Asking for reviews: platform rules, HIPAA, and no incentives

Yes — Asking Is Legal; Here's the HIPAA Frame

You may ask any patient to leave an honest review — HIPAA does not ban the request itself. The Privacy Rule's marketing provisions carve out a face-to-face exception: a direct, in-person or end-of-visit ask for feedback doesn't count as the kind of marketing communication that needs separate written authorization 1Ref 1HHS Office for Civil Rights (2026).Marketing.That a direct, face-to-face request for a review is a HIPAA marketing exception needing no separate authorization, framing when asking is safe.. A neutral card at checkout or a link in the discharge paperwork works the same way, provided it goes to everyone and asks for honest feedback rather than praise.

What changes the analysis is how you ask and who you ask — not whether you're allowed to ask at all. The moment the request becomes automated, incentivized, or filtered by expected sentiment, you've left the safe zone the face-to-face exception covers.

What You Cannot Do: Gating, Incentives, Fake Reviews

Three patterns turn a legitimate ask into a violation, and none of them require you to intend deception. Gating — soliciting only patients you expect to be happy, or diverting unhappy ones to a private form — is deceptive under FTC endorsement policy on its own 2Ref 2Federal Trade Commission (2023).FTC's Endorsement Guides: What People Are Asking.That review gating — filtering who gets asked by expected sentiment — is deceptive under FTC endorsement policy..

Incentives — a discount, a gift card, a raffle entry for leaving a review — collide with the FTC's 2024 rule, which also bans buying reviews and reviewing your own practice without disclosing the connection 3Ref 3Federal Trade Commission (2024).Federal Trade Commission Announces Final Rule Banning Fake Reviews and Testimonials.The FTC's 2024 rule banning incentivized, purchased, and self-written reviews, in force as of July 2026.. Writing or editing a review yourself, even a glowing one you'd stand behind, is the same rule reaching the other direction.

Enforcement so far has concentrated on larger, repeat offenders — review brokers and multi-location chains buying reviews at scale — but the rule itself doesn't scale penalties to practice size, and a single patient complaint or a competitor's tip is enough to put a solo practice's review history under a magnifying glass. The safer posture treats the rule as binding from day one rather than waiting to see whether enforcement ever reaches a practice your size.

The companion piece on review gating works through the FTC's four-pattern test in detail if a pre-survey or "how did we do" workflow is part of your plan; the short version here is: ask everyone the same way, offer nothing for the review, and never touch the text yourself.

Automated Texting Needs Consent First

If the request goes out as an automated text or a prerecorded call rather than a handout, the TCPA requires prior express consent from that patient before the message can be sent — being on your patient roster alone is not consent 4Ref 4Federal Communications Commission (2026).Telemarketing and robocalls.That an automated review-request text or call requires prior express consent under the TCPA before it can be sent..

Capture that consent the same place you capture consent for appointment reminders: at intake, in writing, with a visible way to opt out. A single text sent manually from a staff member's own phone, or a paper card handed over at checkout, doesn't carry the same requirement.

If You Hire a Review-Management Vendor

Hiring a service to send review requests on your behalf turns that vendor into a business associate the moment it receives patient names, phone numbers, or email addresses to contact them — and a business associate needs a signed agreement before you hand over a single contact 5Ref 5HHS Office for Civil Rights (2026).Business Associates.That a vendor sending review requests using patient contact information is a business associate requiring a signed BAA.. A tool that only posts content you write yourself, with no patient data flowing to it, isn't a business associate and doesn't need one.

Ask any vendor exactly what data reaches their servers before you sign up, not after. "We just send a text" still means patient contact information left your systems, and the agreement has to exist before the first contact does, not retroactively.

• Ask what data leaves your systems — names and phone numbers alone are enough to trigger the business-associate requirement.
• Get the agreement signed before the first contact list upload, not after the vendor has already started sending requests.
• Confirm how the vendor captures and stores consent and opt-outs, since you remain responsible for TCPA compliance even when a vendor sends the message on your behalf.
• Review what the vendor does with the data afterward — a vendor that resells or retains contact lists beyond your engagement is a separate conversation worth having before you sign.

A Script That Stays Inside the Lines

The lowest-risk version of the ask is short, uniform, and delivered the same way to everyone: a card, an email footer, or a spoken line at checkout that invites honest feedback without hinting at what you hope to hear. Skip anything that resembles a survey branching by sentiment, and skip any mention of a reward for leaving one.

• Say it the same way every time: "If you have a moment, we'd appreciate an honest review on [platform]" — no branching, no pre-screen.
• Put the ask where it can't be selectively skipped: discharge paperwork, a checkout receipt footer, an automated (consented) reminder — not a staff member's discretion.
• Never mention a reward. Not a discount, not a raffle, not "as a thank you."
• If a patient volunteers a complaint instead of a review, treat it as a complaint — address it directly, and don't let it change whether the next patient gets asked.

Where Platform Rules Differ From the Law

Google, Yelp, and most healthcare directories publish their own review policies on top of federal law, and they enforce those policies with removal or suspension rather than a fine — the more common consequence for a solo practice day to day. Most platform policies track the FTC's rules closely: no incentives, no self-reviews, no gating — so a request built to satisfy HIPAA and the FTC generally clears the platform's bar too.

Read the specific platform's guidelines once before you launch a request program, since wording differs even where the substance overlaps, and revisit them if you switch platforms or add a new one to your presence. A platform can also change its policy without notice, so treat the annual review of your review-request process as routine maintenance, not a one-time setup task you never revisit.