privacy regulations elsewhere mean a single careless reply can become a compliance issue. The rule is simple: never confirm anyone is a patient in public.
The HIPAA safe template
Use this structure for every reply that touches clinical content:
- Thank the reviewer for the feedback (not for visiting).
- Acknowledge the topic in generic terms (not the procedure).
- Say the team is committed to the standard you hold.
- Stop. No invitations to call, email or come back in.
Templates by scenario
5 star praise about a hygienist
"My hygienist was so gentle, the best cleaning I've had."
Thank you for the kind words about our hygiene team. Gentle, careful care is something we take real pride in.
5 star praise mentioning treatment
"My new crown looks perfect, thank you Dr Patel."
Thank you for the lovely feedback. Our team works hard to deliver care that looks natural and feels comfortable, and this is brilliant to hear.
Complaint about wait time
"Waited 45 minutes past my appointment."
Thank you for the feedback. Running on time is a core commitment of ours and your note has been shared with our practice manager so we can review how we schedule.
Complaint about bill
"Was quoted one price and charged another."
Thank you for raising this. Clear, upfront pricing is something we take seriously and your feedback has been shared with our practice manager for review.
Vague 1 star
"Terrible experience."
Thank you for taking the time to leave feedback. We take every concern seriously and your note has been shared with our practice manager.
What never to write
- Anything that confirms the reviewer was a patient ("thanks for visiting us last Tuesday").
- Names of clinical team members (use "our hygiene team", "our practice manager").
- Treatment specifics ("the root canal", "your implant").
- Insurance details or payment history.
- Invitations to call or email a named person.
Why this matters even outside the US
GDPR, UK Data Protection and most national equivalents treat dental treatment as special category data. The same caution applies. A reply that confirms someone was a patient is processing personal health information in public, with no lawful basis.
How to keep the team safe at scale
Training is fine, automation is better. AutoReplyPilot's dental profile drafts every reply with the no clinical confirmation rule baked in, so a slip up is impossible by default.
Frequently asked questions
No. Using their name confirms they were a patient, which can breach HIPAA or your local equivalent. Use generic warm language instead.
No, even if they mentioned it first. Their disclosure doesn't entitle you to confirm it in your public response.
Don't post the call back publicly. Respond generically. If you have an internal way to identify them, contact them privately.
Want every reply pre drafted for you?
AutoReplyPilot drafts replies in your brand's voice the second a review lands. You glance, approve and move on.
Try the free generator