How to ask patients for Google reviews, within the rules
Ask everyone. Reply to everyone. Confirm nothing.
A practice asks for reviews the way any small business should, with three extra rules. Ask every patient in person at checkout, send the direct link through the follow-up channel they already agreed to, offer nothing in return, and reply to every review without confirming the writer was a patient. Here are the rules, the wording and the reply templates.
Written by Gerad Patton, founder of Ark Visibility · Last reviewed September 23, 2026 · Sources listed at the end
The three sets of rules a practice asks under
Three rulebooks apply: the FTC's Consumer Reviews rule, Google's review policy, and HIPAA. null of them stops you asking. All three stop specific shortcuts, which are exactly what a review-generation vendor will offer you. We are not lawyers; ask yours.
The FTC. Since October 21, 2024, a Federal Trade Commission rule bans fake reviews, reviews from insiders without disclosure, and incentives conditioned on a review being positive. It also bans using threats or intimidation to get a review taken down. [Source: FTC]. Asking only your happy patients while steering the unhappy ones elsewhere is called review gating, and the FTC says this can be deceptive under its Endorsement Guides.
Google. Google's policy prohibits incentives for reviews, discouraging negative reviews and selectively soliciting positive ones, and treats reviewing your own business or employer as a conflict of interest. [Source: Google]. Breaking it can cost you the reviews or the listing.
HIPAA. A reply that confirms someone was a patient is a disclosure, even when the reviewer said it first. In 2023 a practice paid $30,000 to settle with the HHS Office for Civil Rights after disclosing patient information in a reply to a negative review. [Source: HHS]. The reviewer going public first doesn't waive anything.
Allowed and not allowed
| Doing this | OK? | Why |
|---|---|---|
| Asking every patient, in person, at checkout | Yes | Nothing in any of the three rulebooks limits asking. |
| Sending the direct link through the follow-up channel the patient already consented to | Yes, with your compliance adviser's sign-off | Keep every detail of care out of it. Some advisers treat it as marketing needing its own consent. |
| A discount, gift card, drawing or free product for reviewing | No | Google prohibits incentives of any kind; the FTC rule prohibits incentives conditioned on a positive review. |
| A "how did we do?" form that sends happy patients to Google and unhappy ones to you | No | Review gating. Google prohibits selective solicitation, and the FTC says it can be deceptive. |
| Staff, family or the practice's own accounts reviewing the practice | No | A conflict of interest under Google's policy; an insider review the FTC rule says must be disclosed. |
| Buying reviews, or paying a service that "generates" them | No | The FTC rule bans fake reviews. Google removes them and can suspend the listing. |
| Asking or pressuring a patient to remove or change a review | No | The practice cannot ask. The FTC rule bans threats or intimidation to suppress reviews, and any exchange about it risks confirming a patient. |
| A reply that mentions a visit, a date, a diagnosis or a bill | No | A HIPAA disclosure, whether the review was glowing or hostile. |
Putting a patient's words on your own website is a separate matter: for a HIPAA-covered practice that may count as marketing, which generally needs written authorization first, and some state boards restrict testimonials in physician advertising. Ask your compliance adviser.
Timing and friction decide most of it
Two things matter more than what you say: when you ask, and how many taps sit between the ask and the box the patient types into. The wording is a distant third.
Timing. The peak is not a week later. It is the moment the patient feels heard: the end of a first visit where the plan finally made sense, or the day the membership question they had been putting off got answered. In a practice that moment is checkout.
Friction. “Look us up on Google and leave a review” is roughly six taps and a search that might surface the practice down the street. A direct review link is one tap into the box. That difference is most of why people who say yes never follow through.
Getting the link. Sign in to the Google account that manages your profile, search your practice name, and in the profile panel choose “Ask for reviews.” Copy the short link; it begins with g.page/r/.
g.page/r/[your-code]/reviewIf your listing doesn't offer the button, the same link can be built from your listing's Place ID; the free audit's profile report includes yours.
The ask, in three steps
In person first, then one message, then one follow-up. There is no fourth step. The verbal yes is what makes the message land.
In person, at checkout.
By whoever the patient deals with last, usually the front desk. "If today was useful, a Google review helps other families find a practice like this. It takes about a minute. Is it all right if we send you the link?" Then wait for the yes. Every patient, not the ones who seemed happiest.
One message, within the hour, through the channel that already exists.
Most practices already send reminders or an after-visit message from a system the patient consented to and the practice has a business associate agreement with. The review link travels on that channel: the patient's name, the link, nothing about the visit. Not from a personal phone, and not from a marketing texting app that has never seen a patient's number. Whether your reminder system may carry it is a question for the vendor and your compliance adviser.
One follow-up, three days later, only if they said yes.
Then stop. There is no third message.
The wording, verbatim
Every message below says nothing about why the patient came, what was found or what was done. Change the names. Do not add a diagnosis, a symptom, a result, or a “hope you're feeling better,” which implies one. “Thank you for coming in” is enough.
Hi Maria, thank you for coming in today. If you have a minute, a Google review helps other families find Example Family Direct Care: [link]. Thanks either way.
Hi Maria, no pressure at all, just sending that review link again in case now is easier: [link]. Thanks either way.
Hi Maria, thank you for visiting us this week. If you have a minute, would you mind leaving Example Family Direct Care a Google review? It takes about a minute and genuinely helps a small practice like ours: [link]. Thanks either way.
Three deliberate choices. The patient's name, because a message without it reads like a template. “Helps other families find a practice like this,” because it is true and gives a reason that isn't you. “Thanks either way,” because removing the obligation gets more people to do it, not fewer.
How to reply to every review without confirming a patient
Reply to every review, and reply to the negative ones best, because those replies are read by far more people than the review itself. The audience is the next person reading both, deciding whether you are the kind of practice that handles a problem well.
HIPAA changes the shape. An ordinary business acknowledges the specific complaint. A practice cannot, because “you're right that your appointment ran late” confirms there was an appointment. So the reply is three sentences that say nothing about the person: thank the writer, state your general policy in neutral terms, and offer a way to continue off the page.
A positive review
Thank you for taking the time to write this. Kind words about our team mean a great deal, and we'll pass them on to everyone here. — Example Family Direct Care
A negative review, including one that mentions clinical details
Thank you for the feedback. We take every comment seriously and would like to talk. Please call the office at [number]. — Example Family Direct Care
Three sentences, and none of them says the writer was here, when, or why. Do not add "your visit," "your appointment," or an apology for something specific; each one confirms a patient. If you want to say more, the only safe addition is why: "Privacy rules mean we can't discuss anyone's care in a public reply."
A review you believe is about another business, or isn't genuine
Thank you for writing. We're not able to discuss whether anyone is a patient here. If this review was meant for a different business, or you'd like to talk with us, please call [number]. — Example Family Direct Care
Flag it to Google from your profile as well. Never argue in public and never threaten; the FTC rule treats threats over a review as suppression, and a public dispute is the fastest way to confirm a relationship you're not allowed to confirm.
What loses: relitigating the facts, mentioning what the person paid, and a reply longer than the review. Have the templates approved once by your compliance adviser, then let one named person use them. Reply templates are part of the Google Business Profile setup for doctors; your adviser has the final say.
Making it a habit that survives a busy week
Aim for a steady few reviews a month, permanently, rather than twenty in one week. A sudden burst looks like bought reviews to a reader. Google says review count is one part of how prominent a business looks; steady is how you build it. [Source: Google]
Save the link as a text-replacement shortcut on the front desk computer. Type "revlink," get the URL. This one change does more than any script.
Put the link on the printed visit summary and in the practice's email signature. Passive, permanent, no incentive.
Give one person the job of asking. Shared responsibility means nobody asks.
Reply within a week, from the practice's account, using the approved templates.
Count it monthly: reviews added, reviews replied to, oldest review without a reply. Three numbers, one minute.
The review request card: the in-person ask, the two messages, the email, the three replies and the allowed-and-not-allowed table, on one page for the front desk.
What I've noticed, and what to do this week
When I added the ask to a practice's existing after-visit message, nothing else changed: no campaign, no software, one sentence and a link added to a message the front desk already sent. That is still the version I recommend.
Two things surprised me. In the map results I've graded since, a practice with a steady run of recent reviews often sits above one with a larger, older pile. I can't prove recency is the cause, and Google doesn't publish its weighting, but if you have a big old stack and nothing this year, start asking again this week. And the messages sent after a verbal yes were the ones that became reviews.
This week.Get your direct review link and save it as a shortcut. Ask the next three patients in person, and send each the message within the hour through the channel they already agreed to. Once your compliance adviser has read the templates, reply to every review currently sitting unanswered. That is the whole system; everything else on this page is refinement.
Reviews are one of eight areas on the Google Business Profile report card, the rubric behind the profile report in the free audit, which grades the rest of your listing too and says whether reviews are actually the first thing to fix. Often they aren't. If the phone is quiet even with good reviews, read why patients drop off at the booking step.
Common questions about asking patients for reviews
Sources and notes
- •FTC: Consumer Reviews and Testimonials Rule Q&A
- •Google Maps: policy on fake engagement and review solicitation
- •Google Business Profile Help: how local ranking works
- •HHS Office for Civil Rights: Manasa Health Center settlement, June 2023
- •Every patient, practice and message on this page is invented. The templates are drafts for your compliance adviser to approve or change.
This guide is general information, not legal or medical advice. We are not lawyers. Review rules and Google's policies change; we review this page and date each review at the top.
The ask is the easy part
Find out what else your listing is missing.
The free audit grades your Google Business Profile field by field, reviews and replies included, from public information only, within two business days.