Short answer: when you reply to an online review, do not confirm that the reviewer is a patient, and do not mention a treatment, a visit, or a result. AI can help you draft calm, general replies quickly. A person on your staff reads each one and posts it. Nothing goes up on its own.
We covered HIPAA and AI in med spas and keeping the personal touch at the front desk. Reviews sit between the two: they are public, they are personal, and they are where good people make privacy mistakes when they are upset.
Why this is a privacy question
Many med spas work under a medical director or offer services that make them subject to HIPAA. Whether your practice is covered is a question for your own counsel. If it is, a review reply is a disclosure like any other.
The federal Office for Civil Rights has acted on this. In 2019 a Dallas dental practice paid $10,000 to settle after it disclosed patient information in replies on a review site. In 2023 OCR announced an agreement with a New Jersey provider that disclosed patient information in response to negative online reviews. Read those pages yourself. The lesson is simple: the reviewer chose to talk about themselves. That does not give you permission to talk about them.
What a risky reply looks like
- "We are sorry you were unhappy with your filler results."
- "Our records show you missed your follow-up appointment."
- "As we discussed at your visit on Tuesday..."
Each one confirms a relationship, a treatment, or a visit. It does not matter that the reviewer said it first.
What a safe reply looks like
- Thank the person for the feedback.
- Say you take every concern seriously.
- Give a direct way to reach a named role, such as the practice manager, by phone or email.
- Say nothing about who they are, what they had done, or what happened.
It feels thin. That is the point. The real conversation happens privately.
What AI may do
- Draft a general reply for each new review, using only wording you have approved.
- Flag reviews that mention a complication, a medical concern, or a threat, so a clinician or the owner sees them the same day.
- Check a human-written reply for words that confirm a visit, a service, or a date before it goes up.
What it must never do
- Look up the reviewer in your scheduling or chart system to "personalize" the reply. The draft should not know whether the person is a patient.
- Answer a clinical complaint in public. Questions about a reaction, a result, or a side effect go to a clinician, by phone.
- Post by itself. A named person approves every reply.
- Argue. A draft that corrects the reviewer's story is a draft that discloses.
A short review routine
- Check new reviews on a set day, or daily if you get many.
- Let the tool draft. A staff member reads it against your checklist.
- Anything clinical or angry goes to the owner or clinician before any reply.
- Keep the approved wording short and boring. Update it with your counsel, not with the tool.
A realistic first step
Pull your last twenty review replies. Mark every one that names a service, a visit, or a result. If you find some, you do not need software first. You need a reply template and a rule. After that, a drafting tool can save time without adding risk.
If you want replies drafted from approved wording, with your staff posting every one, talk with us.
Related: HIPAA and AI for med spas · our approach for med spas.