Can Dentists Ask Patients for Reviews? The Rules

Yes. Dentists can ask patients for reviews, and unlike therapists they are not restricted by an ethics code from doing it. The rules bite in three other places: what you may republish on your own website, what your state dental board requires you to disclose, and what you say when you reply. That last one is where practices actually get fined.

This trips people up because dental marketing advice and dental compliance advice are usually written by different people who never read each other. The marketing side says ask every happy patient. The compliance side says HIPAA. Both are right, and neither one tells you where the line sits.

Can dentists ask patients for reviews?

Yes. There is no professional rule in dentistry that prohibits requesting a review or a testimonial from a patient. That is a genuine difference from behavioral health, where the APA, ACA and NASW ethics codes each restrict soliciting testimonials from clients outright, which is why advice written for a counseling practice does not transfer to a dental one.

What you are allowed to do with the request is bounded by four separate rules, and it helps to see them as a stack rather than as one big HIPAA question:

Notice that the request itself appears nowhere on that list. Asking is fine. Everything downstream of asking is regulated.

Do I need patient consent to put a review on my website?

Yes, and this is the step most practices skip because the review was already public. A patient posting on Google made their own disclosure about themselves. When you copy that quote onto your practice website, you are the one using protected health information, and you are using it for marketing. HIPAA requires a written authorization for that under 45 CFR 164.508.

An authorization is a specific document, not a line in your new patient paperwork and not a checkbox. It needs six core elements and three required statements, including a description of the information being used, who is disclosing it, who receives it, the purpose, an expiration date or event, and the patient right to revoke in writing. Miss one and the authorization is defective, which is legally identical to not having one. We break the elements down individually in the guide to the patient testimonial consent form.

Two practical consequences. First, shortening the patient name to initials does not fix the problem. Anonymizing lowers the odds a stranger recognizes them, which is worth doing, but the marketing use happened either way. Second, authorizations are revocable going forward, so build a takedown path before you need one. A quote that lives in one approved wall comes down in a minute. The same quote pasted into a brochure, three Instagram posts and a Google Ads asset does not.

What does my state dental board require?

More than you would guess, and it varies enough that a checklist written for one state is misleading in another. Texas and Colorado make the point:

Texas, at 22 Tex. Admin. Code 108.57(c)(8), treats a testimonial as false, misleading or deceptive advertising if it comes from a person who is not a patient of record, is not readily subject to verification, or fails to include disclosures as to the identity and credentials of the person making the testimonial. Subsection (d) adds that advertising using photographs of actual patients requires written patient consent first and must include the language "Actual results may vary."

Colorado, at 3 CCR 709-1.17(B)(7), requires the practice to maintain the patient name, address and telephone number as of the time the advertisement was made, to obtain a specific release and consent for the testimonial, to disclose any compensation given in exchange for it, to indicate that results may vary in individual cases, and to hold reasonable substantiation for any testimonial attesting to technical quality or technical competence.

That last requirement is worth sitting with. Colorado defines reasonable substantiation as tests, analysis, research, studies or other evidence based on professional expertise. Now think about the most common dental testimonial in existence, the one where a patient says the dentist does beautiful work. That is a statement about technical quality, and there is no study you can produce to back it. Publish testimonials about what the patient experienced, which they witnessed and can speak to, and be much more careful with quotes that grade your clinical skill.

There is also an apparent conflict here that catches careful people. HIPAA-minded advice says anonymize the testimonial. Texas says a testimonial has to be readily subject to verification and disclose the identity of the person giving it. Both are satisfied by the same instrument: get an authorization that specifically covers publishing the name and photograph in practice advertising, and then use the real name. The full state-by-state framing, with a table of what each requirement demands, is on our page about dental testimonials.

Can I offer patients an incentive for leaving a review?

You can offer something of value, but you cannot condition it on the review being positive, and the material connection has to be disclosed. The FTC Rule on the Use of Consumer Reviews and Testimonials, 16 CFR Part 465, took effect on October 21, 2024 and reaches buying positive reviews at 465.4 and suppressing unfavorable ones at 465.7. The FTC cited $53,088 per violation in its December 2025 warning letters.

The one to watch in a dental office is review gating: sending patients an internal survey first, then routing the happy ones to Google and the unhappy ones to a private feedback form. Part 465 does not name gating by that word, but 465.7 combined with the FTC Act and the Endorsement Guides reaches most of what gating accomplishes, because the visible rating stops reflecting the actual distribution of patient experience. Plenty of dental review platforms still sell this as a feature. Ask directly how the vendor routes negative responses before you buy.

Separately, Google has its own rules that have nothing to do with health law and that dental offices break constantly: you may not set staff review quotas, and you may not ask patients to name a specific team member in the review. A monthly front desk target and a sign asking patients to mention their hygienist are both prohibited. We cover the compliant version in how to get more Google reviews.

Can a dentist respond to a negative review?

This is the question that costs money, and the answer is narrower than almost anyone expects. You may respond, but nothing in the response may confirm that the reviewer is or was a patient.

In October 2019 the HHS Office for Civil Rights settled with Elite Dental Associates of Dallas for $10,000 plus a two year corrective action plan. A patient had complained in June 2016 that the practice replied to their Yelp review by disclosing the patient name along with details of the treatment plan, insurance and cost. OCR found the practice had also disclosed protected health information belonging to other patients who reviewed it on the same Yelp page, and that it had no policies and procedures in place for protecting that information. OCR said it accepted a reduced amount given the size of the practice and its cooperation.

The ADA states the principle without hedging: responding to a negative review on a social media site can result in a privacy law violation, because a covered entity must continue to protect information that a patient has already publicly disclosed. That final clause is the trap. The patient told the world they came to you. That does not release you to agree with them.

Which is why the safe reply reads oddly. "Thank you for coming in" confirms the visit. "Please call the office to discuss your treatment" confirms treatment. What survives is a short statement of your privacy obligations and an offline contact route, with no acknowledgment of any relationship at all, posted identically under good reviews and bad ones. Something like: Our practice takes patient privacy seriously and we cannot discuss anyone care in a public forum. If you have a concern about your experience with us, please call the office and ask for the practice manager.

Apply it as a written policy rather than a judgment call, because the person answering reviews at 6pm is usually not the dentist. The Elite Dental corrective action plan required exactly this: written policies and procedures. If the front desk handles your Google profile, the policy has to be something they were formally trained on and certified against, not a note in a group chat.

When should you ask?

Same day, while the patient is still in the building or within a few hours of leaving. Dental satisfaction decays faster than in most service businesses because the emotional peak is relief, and relief fades. A patient who just got through a two hour appointment they were dreading will tell you exactly why it went well. Three weeks later they remember that it was fine.

The practical version that dental practices actually sustain looks like this:

1. Ask at checkout, in person, when the case is complete and the patient is visibly pleased. A person who has said yes out loud follows through far more often than one who receives a cold email.
2. Send one link by text before they reach the parking lot. It should open the camera or a text box in the browser with no app, no login and no account to create. Every step you add costs you completions.
3. Give two or three prompts instead of a blank box. What were you worried about before you came in, what actually happened, and what would you tell someone in the same position.
4. Capture the authorization on the same screen, so consent and content arrive together rather than requiring a second conversation weeks later.
5. Never make it a staff quota, and never tie anything of value to the sentiment.

One structural point on placement. A general testimonials page is the least useful page in dental marketing because nobody visits it before booking. Put the sedation story on the sedation page, the implant story on the implant page, and the anxious patient story where a nervous new patient lands. A short wall of proof beside the appointment form does more work than a long page nobody reads. Our page on collecting testimonials covers the request flow, and patient testimonials covers the wider healthcare picture, including practices that are not covered entities at all.

The short version

Ask freely, publish carefully, reply almost not at all. Dentistry gives you permission to do the thing behavioral health forbids, and practices repay that freedom by focusing on the wrong risk: they agonize over whether they may ask, then write a warm, specific, well meaning reply to an angry Google review and disclose a patient in the process.

None of this is legal advice. Read your own state dental board advertising rule before you publish testimonials, and have your HIPAA authorization form reviewed by counsel rather than downloaded. Rules cited here were read from the source regulations in August 2026.