How DPC Practices Get More Patient Reviews (and Stay Within HIPAA)

How Do DPC Practices Get More Patient Reviews?

DPC practices get more reviews by asking every patient the same way, at a moment when the good experience is fresh, with a one-tap link to their Google review form. They never offer anything in return and never ask only the patients they expect to be happy, because Google's policies forbid both, and the FTC's rule on consumer reviews bans incentives tied to a review's sentiment. When a review comes in, good or bad, the reply thanks the person without confirming they are a patient or saying anything about their care.

The good news for direct primary care is that patients tend to like what they get. Hint Health's DPC Patient Experience Benchmark, which surveyed 1,534 patients at 12 DPC clinics in eight states, reported a Net Promoter Score of 85, as Medical Economics summarized in February 2026. This guide walks through how to turn that goodwill into reviews: how to ask, what the rules allow, and how to answer the reviews you get.

Why Reviews Matter So Much for a DPC

When someone searches for a practice, reviews sit right next to your name in the results. Google says local results depend mainly on relevance, distance and how well known a business is, counts how many reviews you have toward that last factor, and says more reviews and positive ratings can help your local ranking. More honest reviews make the practice easier to find and easier to trust in the same moment.

Reviews also do a quieter job. A new patient who has never heard of direct primary care learns more from a review that says "the doctor answered my text on a Sunday" than from your homepage. For the rest of what helps you show up, see our guides to how patients find a DPC in 2027 and setting up your Google Business Profile.

When Should You Ask a Patient for a Review?

Ask when the experience is fresh and the patient has a reason to feel good, then ask everyone at that same point. Sameness matters for the rules, so pick moments that happen for every member rather than moments you choose after the fact.

Good moments that happen for nearly every member include:

• A few days after the first visit. The new-member experience is usually the most different from what patients are used to, so it is the easiest to describe.
• After the first message or call that got a quick answer. Same-day access is the heart of DPC, and patients notice it the first time it happens.
• At the 90-day mark of membership. By then the patient has a fuller picture, and the request can sit next to a short check-in.

Pick one or two of these and make them the rule, with a request that is short, warm and free of pressure. Something like "Thanks for being one of our members. If you have a minute, an honest review on Google helps other families find us" works for almost anyone.

Google lets every Business Profile create a link or QR code that opens your review form directly, which removes most of the effort for the patient. Put the link in the message and the QR code on a small card patients can take with them. Google's contributed content policy says businesses "should not require or pressure users to leave ratings or write reviews while on the premises," so the card is for later, never a request to review at the desk.

How to send the request without creating a privacy problem

A review request does not need any health information in it, so keep it that way. Use the patient's first name at most, leave out the reason for the visit, and send it through the same channel you already use for routine messages. If you text patients, our guide to HIPAA-compliant texting for DPC covers consent and what belongs in a text.

Be thoughtful about who gets the request. A patient who just received hard news, or one seen for something sensitive, may not want a cheerful review link that week. Skipping a visit type for every patient is fine. What the rules forbid is choosing who gets asked based on whether you think their review will be positive.

What Are Google's Rules on Review Incentives and Review Gating?

Google allows you to ask for reviews, and it draws two firm lines. You cannot reward a review, and you cannot steer only satisfied patients toward one.

No incentives of any kind

Google's Tips to get more reviews page says offering free or discounted goods or services in exchange for customers to post reviews is strictly prohibited, and the same applies to offers for changing or removing a review. Its contributed content policy removes content that has been posted due to an incentive offered by a business, and reviews or ratings that have been paid for, directly or in kind.

For a DPC, "in kind" covers the things that feel harmless, like a free month of membership, a discount on labs, a raffle entry or a gift card for leaving a review. None of them are allowed, even if you ask for an honest review rather than a five-star one.

No review gating

The same policy says businesses may not discourage or prohibit negative reviews, or selectively solicit positive reviews from customers. The common version of this is called review gating, where a patient gets a short survey first and only those who answer "very satisfied" are sent to Google, while everyone else is sent to a private feedback form.

Asking for private feedback is a good habit. The fix is simply to send the Google link to every patient as well, whatever they answered, so the private form is an extra door rather than a filter.

No staff reviews and no quotas

Google also removes content based on a conflict of interest, which it says includes current or former employment, and it prohibits asking staff to solicit a set number of reviews or reviews with specific content. Your medical assistant should not review the practice, and a front desk goal of "ten five-star reviews this month" crosses the line. A goal of "offer the review card to every patient at checkout" does not.

What about Yelp?

Yelp is stricter than Google. Its support page, Don't Ask for Reviews, asks businesses not to request reviews from anyone, and says its software may not recommend reviews that seem to have been prompted by the business. So point your review requests at Google and let Yelp reviews arrive on their own.

What Does the FTC Rule on Reviews (16 CFR Part 465) Mean for a DPC?

The Federal Trade Commission's final rule on fake reviews and testimonials, announced in August 2024 and codified at 16 CFR Part 465, applies to businesses of every kind, including medical practices. The FTC says the rule lets it seek civil penalties against knowing violators. Four parts of it matter most for a DPC.

Google's policy is broader than the FTC rule on one point. The FTC bans incentives tied to sentiment, while Google bans incentives for any review at all. Follow the stricter of the two, which means no incentives for reviews, full stop.

Keep gag clauses out of your membership agreement

A related federal law, the Consumer Review Fairness Act, makes it illegal to use standard form contract terms that bar or restrict a customer from reviewing a business, or that impose a penalty or fee for a review. The FTC's guide for businesses explains it in plain terms. Membership agreements are form contracts, so if a template you started from includes a non-disparagement clause, take it out before you open.

How Do You Respond to a Negative Review Without Violating HIPAA?

Reply briefly and kindly, without confirming the person is a patient and without mentioning anything about their care, then move the conversation to a phone call. That is the whole pattern, and it works for almost every review you will ever get.

The reason to be careful is that a review reply is a public disclosure. If HIPAA applies to your practice, even saying "we're sorry your lab results took longer than expected" confirms that the reviewer is a patient and discloses something about their care. Reviewers can share whatever they like about themselves, and that does not give the practice permission to add to it.

HHS has settled cases over review replies

The HHS Office for Civil Rights has resolved at least three cases where a practice disclosed patient information while answering reviews or posting on social media:

• Elite Dental Associates in Dallas, which agreed to pay and adopt a corrective action plan in 2019 over social media disclosures of patient information.
• New Vision Dental in California, which settled in December 2022 over disclosures of patient information in responses to online reviews.
• Manasa Health Center, a New Jersey psychiatric practice, which settled in 2023 after posting a response to a patient's negative online review. OCR also cited a failure to have policies and procedures for protected health information.

Each of the three agreed to a corrective action plan.

Elite Dental paid $10,000, New Vision Dental paid $23,000 and Manasa Health Center paid $30,000.

Each case came from a public post or reply about a patient, which is the kind of thing that can feel natural to write when a review seems unfair. A written reply policy and a second reader are cheap protection against that moment.

Replies that are safe to post

Here are reply patterns that hold up for nearly any review, positive or negative:

The last row is the one that surprises people. Saying "you were never our patient" seems harmless, but it confirms or denies patient status, so use the same neutral reply you would use for anyone.

Google notifies the reviewer when you reply, and you can edit or delete your reply later, which helps if you posted something you want to soften. The safest habit is to wait a day before answering a hard review and to have a second person read the reply before it goes up.

When a review is fake or abusive

Google removes reviews only when they break its policies, such as fake reviews, conflict-of-interest reviews or harassment, and its help page asks owners not to report a review just because they disagree with it. You can report a review from your Business Profile and follow it in the Reviews Management Tool, and if the report is declined, Google allows a one-time appeal. A calm public reply is still worth posting while you wait, because future patients can read the reply alongside the review.

Can You Use Patient Reviews in Your Own Marketing?

Yes, with permission. Sharing a patient's words on your own website, a flyer or social media is different from the patient posting on Google, because now the practice is the one publishing. If HIPAA applies to your practice, 45 CFR 164.508 requires a signed authorization before you use protected health information for marketing, so get written permission for any quote, photo or story before you reuse it. It is a good standard to follow even when you are unsure whether HIPAA applies, because patients expect it.

Embedding your public Google reviews widget on your site is a common, simpler route, since it shows reviews exactly as patients posted them. If you collect testimonials yourself, show the range you receive, since 16 CFR 465.7 covers misrepresenting that the reviews you display are all or most of the ones you collected. For the rest of the year's marketing, see the first-year DPC marketing plan.

How Reviews Fit With Referrals and Retention

Reviews, referrals and retention all come from the same place, which is members who feel well looked after. A member who leaves a review may also mention you to a coworker, and the request for one can sit naturally next to the other.

Be careful not to blend the two offers, though. A referral thank-you is a separate question with its own rules, including the federal anti-kickback statute if any of your patients are covered by a federal health care program, which our DPC anti-kickback and Stark basics and member referral program guide explain. Never tie any thank-you to a review. For keeping members long enough to become your best advocates, see DPC patient retention and churn.

A Simple Monthly Review Routine for a DPC

Most of this is a few minutes a week once it is set up. A routine like this keeps it steady:

1. Set the trigger. Choose the moment, such as three days after a first visit, and send the same request to every member who reaches it.
2. Keep the card out. Leave a QR code card at checkout for every patient to take home, not only the ones who seem happy.
3. Read new reviews twice a week. Reply to positive ones with a short thank-you, and give hard ones a day before answering.
4. Have a second reader. Ask someone else in the practice to check any reply to a negative review for patient details before it goes up.
5. Count once a month. Track new reviews and your average rating alongside the numbers in DPC metrics to track in 2027.

When you hire your first DPC medical assistant, add the review request and the safe reply patterns to their first week.

This post is general information, not legal advice. Rules for health care advertising and confidentiality also vary by state, so check with a health care attorney if you are unsure how they apply to your practice.

Keeping the Review Habit Going When the Panel Gets Busy

The hard part of reviews is not knowing what to do. It is remembering to do it for every patient, every week, when the request lives in your messaging tool, the visit lives in your EHR and the membership start date lives in your billing system. On a busy week, those are the steps that slip, and the patients who would have happily written a review never get asked. Put the trigger on a schedule that runs for every member, so the habit doesn't depend on someone remembering it.

Spot a wrong fact? Email a correction.