Go to AAD Home
Donate For Public and Patients Store Search

Go to AAD Home

Troll control

How can dermatology practices respond to false and malicious online reviews while maintaining HIPAA compliance?


By Allison Evans, Assistant Managing Editor, June 1, 2023

Banner for troll control feature

The practice of medicine is personal. It’s personal for the patient, and it’s personal for the physician. While negative reviews sting, there is something worse than a negative review: A fake or malicious review that could threaten your reputation and livelihood. About 75% of health care consumers select their physician based on findings from an online search — highlighting the gravity and influence of online reviews in particular.

According to a study from Fakespot, a company that specializes in using AI to detect fake online reviews, at least 30% of Amazon reviews are inauthentic and unreliable, and that is likely on the low end. As a world of fake review scams and marketplaces have been exposed, consumers have become wiser and are better at identifying false and malicious reviews. Unfortunately for physicians, it can be harder for consumers to know when a physician review is false, as HIPAA laws make it nearly impossible to thoroughly defend one’s reputation.

Monitoring strategy

Having a strategy for how to review and respond (or not respond) to online reviews is very important, said Kevin Crawford, MD, FAAD, a member of the Academy’s Practice Management Committee and a Mohs surgeon in Indiana.

“Reviews not only help with search engine optimization, but they can provide valuable feedback to you and your team about what you’re doing well or what you could improve on,” Dr. Crawford continued. “I suggest monitoring your reviews as they come in and responding within 24 to 48 hours. A timely response lets the public know you take patient feedback seriously, and a quick phone call to follow-up on a negative review can help resolve the patient’s concern.”

“We leverage a third-party tool to ensure reviews are taken care of quickly,” he said. “Using a tool to aggregate your reviews from multiple sites can save you time and give you better reporting insights.”

Don’t be afraid of negative reviews or use that fear as an excuse to not manage your online reputation, said Dr. Crawford. “You will get some negative reviews, but that’s okay. They are unavoidable and can actually bring authenticity to your online listings.”

While monitoring and responding to reviews can be an important part of reputation management, it’s not without its own costs. “Monitoring reviews, responding to reviews, and following up directly with patients can require a sizeable time investment, depending on the volume of reviews you receive and how many reviews require a phone call follow up,” Dr. Crawford said.

Ashton Gonzales, practice manager at Vanguard Skin Specialists in Colorado, spends about two to three hours per week reading and responding to online reviews. “We use our appointment reminder system to send requests for Google reviews every week on Friday afternoons,” she said. “Every Monday I read all of the reviews that were received, and I immediately respond to any negative, false, or malicious reviews. I also personally contact patients who take the time to leave exceptionally positive reviews, which is the most fun part of the process!”

Take it down!

While the Federal Communications Decency Act of 1996 protects websites that publish review content like Google, HealthGrades, Yelp, and the like, physician practices still have options, said Daniel F. Shay, JD, an attorney at Alice G. Gosfield and Associates, PC. “Practices can go through the review website protocols to attempt to get false reviews removed if they are against the site’s policy,” said Shay. For reviews that are probably false, he recommends this as the first option.

It’s a good idea to familiarize yourself with each site’s policy, said Dr. Crawford, who reports any review that violates the review site’s policy.

“Generally speaking, when you choose to respond you are much more likely to trip over HIPAA than you are to successfully thread the needle.”

Given the constraints of HIPAA, proving a review is false can be very difficult, noted Dr. Crawford. “If the review specifically states it is for the wrong business or if it does not represent a personal experience (describes a friend’s or family member’s experience, etc.), or if it is blatantly spam, then it is likely you can get the review removed. If the review itself cannot clearly be shown as false or that it violates the review site’s policy, most review sites will not remove it.”

Like Dr. Crawford, Gonzales also reports any review that violates a review site’s policy. “I have had success getting one review removed. We found the exact review on three of our practice locations’ Google pages and so it was removed.” Despite only having one success, Gonzales maintains that it is still worthwhile to keep trying.

“You may have to provide evidence to show that it is inaccurate, such as proving that the office was closed that day or that doctor has not worked there for two years prior to the date of the review. You can have an attorney send a ‘cease and desist letter’ to demand that it be taken down, said dermatologist and lawyer Clifford Warren Lober, MD, JD, FAAD, in an April 2020 issue of DermWorld.

Should I respond?

Shay advised, “Generally speaking, when you choose to respond you are much more likely to trip over HIPAA than you are to successfully thread the needle.”

To address the details of the complaint online, a HIPAA authorization form would be needed — one that almost no patient would willingly sign, Shay continued. The authorization must contain specific elements and cannot be simply verbal permission or an electronic communication in which someone agrees to let you respond, he added.

“Many physicians who have been confronted with a false or malicious online review understand the powerful urge to defend one’s business and one’s integrity. If a practice is going to respond,” Shay said, “they should respond generically and not respond to the specific complaint.”

It can be tempting to want to type a rebuttal to a negative review, explaining your perspective on the situation, Dr. Crawford said, “but this can have serious legal ramifications and it can also come off as rude or arrogant to prospective patients who may be reading your reviews.” Responding to the review could also infuriate the original poster, who may retaliate by posting additional negative comments.

Physicians should weigh the advantages and disadvantages of responding. Here are some considerations:

  • If the review screams fake to you, there’s a good chance that potential patients will feel the same way. It may be best to let it rest and let good reviews override it.

  • A carefully crafted and compliant response may allow for a problem to be resolved and the reviewer may decide to edit or delete their review.

  • Responding to a clearly false or malicious review may only attract more attention to that review and may cause the person to write more negative or false comments.

  • How many positive reviews do you have? Sometimes a few negative reviews bring authenticity to a business.

Dos and Don’ts of responding to online patient reviews

Online reviews can be one of the most influential factors when prospective patients choose a dermatology practice, said Olivia Barry, MPH, the Academy’s manager of practice management. “A negative review can weigh heavily on your practice’s reputation and its ability to attract new or retain existing patients. While there is no silver bullet to ensure you never get a negative review, following the suggestions below can help combat negative online reviews, generate positive ones, and build a winning practice image.” Get more details.


  • Respond impulsively

  • Remove the negative review if it's on your website

  • Disclose protected health information

  • Engage with trolls/cyberbullies


  • Review the patient's experience and consider their perspective

  • Have a templated, customizable response prepared

  • When appropriate, contact the patient directly via phone

  • Use patient feedback to improve your practice where appropriate

HIPAA-compliant responses

As HIPAA officer at the Colorado practice, Gonzales is cognizant of the ease with which a HIPAA violation could occur. “Some of my strategies are to never confirm or deny whether the person posting the review is our patient, even if they say that they are in their review. I always respond to reviews as generically as possible. For example, when a patient posts a positive review, I would respond with something like this: ‘Thank you so much for sharing this experience. Our office prides itself on treating every single patient like family and we are so glad to hear when we are successful!’”

“If a patient posts a negative review,” Gonzales continued, “I would respond with something like this: ‘Thank you for sharing this feedback. We pride ourselves on ensuring that every patient leaves our office with all of their concerns addressed, and we are so sorry to hear that we missed that mark. Our practice manager will reach out to you personally to see how we can make this right.’”

Because of HIPAA, you can’t acknowledge that the patient was a patient seen in your office, said Kavita Mariwalla, MD, FAAD, coauthor of The Business of Dermatology and a practice owner at Mariwalla Dermatology in New York. When she suspects a reviewer is not an actual patient, she responds with something like this: ‘Unfortunately, due to HIPAA restrictions, we are not able to comment on this specific scenario. However, if you are a patient of the practice, we ask that you give us a call and we’ll be happy to resolve this offline. Our goal is for everyone to have a great experience at our practice.’

Dr. Crawford recommends consulting with your legal team to develop your own best practices. “When responding to reviews, never confirm or deny the details of any review. Even if a person volunteers details about their appointment or visit in their review, don’t acknowledge those details, or disclose any other protected health information in your response, as this would clearly violate HIPAA.”

If someone leaves a negative review and you’re familiar with the situation described online, follow-up with them directly via a phone call, advised Dr. Crawford. “Being proactive in your follow-up can go a long way. Oftentimes, someone who leaves a negative review just wants to know they’ve been heard. If you can resolve the issue, they may go back and delete, or better yet, update their review.”

However, Dr. Mariwalla cautions practices about getting wrapped up in the idea of following up with all negative reviews. “More often than not, the time it takes to call all negative reviewers back, apologizing, and asking them to take their review down, is just not worth it.”

“Instead, focus on thanking the individual for leaving a review and making it as easy as possible for the person to contact you offline to resolve their issue,” Dr. Crawford said. “This can include providing your practice phone number or a link to a secure web form where they can provide additional details about their experience. Our goal in responding to reviews is to show we care about patient feedback and to drive the conversation to a secure channel where issues can be resolved privately and compliantly.”

Digital marketing for dermatologists 102

Read about the value of setting social media goals, HIPAA compliance, and how to create quality content.


Some physicians have opted to sue patients or online trolls, but very few have scored legal successes. Proving defamation is already difficult, Shay said. Also, states have differing interpretations of defamation, so it may be even more complex depending on where you live. As of October 2022, 32 states and Washington, D.C., have what are called anti-SLAPP (strategic lawsuits against public participation) laws. These laws are intended to prevent people from using courts, and potential threats of a lawsuit, to intimidate people who are exercising their First Amendment rights. If a physician can’t prove legal defamation in a state with an anti-SLAPP law, then the lawsuit is prematurely shut down and may result in the physician having to pay for the other side’s legal fees.

“It may help to approach negative reviews with a dispassionate cost-benefit analysis of whether a lawsuit is the right path,” Shay advised. “You must ask yourself: What’s the actual monetary harm from this? Did people read this review and did your business drop off immediately after the review posted?”

“Consumers are more aware now than ever that false or malicious reviews are often individuals with an axe to grind or may just be an online troll looking to stir the pot,” Dr. Mariwalla said. While she has considered litigation at times, she’s never followed through with it. “At the end of the day, there are so many things that are all-consuming for physicians that you have to consider the end goal and whether it’s truly worth the cost, time, and energy investment.”

How to identify a fake review

Sometimes, a fake review is obvious. Other times, they can be pernicious. Here are four tips to watch for that can alert you to a fake review. If any of these types of reviews appear on your page, submit a request to the website to have the review removed.

  1. Dig into the reviewer’s profile: Fake reviewers often use generic names (or sometimes famous names or characters) and create profiles without pictures and information.

  2. One-star reviews: Often, multiple one-star reviews coming in around the same time with no accompanying text can signal a false review.

  3. The content of the review can be proven false: A review may mention services or physicians who do not exist at your practice, which is a clear sign that either a patient is confused or there is an internet troll at work.

  4. Repetition: A review that repeats the same allegations or grammatical style as other reviews may be false. See what other products and services they have reviewed and compare the content of those reviews.

Asking for reviews

“Our strategy for dealing with online reviews includes making it as easy as possible for our patients to provide their feedback online,” said Dr. Crawford. “False or malicious reviews are, in many cases, unavoidable. However, by encouraging real patients to leave real reviews, we’re able to portray an accurate representation of our patient experience.”

Typically, happy people don’t write online reviews, unless prompted, said Dr. Mariwalla. “If you have a patient who is happy with the service or treatment, ask them to write a Google review. The easiest way to do that is to give them a ready-made card that has a QR code that directs them to your Google review page. Patients are usually more than happy to do this for you.”

Dr. Crawford has also seen great success asking patients for reviews. “We send patients a text message follow-up with a link for them to leave their review directly on Google and Facebook. Some software solutions will first screen patient feedback prior to asking them to leave a review so only positive reviews are posted, but we believe in transparency by asking all of our patients to leave a review. We’re confident in the care we provide, so by making it easy for all patients to leave their feedback we see an overwhelmingly positive sentiment in our reviews,” he added.

“We use our appointment reminder system to send out automated requests for Google reviews each Friday afternoon to all patients who had an appointment that week,” Gonzales said. “We usually receive 20-40 reviews per week across all of our offices; it’s rare that these reviews are negative.”

Building an online presence

“The amount of time you’re going to spend fighting negative reviews, you’re better off taking that energy and spending it trying to get positive reviews and building your practice on social media,” Dr. Mariwalla said.

According to recent statistics from Press Ganey, patients typically visit at least three websites before booking an appointment, highlighting the importance of providing ample information online and in various locations.

A recent Tebra report found that only 18% of respondents said they follow their doctor’s office on social media, although 45% said they would if their doctor posted regularly, highlighting these platforms as a great opportunity for practices to engage with patients outside the office.

“I have been doing this for many years,” Dr. Mariwalla said, “and I have good reviews, bad reviews, and some that are outright false and have caused a lot of turmoil. When you look back on the amount of stress and energy dealing with these reviews can take, you may decide to walk away, although this is admittedly very hard to do.”

“Before Facebook and Instagram, people couldn’t see you; you were this nebulous person,” Dr. Mariwalla said. “Nowadays, more people are going to find you on social media and your website and decide for themselves based on what they see. The more videos and social content you post, the more Google’s search algorithms will work in your favor.”

Promote the specialty

Access resources to help you promote the specialty in your community and beyond.