HIPAA does not stop a psychiatry practice from asking patients for Google reviews. It restricts what you disclose publicly, which is a separate activity. You can ask every patient, provided the request itself carries no clinical detail and no incentive: a post-visit text with a direct review link, a QR code at checkout, and passive links in your email signatures and website footer will do most of the work. The compliance risk sits almost entirely in your replies. Never confirm publicly that a reviewer was a patient, and never mention a diagnosis, medication, or appointment, even when the reviewer raised it first.
That distinction is worth $30,000, which is what one psychiatry practice paid to learn it.
In June 2023, a practice in Kendall Park, New Jersey settled a HIPAA complaint with the Office for Civil Rights. Nobody had lost a laptop or been hacked. A patient left a negative Google review, and someone at the practice wrote a reply that referenced the patient’s diagnosis and treatment. OCR investigated and found the same thing had happened to three other patients.
Manasa Health Center settled without admitting wrongdoing, paid the $30,000, agreed to two years of monitoring under a corrective action plan, and had to send breach notification letters to all four patients.
That case is why plenty of psychiatry practices sit on twelve reviews while the clinic down the road has two hundred. The fear is rational. It’s just aimed at the wrong activity.
A note before we start: this is marketing guidance informed by published enforcement actions and federal rules, not legal advice. Run your final policy past a healthcare attorney who knows your state.
What HIPAA actually restricts here
HIPAA governs what you disclose about a patient. It says almost nothing about what you ask a patient to do.
You can invite someone to review your practice. You can send them a link. You can put a QR code on the front desk. None of that discloses protected health information, because the patient already knows they’re your patient, and you’re not telling anyone else.
The problem starts the moment you say something public that confirms a specific person received care from you. And in psychiatry, that bar is lower than in most specialties. Confirming that someone is your patient reveals that they sought mental health treatment. That fact alone is protected. You don’t need to mention a diagnosis to cause a disclosure.
So the working rule is:
- Asking for a review: fine, with conditions on how you ask.
- Replying to a review in a way that confirms the reviewer is or was a patient: not fine.
- Replying to a review with any clinical detail: definitely not fine.
Everything below follows from that split.
Why psychiatry is harder than dermatology
Generic advice on medical reviews assumes patients are happy to be identified. Psychiatric patients often aren’t, and a review strategy that ignores this will underperform and irritate people. This is one of the reasons mental health marketing rarely transfers cleanly from other specialties.
Three things are different.
Public identification carries a cost. A patient who leaves a five-star review for a knee surgeon is telling the world they had a knee problem. A patient who leaves a five-star review for your psychiatry practice is telling their employer, their family, and anyone who searches their name that they are in mental health treatment. Plenty of patients who love their care will still decline, and that’s a reasonable choice, not a failure of your ask.
The therapeutic relationship complicates the ask. There’s an ethical question underneath the compliance one. Asking a patient in an active, dependent clinical relationship to do you a public favor introduces a small pressure that doesn’t exist at a dental checkout. The safest approach is to make the ask systemic rather than personal, which I’ll come back to.
Some practices carry an extra rule. If any part of your practice is a federally assisted program that diagnoses or treats substance use disorder, 42 CFR Part 2 applies on top of HIPAA. Part 2 has historically been stricter, and the 2024 final rule brought civil and criminal penalties and breach notification requirements in line with HIPAA. Compliance was required from February 16, 2026. Not every psychiatry practice is a Part 2 program, and the definition is specific, so check rather than assume. If you run a ketamine or MAT service line, this is worth an hour with your attorney.
Three things to set up before you ask anyone
Verify and finish your Google Business Profile. Reviews only display on a verified profile. If yours isn’t verified, everything downstream is invisible, and the rest of your local SEO for psychiatry clinics works harder than it needs to.
Create individual profiles for each prescriber. Patients search for the clinician, not the LLC. A group practice with four psychiatrists and one profile is leaving three review streams unclaimed.
Generate your direct review link. In your Google Business Profile dashboard, use the “Ask for reviews” option to copy the short link that opens the review form directly. Every touchpoint below uses that one link. If a patient has to search for you, most won’t finish.
Then write the policy down. A one-page document covering who can ask, what the approved wording is, who is authorized to respond, and what nobody may ever say. In the Manasa case, OCR found not just the disclosures but a failure to have privacy policies and procedures in place. A written policy is cheap protection.
Nine ways to ask that hold up
1. Post-visit text, sent to everyone
A text 24 hours after the appointment, with the direct link, converts better than any other channel. The message must contain nothing clinical:
Thanks for visiting [Practice Name]. If you have a moment, we’d appreciate hearing about your experience: [link]
No provider name, no appointment type, no “we hope your medication adjustment is going well.” Someone else may see that screen. If you’re running this through intake automations, audit what the system actually merges into the template rather than trusting the preview.
2. Email follow-up three days later
Catches the people who ignored the text. Same content rules. A two-step sequence meaningfully outperforms a single send.
3. A QR code at checkout
Frame it at the front desk with neutral wording. This is the highest-value channel in psychiatry specifically, because it lets the patient decide privately. Nobody has to watch them decline.
4. Passive links everywhere
Website footer, contact page, staff email signatures, appointment confirmation emails. These generate slow, steady volume with no ask and no awkwardness, which suits this specialty better than it suits most.
5. A dedicated reviews page
A page displaying your Google reviews serves prospective patients researching you and gives current patients an obvious place to contribute. Most clinic websites have nowhere sensible to put a review link, which is why the ask dies at the front desk.
6. Verbal invitation from front desk, not the clinician
Train the front desk to make the ask at checkout. Keeping it away from the treating psychiatrist removes the power imbalance. The script stays short:
If you ever have a moment, a Google review helps other people find us.
Then hand over a card with the QR code and stop talking. No follow-up, no second ask.
7. Attach it to your satisfaction survey
If you already send post-visit surveys, add a closing line offering the public review option. People who finished a survey are already engaged.
8. Respond to the reviews you have
Practices that reply consistently earn more reviews than practices that don’t. Prospective reviewers can see whether feedback gets acknowledged. Just reply within the rules in the next section.
9. Make it routine
The practices with three hundred reviews didn’t run a campaign. They put review generation on the monthly ops agenda and let it compound. Fifteen a month for two years beats any one-off push, and recency carries weight in local ranking.
What will get you in trouble
Incentives. The FTC’s Rule on the Use of Consumer Reviews and Testimonials, 16 CFR Part 465, took effect on October 21, 2024. It prohibits providing compensation or other incentives in exchange for, or conditioned on, a review expressing a particular sentiment. The condition can be implied as well as stated, and disclosing the incentive doesn’t cure it. Civil penalties run up to $51,744 per violation. Google’s own review policies prohibit incentivized reviews independently of the FTC rule. No gift cards, no raffle entries, no discounted follow-up.
Fake reviews. The same rule bans creating, buying, or disseminating fake reviews, including AI-generated ones and reviews from people with no genuine experience of the practice. Reviews written by staff without disclosing their connection are covered too. Google detects clustered patterns and penalizes the whole listing, not just the offending review.
Review gating, with a caveat worth getting right. Gating means surveying patients first and only routing the happy ones to Google. Most articles state flatly that this is illegal. That’s imprecise. The FTC’s own guidance says the rule “does not contain a specific prohibition against such conduct,” while noting it could still violate the FTC Act under the Endorsement Guides. Google’s review policies separately discourage it. So: don’t gate, but understand the actual reason. It skews your public rating in a way regulators can treat as deceptive, and it wastes the negative feedback you needed to see.
There’s a psychiatry-specific reason to avoid it too. Filtering by satisfaction means building a list of who was and wasn’t happy with their mental health treatment, which is a data set you’d rather not create.
Anything clinical in the request itself. A review request that references a specific procedure, diagnosis, or appointment detail can be an impermissible disclosure on its own. Check what your practice management system actually merges into the message template.
Responding without confirming anyone is a patient
This is where the money is lost. Here is the framework.
Never write anything that confirms the reviewer received care from you. Not “thank you for trusting us with your treatment.” Not “we’re sorry your appointment ran late.” Both confirm the relationship.
Never reference a diagnosis, medication, session, or date, even if the reviewer mentioned it first. The patient’s decision to disclose their own information does not authorize you to discuss it.
Keep responses generic enough that they would make sense if written by a business that had never met the reviewer.
| Situation | Safe response | Why it works |
|---|---|---|
| Positive review | “Thank you for the kind words. Feedback like this means a lot to our team.” | Acknowledges without confirming care |
| Negative review, no clinical detail | “We take all feedback seriously and would like to understand more. Please contact our office at [phone].” | Moves it offline, confirms nothing |
| Review containing diagnosis or treatment detail | “We appreciate all feedback. Privacy rules prevent us from discussing any specific care publicly. Please contact our office directly at [phone].” | States the constraint without engaging it |
| Review that appears to be for another practice | “Thank you for reaching out. Please contact our office at [phone] so we can look into this.” | Never say “you were never our patient” |
That last row matters more than it looks. Publicly denying that someone was your patient is itself a statement about their patient status. Handle mix-ups privately.
One more control: nobody responds while angry. Draft, wait an hour, have a second person read it. In psychiatry the reviews that provoke a defensive reply are often the ones written during a difficult period, and those are exactly the replies that end up in an OCR complaint.
When a review discloses the patient’s own diagnosis
This happens constantly in mental health and the instinct to correct the record is strong. Resist it.
Use the third template above, respond once, and stop. Then reach out privately through whatever contact route you legitimately have. If the review contains detail that could harm the reviewer, you can flag it to Google, though removal is not likely.
What you cannot do is answer the substance. A reviewer saying “Dr. X refused to refill my Adderall” does not license you to explain the clinical reasoning publicly. That reply would confirm patient status and disclose treatment detail in a single sentence.
Fake and defamatory reviews
You can’t get a legitimate negative review removed for being unfair. You can flag reviews that breach Google’s content policies: fabricated reviews, spam, competitor attacks, off-topic content. Report through the Google Business Profile interface, expect it to take weeks, and expect to appeal.
The durable defense is volume. A practice with 200 reviews absorbs a one-star without much movement in its average. A practice with 12 does not. That, rather than any takedown tactic, is the real argument for a steady review program, and it compounds with the rest of your search visibility.
The vendor question nobody asks
If you use a third-party platform to send review requests, you’re likely uploading patient names, phone numbers, and appointment timings into it. That’s protected health information, and the vendor is handling it on your behalf.
Ask for a business associate agreement before you upload anything. If a vendor won’t sign one, or doesn’t know what you’re asking for, that answers the question. Same applies to any automation layer sitting between your EHR and the messaging tool.
Also check what the integration actually sends. Some platforms default to merging appointment type or provider specialty into the message body. For a psychiatry practice, or a Spravato clinic where the treatment name alone signals a diagnosis, that’s a disclosure waiting to happen.
A 90-day plan
Days 1 to 14. Verify the Google Business Profile, complete it, create individual prescriber profiles, generate the review link. Write the one-page policy and get it signed off. Confirm the BAA with any vendor in the chain.
Days 15 to 30. Train front desk on the verbal ask and the response templates. Print QR cards. Add the link to email signatures, website footer, and confirmation emails.
Days 31 to 60. Turn on the automated text at 24 hours and the email at day three. Audit the actual outbound message content, not the template you were shown. Start responding to every existing review using the table above.
Days 61 to 90. Review the numbers. Look at request-to-review conversion by channel, not just total count. In psychiatry the passive channels usually outperform the direct ones, which is the opposite of what happens in dental, so don’t benchmark against generic healthcare figures. If you’re building this alongside other search work, the healthcare SEO starter checklist covers what else should be running in parallel.
Then keep going. The practices that win here treat it as a standing operational habit rather than a project with an end date.
Frequently asked questions
Is responding to a Google review a HIPAA violation?
Responding isn’t a violation. Confirming that the reviewer is a patient, or referencing any clinical detail, is. The Manasa Health Center settlement involved responses that named diagnoses and treatment.
Can a psychiatry practice ask patients for Google reviews?
Yes. HIPAA doesn’t prohibit inviting patients to leave reviews. The restrictions are on incentivizing them, referencing clinical details in the request, and what you say in public responses.
Can I be sued for a negative Google review?
Defamation claims against reviewers are possible but rarely worth it, and in healthcare they carry an extra hazard: litigation can put patient information into the public record. Most practices are better served by responding within the rules and building review volume.
What if a patient shares medical details in their review?
Respond once with a generic acknowledgement that cites privacy rules, invite them to contact the office, and take it from there privately. Their disclosure doesn’t authorize yours.
Can I offer a discount for a review?
No. The FTC rule bars incentives conditioned on a review expressing a particular sentiment, and Google’s policies prohibit incentivized reviews outright.
How many reviews does a psychiatry practice need?
It depends on the market. What matters more than a raw count is recency and consistency. Recent reviews carry more weight in local ranking than a large but stale profile.
Getting this running in your clinic
Most practices don’t have a review problem. They have an unwritten policy, a nervous front desk, and no system. The compliance rules above are narrow and learnable. The operational habit is the harder part.
If you’d like a second pair of eyes on your review workflow before you turn it on, book a call and we’ll walk through it.
