How to Respond to Negative Med Spa Reviews: HIPAA-Safe Reply Templates
Why your reply matters more than the review
A negative review is read by every future client who checks your Google profile. Your reply is read by them too. It is the one part of the page you control, and it shows how the clinic behaves when something goes wrong.
Many clinics leave that space empty. In October 2026 Workee looked at the lowest-rated Google reviews of 210 med spas and aesthetic clinics in one large U.S. metro area. Of 957 one- and two-star reviews with text, 379 (40%) had no reply from the owner. In the last 12 months the share was similar: 123 of 299.
A reply will not undo a bad visit. What it can do is show that the clinic listens, protect patient privacy, and move the conversation to a channel where the problem can actually be solved. This guide gives you a formula, templates by complaint type, and the cases where you should escalate or say nothing at all.
It is written for med spas and aesthetic practices, but the privacy rules apply to any clinic that is a HIPAA covered entity.
What you cannot say: HIPAA in a public reply
If your practice is a HIPAA covered entity, a public reply cannot disclose protected health information. That includes confirming that the reviewer is or was your patient, even when the reviewer said so first.
The Office for Civil Rights has enforced this several times:
New Vision Dental, California, December 2022: $23,000 and a two-year corrective action plan. Yelp replies gave patients' full names and visit, treatment and insurance details that the reviewers had not posted (HIPAA Journal).
Manasa Health Center, New Jersey, June 2023: $30,000 and a two-year corrective action plan. A reply to a Google review described the patient's diagnosis and treatment; OCR found disclosures about four patients (Nixon Peabody summary, HHS announcement).
Nixon Peabody counts four OCR settlements over review replies between 2019 and 2023, from $10,000 to $50,000. In each case the problem was the reply, not the review.
Never put these in a public reply:
The reviewer's name, if they posted under a nickname
Any confirmation that they visited, booked or paid
The treatment, product, dose, provider or date
Before and after results, photos or chart notes
What they "forgot to mention": no-shows, unpaid balances, consent forms
Not every med spa is a covered entity. Whether HIPAA applies depends on how the practice bills and operates, so confirm it with counsel. Either way, write every reply as if it applies. State privacy laws and patient trust point the same direction.
Sort the complaint before you write
The right reply depends on what went wrong. In the reviews Workee analyzed, most operational complaints fell into the five groups below. Billing and refund disputes were the most frequent, followed by calls and messages that went unanswered and cancellation or deposit disputes.
Booking and communication. What the review usually says: Nobody called back, appointment not in the system, cancelled last minute. Who owns the reply: Front desk lead or manager. Goal of the reply: Own the process failure, open a direct line.
Money. What the review usually says: Charged a fee, refund refused, price differed from quote, package or voucher dispute. Who owns the reply: Manager or owner. Goal of the reply: Move to a private conversation, never argue amounts in public.
Wait time and staff. What the review usually says: Kept waiting, rushed, rude or dismissive staff. Who owns the reply: Manager. Goal of the reply: Acknowledge the experience, show it will be reviewed.
Treatment result. What the review usually says: Did not work, uneven, bruising, burn, reaction. Who owns the reply: Medical director, then manager. Goal of the reply: Say nothing clinical, invite a private clinical follow-up.
Not a real patient. What the review usually says: Competitor, ex-employee, wrong business, spam. Who owns the reply: Owner. Goal of the reply: Flag to Google, reply only if needed, stay neutral.
Tag each new review with one type before anyone replies. The tag decides the template, the owner and whether to escalate.
A four-step reply formula
Every reply below follows the same four steps. Together they usually fit in three to five sentences.
Thank them for the feedback. Not for "choosing us", which confirms a visit. "Thank you for taking the time to share this" is safe.
Say what the clinic expects, without facts about them. Describe your standard, not their appointment: "We expect every call to be returned the same business day."
Own the process, not the clinical claim. You can say a process should work better. Do not agree or disagree with a medical outcome in public.
Move it offline, with a name and a channel. Give a role and a direct contact: "Please call our practice manager at [phone] or email [address]." Then follow up privately.
Three habits make the formula work:
Reply within two business days. A fast, calm reply reads better than a perfect late one.
Sign with a role, not a provider's name when the complaint is clinical.
Never paste the same reply twice. Identical replies read as automated and get ignored.
Reply templates by complaint type
Edit each template before posting. Replace the brackets, change the wording, and check that nothing in it confirms a visit or a treatment.
Booking and communication
Nobody called back
Thank you for letting us know. We aim to return every call and message the same business day, and it sounds like that did not happen here. Please contact our front desk lead, [name], at [phone] so we can make this right.
Appointment cancelled or missing from the schedule
Thank you for sharing this. A booking should never disappear or change without a clear message from us. We are reviewing how our schedule changes are confirmed. Please reach our practice manager at [phone or email], and we will look into it directly.
Money
Fee or refund dispute
Thank you for raising this. We want our fees and policies to be clear before anyone books, and we take billing questions seriously. Because account details are private, please contact our practice manager at [phone or email] so we can review it with you one on one.
Price different from what was quoted
We appreciate the feedback. Pricing should never be a surprise, and we are checking how quotes are explained at our clinic. Please reach [role] at [phone or email] so we can go through it privately.
Wait time and staff
Long wait or rushed visit
Thank you for telling us. Running behind without keeping people informed is not the standard we set. We are looking at how our team schedules and communicates delays. If you are open to it, please call [role] at [phone].
Rude or dismissive staff
Thank you for sharing this. Everyone who contacts our clinic should be treated with respect, and we take this kind of feedback seriously. Our manager, [name], would like to hear more. Please reach out at [phone or email].
Treatment result
Unhappy with a result or a reaction
Thank you for reaching out. We take every concern about care seriously and cannot discuss anyone's treatment in a public forum. Please contact our clinical team at [phone] so a provider can speak with you directly.
Do not explain the procedure, the expected recovery, or what the reviewer "should have" done. That is clinical information, and it confirms a visit.
Not a real patient
Review that does not match any client
Thank you for your feedback. We cannot locate this concern, and we take every review seriously. If you have contacted us, please reach [role] at [phone or email] so we can understand what happened.
Star rating with no text
We are sorry to see this rating. If you are willing to share more, please contact [role] at [phone or email].
When to escalate, flag, or wait
Some reviews should not get a template at all. Decide the route first.
Possible injury, infection, burn or adverse reaction. Route: Medical director. Before any public reply: Reach the patient privately first; document the contact.
Threat of a lawsuit, attorney named, regulator mentioned. Route: Owner and legal counsel. Before any public reply: Hold the reply until counsel approves it.
Review names a staff member. Route: Manager and that staff member. Before any public reply: Reply about the standard, never about the person.
Ex-employee, competitor or someone with a conflict of interest. Route: Owner. Before any public reply: Report it to Google; reply only if the review stays up.
Spam, harassment, or someone else's personal details. Route: Owner. Before any public reply: Report it to Google; do not engage.
What Google allows you to report. Google's prohibited content policy removes reviews that are not based on a real experience, come from someone with a conflict of interest such as current or former employment, are off-topic, harass, or share personal information. A review is not removed just because it is negative or unfair.
What you must not do to get a review taken down.
Do not offer a refund, discount or free service in exchange for removing or changing a review. Google's policy bans rewards for removing negative reviews.
Do not threaten legal action to make a reviewer delete a post. The FTC's rule on consumer reviews and testimonials, in effect since October 21, 2024, covers suppressing reviews through physical threats or unjustified legal threats.
Do not post or buy reviews to bury a negative one. The same FTC rule bans fake reviews.
You can still resolve the problem privately and refund what you owe. If the client later updates the review on their own, that is their choice.
Fix the cause, not only the reply
A reply handles one review. The pattern behind ten reviews is an operations problem. Once a month, count the tags from the past 30 days and pick the one process to fix.
Calls and messages not returned. Fix this first: An owner and a response target for every inbound channel. Related guide: Med spa lead response SOP.
Fees, refunds, cancellations. Fix this first: Policy wording shown before payment, staff scripts for exceptions. Related guide: Med spa cancellation policy.
Deposits and card on file. Fix this first: One clear mechanism per service, explained at booking. Related guide: Card on file vs deposit.
Last-minute changes by the clinic. Fix this first: A waitlist and a rule for who is offered an opening. Related guide: Med spa waitlist workflow.
Expectations after a consultation. Fix this first: Written next steps and a follow-up message. Related guide: Consultation follow-up templates.
Balance the negative side with a steady flow of new reviews from satisfied clients. Our guide to getting more Google reviews covers how to ask without breaking Google's rules.
Who replies and how fast
Write the process down once, so replies do not depend on who happens to see the notification.
Day 0: tag and route. The person watching the profile tags the review with a complaint type and sends it to the owner listed for that type above.
Day 0–1: private contact first. If you can identify the client in your own records, reach them privately before posting. Do not mention that contact in the public reply.
Day 1–2: post the public reply. Use the template for the tag, edited for the situation. A second person reads it for privacy before it goes live.
Day 7: close the loop. Log the outcome: resolved, refunded, clinical follow-up, or no response.
Monthly: review the tags. Pick one process to fix, as described above.
Keep the templates, the escalation routes and the log in one shared place. Train everyone who can post on behalf of the clinic, including outside agencies.
How Workee can support your review process
Workee does not write or post replies to reviews. It helps with the two things around them: hearing about problems before they reach Google, and keeping a steady flow of reviews from happy clients.
Post-visit follow-up. Jenny, Workee's AI front desk, follows up after each visit by text and email. A client with a concern has a private place to say so first.
Google review requests. Workee can send review requests after visits, so new positive reviews keep arriving alongside the occasional negative one.
Clear payment terms at booking. Deposits, no-show fees and cards on file are set up in the booking flow, which helps prevent the fee disputes that end up in reviews.
Fewer missed messages. Lead forms on your website let Jenny answer questions and book a time, and the weekly report shows what Jenny handled.
Book a demo to see how it fits the system you already use.
Frequently asked questions
Can a med spa respond to a review without violating HIPAA?
Yes, if the reply contains no information about the person. Do not confirm they are a patient, name a treatment or date, or correct their account with details from your records. Speak about your standards and invite them to contact you privately.
Should we reply to every negative review?
Reply to almost all of them, within two business days. The exceptions are spam, harassment and reviews you have reported to Google; for those, wait for Google's decision. A short, calm reply is better than silence.
Can we get a negative Google review removed?
Only if it breaks Google's content policy, for example a review from a former employee, a fake review, or one that shares personal information. Negative or unfair is not enough. Report it from your Business Profile and reply neutrally in the meantime.
Can we offer a refund in the public reply?
No. Discuss money privately, and never tie a refund or discount to changing or removing the review. Google bans rewards for removing negative reviews, and offering one in public also confirms a transaction.
What if the review is about a medical complication?
Route it to your medical director before anyone replies. Contact the patient privately through your normal clinical channel. The public reply should only say that you take care concerns seriously and give a way to reach the clinical team.
Can we ask the reviewer to update the review after we fix the problem?
You can tell them the issue is resolved. Leave any change to the review up to them, with no incentive and no pressure.
Keep updated about latest industry insights and subscribe to our newsletter
Follow Us
