Reviews for a hearing clinic: the routine, the replies and the HIPAA line.

Why reviews, in numbers

Google's local ranking help says prominence is "also based on info like how many websites link to your business and how many reviews you have", and that "More reviews and positive ratings can help your business's local ranking." A 2022 YouGov survey of more than 1,000 US consumers for Reputation found 72% read online reviews when considering a new provider, 72% want four stars or better, 80% trust a provider with five or more reviews, and 65% say a provider's public responses to reviews are essential; reviews were the third biggest driver of choice after insurance acceptance and location, and Google was the most used place to look. MarkeTrak 2022 found 91% of hearing aid owners satisfied with their hearing care professional, which is a lot of people who would say so if asked.

In our October snapshot of 14 towns, one search each, at least two of the three map results were not chain locations in 12 towns. Reviews are the part of prominence a clinic controls week to week, and the part a chain location cannot match from a national template.

The three sets of rules

Google. The Maps content policy on rating manipulation says businesses must not "Discourage or prohibit negative reviews, or selectively solicit positive reviews from customers" and must not "Offer incentives ... in exchange for posting any review". Google also says merchants should not pressure people to leave reviews while on the premises. So: no battery pack for a review, no "if you were happy, leave a review; if not, call us", no tablet at checkout.

The FTC. The Consumer Reviews and Testimonials Rule, 16 CFR Part 465, took effect October 21, 2024. It prohibits fake or false reviews and testimonials, buying reviews that must express a particular sentiment, suppressing reviews by intimidation or unfounded legal threats, undisclosed insider reviews (staff and family), and company-controlled sites presented as independent. The FTC says "The rule does not prohibit giving incentives for reviews" as long as no sentiment is required, and that asking only satisfied customers could still violate the FTC Act. Google's rule is stricter than the FTC's on incentives, and Google's is the one that gets a profile suspended.

HIPAA. A public reply to a review is a public statement. If it confirms the reviewer was a patient, or says anything about their visit, it discloses protected health information, and there is no exception for "but they said it first". Patient testimonials on your own site need the patient's written authorization under the Privacy Rule's marketing provisions. HearingTracker's provider reviews are gated by design (a professional must create a review ticket before a patient can review them), which is why we treat them as a different thing from public Google reviews. One more trap sits outside reviews: a mailer or email to your patients that a manufacturer pays for can count as marketing under HIPAA even when it describes your own services, because whether a message counts can turn on who pays for it. Check with your compliance adviser before you send one.

What HHS settled

Two settlements over review replies, both public. In June 2023 HHS's Office for Civil Rights settled with a New Jersey provider for $30,000 and a two-year corrective action plan after it "posted a response to the patient's negative online review" that revealed protected health information; OCR found three other patients' information disclosed in review responses. OCR's then director put it in one sentence: this is not allowed. In October 2019 a Dallas dental practice paid $10,000 to settle "Social Media Disclosures of Patients' Protected Health Information" in review responses. Neither was a hearing clinic. Both were small practices answering reviews the way an owner answers a complaint across the counter, which is exactly the instinct a reply template exists to stop.

The routine

1. Everyone, the same way, after the visit. One message, sent by your own patient system or your own email, the day after any visit (evaluation, fitting, repair, cleaning), to every patient who has given the clinic an email or mobile number for communications. Every kind of visit, and every patient asked the same way.
2. The message. "Thank you for visiting Maple Street Hearing. If you have a minute, we would value a review of your visit on Google: [link]. Reviews help neighbors find the clinic. Thank you, Dr. Alvarez and the team." No incentive, no request for stars, no "if you were happy".
3. The link. The profile's own "write a review" link, which Google provides in the profile dashboard. Not a third-party funnel that sorts people by rating before sending them to Google; that is selective solicitation with extra steps.
4. No devices in the clinic. Google's policy on pressure while on the premises, and the simple fact that a patient at the counter cannot say no.
5. Nobody inside the clinic. No staff, no family, no suppliers. The FTC's rule treats undisclosed insider reviews as deceptive.
6. Reply to every review within a week. Templates below. Approved by the clinic owner once; then used.
7. Count monthly. Reviews, average, the date of the newest. If the newest is older than a month, the message is not going out.

If a clinic sees 150 patients a month and one in thirty writes a review, that is five a month. That is enough. The location across town with 140 reviews got them over years.

Replies that disclose nothing

The test for every reply: could this sentence be posted under a review from a person who has never been in the building? If not, cut it.

Five stars, named provider. "Thank you for the kind words. Dr. Alvarez and the team appreciate it. We are glad to help any time." (It does not say the reviewer was fitted, tested, or seen.)

Five stars, mentions a device. "Thank you for taking the time to write this. It means a lot to the whole team." (It does not repeat the device, the problem or the outcome.)

Three stars, a wait. "Thank you for the feedback. We take waiting times seriously and are looking at scheduling. If you would like to talk about your experience, please call the clinic and ask for the office manager." (No confirmation of an appointment, no explanation.)

One star, details that are wrong. "Thank you for sharing this. We take all feedback seriously and would welcome the chance to talk with you directly. Please call the clinic and ask for Dr. Alvarez." Then the phone. Not the reply box.

What a reply never contains. The date of a visit, the device, the test result, the diagnosis, the insurance, the price paid, the name of a family member, or any sentence that begins "When you came in".

Reviews and testimonials on your own website

A Google review lives on Google, under Google's rules, and you did not publish it. A testimonial on your own website is your publication, and two more sets of rules apply. HIPAA first: using a patient's words, name or photo in your marketing is a use of protected health information, and 45 CFR 164.508(a)(3) requires the patient's written authorization before it happens; a full-face photograph is an identifier under the Privacy Rule's de-identification standard, so a photo of a smiling patient with their new devices is a disclosure unless the form is on file. Second, the FTC's reviews rule reaches testimonials as well as reviews: they must be real, from real customers, not bought with a required sentiment, and not written by people with an undisclosed connection to the clinic.

Our advice is to publish none. Let the Google reviews stand where people already look for them, and keep the website for what the clinic does and who does it. If you do want testimonials, keep the signed authorization with the quote, use first name and last initial at most, use no photos, and do not edit the words.

What the counts tell you, month to month

Four numbers, read together on the first of the month: the total number of reviews, the average rating, the date of the newest review, and the number of reviews from the previous 30 days. The first two are what a searcher sees on the map. The third tells you whether the request is going out at all. The fourth tells you whether it is working: if the clinic saw 140 patients and one wrote a review, the message is arriving at the wrong time or from the wrong sender, and the fix is usually to send it the morning after the visit from the provider's own name rather than from an office address.

Compare the same four numbers for the two or three businesses above you in the map pack for "hearing aids [town]". If a chain location has 140 reviews and you have 23, the gap closes at the rate of your routine, and the routine is the only honest way to close it. Buying reviews is a violation of the FTC rule; sorting patients before asking is a violation of Google's policy and a risk under the FTC Act; both are also the kind of thing a competitor reports.

What the front desk can say

Google's policy on pressuring people while on the premises does not stop a human being from mentioning reviews. It stops the tablet at checkout and the "leave us five stars before you go" script. What the desk can say, to everyone: "We will send you a short message tomorrow with a link in case you would like to leave a review. No obligation either way." It is a courtesy, it tells the patient what to expect, and it keeps the request in writing, after the visit, where Google wants it.

The wrong one-star review

Three options, in order. First, reply with the template and take it to the phone; a patient who was heard sometimes edits the review. Second, if the review breaks Google's content rules (it is about a different business, it contains hate speech or personal information, it is from a competitor), report it through the profile dashboard; Google removes some, slowly. Third, if it is defamatory, that is a question for legal counsel, not for the reply box, and the FTC's rule treats unfounded legal threats to reviewers as suppression. What is not an option is explaining what really happened in public.

Which sites matter

Google first and by a distance; it is the map, and in that snapshot a general review site appeared on page one in 12 of 14 towns while no health-specific review site did. Healthgrades runs an audiologist directory with per-provider ratings from verified surveys; most profiles in a mid-size city have no ratings at all, so a few go a long way, and the listing should match the Google profile exactly. HearingTracker's clinic directory charges per location and syncs Google reviews into its profiles; whether it is worth the fee depends on the town, and its own reviews are ticket-gated. The general review site that shows up on page one is worth claiming and keeping accurate, and not worth paying.

What to do in the next hour

1. Open your profile and read your last ten replies. Delete or edit any that mention a visit, a device or a test.
2. Copy your profile's "write a review" link and paste it into the message template above.
3. Decide who sends the message and from what system, and send the first batch to last week's patients.
4. Remove any tablet, sign or script that asks for reviews at the front desk.