Managing Online Reviews Within FTC and HIPAA Rules

For a local practice or a small brand, reputation is mostly what shows up next to your name online: star ratings and reviews on Google, Yelp, Healthgrades, Amazon or your own product pages. Those reviews shape who books, who buys, and increasingly what AI assistants say about you.

Three sets of rules limit how you can earn and respond to them. The FTC's review rule applies to almost every business. Platform policies, especially Google's, add their own limits. And for healthcare providers covered by HIPAA, privacy law sharply restricts what you can say in a reply. This guide walks through all three, with practical routines at the end.

The FTC's review rule in plain terms

The FTC finalized its Trade Regulation Rule on the Use of Consumer Reviews and Testimonials (16 CFR Part 465) in August 2024, and it took effect on October 21, 2024. It prohibits:

Fake or false reviews and testimonials: reviews from people who don't exist, who never used the product or service, or that misrepresent the reviewer's experience. The FTC said this covers AI-generated fake reviews too. Businesses can't write, buy or post them when they knew or should have known they were fake.
Buying reviews that require a particular sentiment: paying or rewarding people for positive (or, against a competitor, negative) reviews.
Undisclosed insider reviews: reviews from owners, managers, employees or their relatives without a clear disclosure of the relationship.
Company-controlled "independent" review sites that pose as neutral while promoting your own products.
Review suppression: using unfounded legal threats, physical threats, intimidation or knowingly false public accusations to get a review removed or prevent one, and claiming a review section shows all reviews when negative ones have been hidden.
Fake social media indicators: buying or selling fake followers or views to inflate influence.

Courts can impose civil penalties for knowing violations. The FTC's maximum is $53,088 per violation. That is the 2025 inflation-adjusted figure, and the FTC announced in September 2026 that it would keep the 2025 levels for 2026 rather than adjust them.

Enforcement has started. In December 2025 the FTC sent warning letters to 10 unnamed companies about possible violations. In July 2026 it finalized an order against the supplement seller TruHeight, which it said had posted thousands of five-star reviews written by employees and offered free or discounted products for five-star reviews. The company and its principals must pay $750,000 and are barred from buying reviews conditioned on a particular opinion.

A separate law, the Consumer Review Fairness Act of 2016, bars form contracts that restrict customers from reviewing you, fine them for reviews, or claim rights to their review content. Practices should check intake paperwork and membership agreements for old "no negative reviews" clauses.

Asking for reviews without crossing a line

Ask everyone, not just happy customers. The FTC rule has no specific ban on "review gating," where only satisfied customers are steered to public review sites. But the FTC says selective requests could still be deceptive under the FTC Act. Google's policy is direct: businesses may not discourage negative reviews or selectively ask for positive ones. Automated review requests that send happy customers to Google and route unhappy ones to a private form fall squarely into this.

Treat incentives carefully. Under the FTC rule, an incentive is a problem when it is conditioned, openly or implicitly, on a positive review. Google goes further and prohibits offering payment, discounts or free services in exchange for any review on its platform. Google removes those reviews and can restrict a Business Profile that breaks the policy, for example by blocking new reviews for a period or showing a warning that fake reviews were removed. The simplest policy for Google is no incentives at all.

Keep staff out of it. Under the FTC rule, employees and relatives may post reviews only with a clear disclosure, and the FTC notes that disclosed insider reviews can still mislead if they lift your average. Google treats reviews from current or former employees as a conflict of interest and removes them. The simplest policy is that staff don't review the business.

Never buy reviews or hire a service that posts them. If a vendor promises a burst of reviews, that is a red flag. The FTC treats an unusual spike of reviews as the kind of sign that should prompt questions.

Show reviews honestly on your own site. Sorting by helpfulness or showing top-rated reviews first is not suppression under the rule, but making negative reviews hard to find while implying everything is shown can be deceptive.

Responding to reviews

Public replies are allowed and often help. A calm, specific reply to a complaint tells future customers how you handle problems. A few habits keep replies safe:

Respond within a few days, thank the reviewer, and offer a direct contact for follow-up.
Don't argue facts in public, and never accuse a reviewer of lying unless you know it is true. The FTC rule bans knowingly or recklessly false accusations made to get reviews removed.
Don't threaten legal action over an honest negative review. Legitimate legal claims, such as defamation, are a separate matter for your attorney, not a reply box.
If a review looks fake (wrong business, someone who was never a customer), report it through the platform's process.

HIPAA limits for healthcare providers

If your practice is a HIPAA covered entity, a patient posting about their care does not give you permission to discuss it. Even confirming that the reviewer is a patient can disclose protected health information. OCR, the HHS office that enforces HIPAA, has taken several actions over review replies:

Year	Practice	What happened	Outcome
2019	Elite Dental Associates, Dallas	A Yelp reply disclosed a patient's last name, condition, treatment plan and costs; OCR found other disclosures on the same page	$10,000 settlement and corrective action plan
2022	Dr. U. Phillip Igbinadolor, D.M.D. and Associates, North Carolina	Posted a patient's information on a webpage replying to a negative review, then ignored OCR's requests	$50,000 civil money penalty
2022	New Vision Dental, California	Disclosed patient information in replies to online reviews	$23,000 settlement and corrective action plan
2023	Manasa Health Center, New Jersey	Google review replies revealed diagnosis and treatment details for four patients	$30,000 settlement and corrective action plan

When OCR announced the Manasa settlement, its director said, "Simply put, this is not allowed."

A safe reply for a covered practice stays generic and confirms nothing. For example: "We take all feedback seriously. Privacy rules prevent us from discussing anyone's care online, but our practice manager would be glad to talk with you at [phone number]." Then handle the conversation privately. Have one trained person approve every public reply.

Not every med spa or wellness business is a HIPAA covered entity. That depends on factors like electronic insurance billing, covered in our guide on when HIPAA applies to medical spas. Businesses outside HIPAA still face state privacy laws and lose trust fast when they air a customer's details, so the same restraint is good practice. Talk to counsel about which rules apply to you.

A simple reputation routine

Send every customer or patient the same review request after a visit or purchase, with a direct link to your Google profile.
Check new reviews on Google, Yelp and your main industry site weekly.
Reply to all reviews within a few days using approved templates, with nothing that identifies a patient's care.
Report reviews that are clearly fake or about the wrong business.
Fix the recurring problems that negative reviews point to: wait times, billing confusion, slow shipping.
Once a year, review intake forms and vendor contracts for review restrictions or incentive schemes.

Where NutriCove fits

NutriCove builds websites and web apps with lead capture, CRM and booking wired in, and our multi-page builds include Google Business Profile setup. If you are rebuilding the site where patients and customers find your reviews and contact you, see how we build websites.

Sources

This article is general information, not legal or medical advice. Talk to a qualified attorney or licensed professional about your situation.