Healthcare professionals: replying to Google reviews without breaching confidentiality

The trap: confirming the person is your patient

In most trades, a good reply starts by picking up what the customer experienced. For a healthcare professional, that is exactly what not to do. "We're sorry your root canal was painful" publicly confirms that an identifiable person was treated at your practice, and for what.

The GDPR classes data concerning health among the special categories of personal data, whose processing is prohibited in principle, and includes information on the provision of health care that reveals a person's health status¹. If your profession is bound by professional secrecy, it also applies to what you write online.

The fact that the patient described their treatment in their review changes nothing: they chose to make it public, not you. Don't use it to confirm anything.

What Google allows, and what it prohibits

Google's policy prohibits publishing personal information without consent, medical information included². On the other hand, it allows reviews that name a professional working under their own name, and gives doctors and lawyers as examples²: your name in a review is therefore not, on its own, a reason for removal.

A review can be reported if it breaks Google's policies, for example if it contains insults or isn't based on any real experience, but not because it is negative³.

The right reply: general, courteous, focused on the practice

The golden rule: talk about how your practice works, never about the patient.

Avoid: "At your appointment on the 12th, we found that…"

Prefer: "Thank you for your message. Out of respect for confidentiality, we never comment on an individual situation online. If you wish, call the practice: we'll take the time to talk it through with you. — Dr Martin"

For a positive review: "Thank you for this message, which the whole practice team is delighted to read."

For a review about organisation (waiting times, the front desk, access), you can reply about the organisation, without going back to the patient:

"Late-afternoon delays are our weak point, and we know it. We have lengthened afternoon appointment slots to reduce them."

What you should never write

• confirming or denying that the person is a patient of the practice;
• mentioning a procedure, diagnosis, treatment or appointment date;
• publicly contradicting the patient with details from their file;
• replying in the heat of the moment: an unfair review is handled with a cool head.

The rules that apply to every trade are gathered in what a reply must never contain.

What if the review is defamatory?

Report it to Google if it breaks its policies³: its policy covers in particular unsubstantiated allegations of dishonest behaviour or criminal acts². Beyond that, contact your professional body or a lawyer: the remedies depend on your country.

ReplyTop for practices

Your instructions to the AI (from the Starter plan) let you apply this framework to every reply: never mention any care, date or individual situation, and sign on behalf of the practice. 1- and 2-star reviews always wait for your review; for a practice, we also advise turning off automatic publishing, so you can read every reply before it goes out.