How to respond to a bad Google review when you run a health practice

On This Page

1. Why you can’t reply like a café
2. The case that shows what goes wrong
3. What the indemnity insurers advise
4. Where Ahpra comes in
5. First decide: reply, report or leave it
6. Getting a review removed
7. Replies you can adapt
8. What not to do
9. Defamation: rarely the answer
10. Psychologists and counsellors: extra care
11. Questions we get asked

Most advice on answering a bad Google review was written for cafés. Thank them, address the specific complaint, apologise, explain what went wrong, offer to make it right. For a café that's fine. For a health practice, the middle of that advice can break the law.

The problem is simple. The moment your reply confirms the reviewer is a patient, you've disclosed health information about them, in public, to anyone who searches your name. This guide covers what you can say, what to report instead, what Google will and won't take down, and replies you can adapt for the five situations practices ask us about most.

Why you can't reply like a café

Under the Privacy Act, health information includes information about "a health service provided, or to be provided, to an individual". So even the fact that someone is your patient, or had an appointment on Tuesday, can be health information. It's also sensitive information, which gets the strictest treatment.

The Act covers every health service provider regardless of turnover. The OAIC's definition includes anyone providing services for physical, emotional, psychological or mental health, so the small-business exemption that covers many other businesses doesn't help a two-room physio or a solo counsellor.

Australian Privacy Principle 6 says you can only use or disclose personal information for the purpose you collected it, unless an exception applies. You collected your patient's details to treat them, not to win an argument on Google. For sensitive information, a secondary purpose has to be directly related to the original one, and the person has to reasonably expect it. Defending your reputation in public isn't that.

The patient posting about themselves doesn't change this. MDA National puts it well: the patient can talk about their medical problems in an open forum, but you could face an Ahpra or OAIC complaint if you do likewise.

The case that shows what goes wrong

In July 2021 a tenant left a one-star Google review of a New South Wales real estate agency, under a profile that didn't show his full name. Five days later the agency replied. It addressed him by his full name, mentioned his rent arrears and the number of arrears notices it had sent, and added that his LinkedIn profile said he was an accountant.

On 1 November 2024 the Australian Information Commissioner found the agency had breached APP 6.1 by disclosing his personal information in its reply. The agency accepted it could have answered the review without identifying him. It was ordered not to repeat the conduct and to send him a written apology within 30 days. He asked for $15,000 in compensation and got none, but the complaint took more than three years to resolve. The OAIC's own summary of the case said it isn't right "to expose someone's personal information to pressure them" into changing or deleting a review.

That was rent arrears. Swap in a diagnosis, a treatment or a mental health appointment and the information is far more sensitive. We couldn't find a published OAIC determination about a health practice replying to a review, but the same principle applies to you, with higher stakes.

What the indemnity insurers advise

Australia's medical defence organisations have written about this for years, and their advice lines up.

Avant splits reviews in two. If a review is about administration, like waiting times or parking, your practice manager may want to reply online, quickly. If it's about a clinical issue, Avant suggests at most a general response that apologises and acknowledges the concerns, kept "very general" so you don't breach confidentiality, and says ignoring the review is also an option. It recommends talking to your defence organisation before you respond.

MDA National, in a 2019 article that still holds up, says sometimes it's "better to maintain a dignified silence". If you do respond, it suggests something neutral along the lines of "we take all patient complaints seriously so please contact the practice so we can resolve your concerns", and says the best outcome is the patient choosing to remove the review after you've dealt with their complaint privately.

If you're unsure about a specific review, ring your insurer's medico-legal team before you type anything. That's what they're for.

Where Ahpra comes in

A negative review isn't a testimonial, so the advertising ban mostly isn't the issue. The issue is mixed reviews. "Dr Chen fixed my knee but the billing was a shambles" contains a positive statement about a clinical outcome. Ahpra's guidelines warn that engaging with reviews on a third-party site "may be considered using a testimonial". Reply warmly to that review and you're arguably promoting the knee part.

For higher-risk cosmetic procedures it's stricter. Since 2 September 2025 the cosmetic advertising guidelines say practitioners must take steps not to interact with positive reviews, and give liking or responding to a patient's post as examples of using a testimonial. If you do injectables or veneers, don't reply to anything that praises a result. Our guide to asking for reviews covers the rest of Ahpra's rules on reviews.

First decide: reply, report or leave it

Not every review needs a reply. Sort it first.

Scroll the table sideways to see every column.

Whatever you decide, check your records. If you can identify the person, the best fix is the same as for a written complaint: call them, listen, and resolve it privately. Some will update the review on their own. Never ask them to in exchange for anything.

Getting a review removed

Google removes reviews that break its policies. It doesn't remove reviews because they're negative, unfair or disputed. Its help page is blunt: don't report a review just because you disagree with it, and Google doesn't get involved in conflicts between businesses and customers.

The policies most useful to a practice:

• Fake engagement. Content not based on a real experience, paid reviews, or reviews posted from several accounts by one person.
• Conflict of interest. Reviews from current or former employees, contractors, competitors or family.
• Off-topic. General commentary or personal rants that aren't about an experience at your practice.
• Harassment and personal information. Threats against people, or personal details such as someone's full name posted without consent.

To report one, open your Business Profile, choose Read reviews, select Report next to the review and pick the reason. You can also use Google's Reviews Management Tool, which shows the status of each report: decision pending, reviewed with no violation found, or escalated. Google says evaluation typically takes several days. If it finds no violation, you get one appeal per review through the same tool.

MDA National's tip is worth borrowing: write your report in the language of the platform's own policy. "This review is not based on a real experience: we have no record of this person" lands better than "this is unfair".

Replies you can adapt

Every one of these is written so it doesn't confirm the reviewer was a patient. Swap in your own details, keep them short, and put a real phone number or email in. Google checks replies against its content policies before posting them, which usually takes up to 10 minutes and occasionally up to 30 days.

Notice what's missing. No "we're sorry your treatment didn't help", no "as we explained at your appointment", no "our records show you missed two sessions", no "you're not a patient here". Each of those either discloses health information or invites the argument you're trying to avoid. The last one is tempting with a fake review, and still a bad idea: report it instead.

One reply per review, written once. Don't get into a back-and-forth. The reviewer is notified of your reply and can edit their review afterwards, which sometimes happens on its own when the reply is calm.

What not to do

Don't correct the facts with their facts. Even a true, polite correction drawn from their file is a disclosure. That's the trap the agency in the privacy case fell into.

Don't offer anything for removal. Google bans incentives, including payment, discounts or free services, in exchange for revising or removing a negative review. A refund to settle a genuine complaint is fine; a refund conditional on deleting the review isn't.

Don't bury it with fake positives. The ACCC says reviews written by family, employees or people paid by the business, without disclosing the connection, can mislead consumers, and suppressing or removing genuine negative reviews can too. Google treats the same reviews as fake engagement and conflict of interest. The Federal Court ordered a health booking platform to pay $2.9 million in 2020, partly for not publishing large numbers of negative patient reviews.

Don't threaten legal action in the reply. It reads badly to every future patient who sees it. If you think a review is defamatory, see the section below and get advice privately.

Don't reply in anger. Write it, leave it overnight, and get someone else to read it.

Defamation: rarely the answer

Defamation law is the same model law in each state and territory, with some differences. Three points matter for a practice.

First, under section 9 of the uniform Defamation Act, most companies can't sue at all. A corporation can only sue if it isn't for profit or has fewer than 10 employees and isn't part of a larger group. A practice company with ten or more staff has no claim, though the individual practitioners named in a review might.

Second, since the Stage 1 reforms, which have commenced everywhere except Western Australia, a claimant has to show the publication caused, or is likely to cause, serious harm to their reputation. For a small company that means serious financial loss. And you have to send a concerns notice and give the reviewer the chance to make amends before you can start proceedings.

Third, it can work, at a cost. In a 2021 County Court of Victoria case, a Melbourne periodontist was awarded $170,000 in damages, including aggravated damages, over Google reviews posted by a former patient who stopped taking part in the proceedings. That case was decided on reviews posted before the serious harm threshold applied. Avant's assessment is that defamation actions "can be difficult to win and difficult to enforce". Treat it as a last resort, with legal advice, for reviews that are false and genuinely damaging.

Psychologists and counsellors: extra care

For a psychologist or counsellor, confirming someone is a client discloses that they sought mental health care. That's about as sensitive as health information gets, and the reviewer may not have thought through what they've revealed by posting.

Our advice is stricter here. Don't reply to any review that describes therapy. If the review is purely about something administrative and you feel you must reply, use the "can't find in your records" wording, which says nothing about whether the person was seen. Never use the words "client", "session" or "treatment" in a reply. The Privacy Act applies to counsellors as health service providers even though they aren't registered with Ahpra. Psychologists should also note the Psychology Board's own Code of conduct, which replaced the APS Code of Ethics as the Board's foundation document on 1 December 2025.

If you keep getting reviews you can't answer, put your effort into the side you control: a clear Google Business Profile and a steady flow of reviews from everyone, asked for the same way. Our Business Profile checklist covers the setup.

Questions we get asked

Should I respond to a bad Google review?

Often, but briefly, and never in a way that confirms the reviewer was a patient. For clinical complaints, a neutral one-line reply or no reply is usually safer.

How do I respond to a negative review without breaching privacy?

Don't mention their name, appointment, treatment or anything from their file. Say you take feedback seriously and give a phone number or email to continue privately.

Can I get Google to delete a bad review?

Only if it breaks Google's policies, for example if it's fake, off-topic, abusive or from a competitor or former employee. Google won't remove a review just because it's negative.

How long does Google take to review a reported review?

Google says evaluation typically takes several days. You can track it, and appeal once, in the Reviews Management Tool.

What if the reviewer was never our patient?

Report it as not based on a real experience. If you reply, don't say they weren't a patient; say you can't discuss individual matters online.

The patient already posted their diagnosis. Can I respond to it?

No. Their choice to share it doesn't give you permission to discuss it. Keep your reply general.

Can I offer a refund if they take the review down?

No. Google bans incentives for removing negative reviews. You can resolve the complaint, including with a refund, but not on the condition that the review goes.

Can I sue someone over a Google review?

Sometimes, but companies with 10 or more employees can't sue for defamation, and claimants must show serious harm. Get legal advice first.

Can I reply to a review that praises our treatment but complains about something else?

Be careful. Ahpra says engaging with reviews may count as using a testimonial. For higher-risk cosmetic procedures, don't interact with positive reviews at all.

Should psychologists reply to Google reviews?

Rarely. Confirming someone is a client reveals they sought mental health care. Don't reply to anything about therapy.