No. Asking only the patients who seem satisfied is review gating, which Google's policy and the FTC's 2024 rule address, and the larger risk for a medical practice is what happens after the review is posted, because replying to a review can disclose patient information. The bottom line: GoHighLevel can send a review request to every patient, and the practice's reply policy should be written down before the first review arrives.
The general review rules
Google's contributed content policy, as quoted by review management vendors, prohibits businesses from discouraging negative reviews or selectively soliciting positive reviews, and bans incentives for reviews. The FTC's Consumer Reviews and Testimonials Rule took effect October 21, 2024 and targets fake reviews, incentives conditioned on sentiment, and certain suppression. Commentary is not uniform on how the federal rule applies to each gating scenario, so ask counsel. The practical rule is simple: send the request to everyone, at the same point in the process, and offer nothing in return.
The HIPAA risk is in the reply
OCR has enforced this repeatedly. A dental practice paid $10,000 in 2019 after responding to a Yelp review with a patient's last name, treatment plan, insurance, and cost details, and OCR found it had also disclosed other patients' information in replies. OCR imposed a $50,000 civil money penalty on another dental practice for disclosing patient information on a webpage in response to a negative review, New Vision Dental paid $23,000 in 2022, and Manasa Health Center, a New Jersey psychiatry practice, paid $30,000 in 2023 after replying to four patients' Google reviews with comments about their diagnoses. A HIPAA Journal review of 80,300 public Google review replies from 2,972 practices found risk in how healthcare practices reply. A compliance firm advises that the only permissible replies are a thank you or an invitation to contact the office.
| Review | Safe reply |
|---|---|
| Positive review | A generic thank you that does not confirm the reviewer is a patient, or no reply |
| Negative review | No details. Invite the person to contact the office by phone |
| Review that names a diagnosis or staff member | Do not reply publicly, and consult the compliance lead |
| Review from someone who may not be a patient | Do not confirm or deny, and report to the platform if it is false |
Build it in GoHighLevel
GoHighLevel's help portal has a Review Requests section covering customized request messages by text and email. A third party guide describes Reviews AI as drafting or posting replies to Google reviews, so confirm in your account that drafts require approval.
- Connect the practice's Google Business Profile in the reputation settings.
- Write a plain request that thanks the patient and links to the review page, with no incentive and no satisfaction question first.
- Build a workflow with the Appointment Status trigger set to Showed Up that waits 2 days and sends the request to every patient with a documented contact preference, once, with a reminder 7 days later for those who did not click.
- Exclude patients tagged Complaint, and route their complaints to the practice manager.
- If Reviews AI is on, set it to draft only and have the compliance lead approve every reply.
- Write the reply policy from the table, and train every person who can post.
Worked example
For example, a practice with 1,000 visits a month sends 1,000 requests. At a 5 percent review rate, that is 50 new reviews a month (1,000 times 0.05), and every one is authentic and unscreened.
Mistakes to avoid
- Screening first. Google names selective solicitation.
- Defending the practice in a reply. OCR has penalized this repeatedly.
- Autopilot replies. Use drafts and approval.
- Offering a discount. Google bans incentives.
How this was handled before
Practices relied on directory listings and word of mouth. Review sites changed that, and OCR's settlements over replies show that the new risk for medical practices is what they say back, not only what patients say.
What to measure after launch
Track requests sent, clicks, new reviews, and replies approved by the compliance lead. Audit every reply posted against the written policy each quarter.
Check before you switch it on
US text messages sent from a standard 10 digit number need A2P 10DLC registration. The HighLevel support portal says registration is required for texts to US recipients from 10 digit long code numbers and that toll free numbers do not require it. HighLevel's opt in guidelines also say a person cannot be forced to agree to text messages in order to submit a form, so keep the consent box optional. One compliance guide separates informational texts, which need documented consent, from marketing texts, which need prior express written consent. Ask your attorney which category your reminders fall into. Have counsel confirm how your state and HIPAA treat review requests, and have the compliance lead sign off on the reply policy. This is general information, not legal advice.
Questions people ask
Can a practice reply to a negative review?
Only with a generic response or an invitation to call. OCR has settled cases with practices that disclosed patient information in replies.
Is screening patients before a review request allowed?
Google's policy prohibits selectively soliciting positive reviews. Send the request to everyone.
What have OCR settlements been?
$10,000 for Elite Dental in 2019, $23,000 for New Vision Dental in 2022, and $30,000 for Manasa Health Center in 2023, plus a $50,000 penalty against another dental practice.
Ready to try it yourself? Start a GoHighLevel account here.
You can also see this in action in our GoHighLevel capabilities demo.