Patient reviews: what you can and can't do

A patient has just left you a review, and now you are wondering what you are allowed to do about it. Maybe it is glowing and you want to share it. Maybe it praises your care directly and you want to say thank you without breaching a rule you have heard about but never actually read. Maybe it is negative, wrong, and clearly identifies who wrote it, and every instinct says to set the record straight in the replies. All three situations sit inside the same small set of rules. Once you see the shape of them, most review decisions take about ten seconds.

A review is not automatically a testimonial

Practices often treat 'review' and 'testimonial' as the same word wearing different clothes. AHPRA does not. A testimonial, in the sense the National Law bans, is a positive statement about a clinical aspect of care: the symptom someone came in with, the diagnosis or treatment they received, the outcome, or the practitioner's skill. A review that says the reception staff were lovely, parking was easy and they got seen the same day contains none of that, and is not a testimonial at all, however warm it reads. We cover the full mechanics of the rule, including the penalties, in AHPRA's advertising rules in plain English. This guide is about what that rule means once it meets the messy, specific situations real reviews create.

What counts as 'using' a review

Most practices assume 'use' means publishing a review on your own website, and stop there. AHPRA's definition is wider. You are considered to have used a testimonial if you publish it directly, link to it on someone else's site, reshare a patient's positive post, or simply interact with it: liking a clinical review, or replying to it warmly, counts as use even though you didn't write a word of it yourself. The cosmetic-procedure guidelines add a detail worth knowing before you tap share: a testimonial posted as a time-limited story that vanishes after a day is treated the same as a permanent post. There is no quieter, lower-risk version of resharing a clinical review. It either stays untouched or it doesn't.

Who is responsible comes down to control

AHPRA's test for responsibility is simple to state: whoever controls the advertising is responsible for what is in it. That single idea explains every case that otherwise seems inconsistent.

• Your own website and social pages. You have full control, so you carry full responsibility. Clinical reviews have to come down, and if a platform doesn't let you remove individual comments selectively, the safer path is disabling the reviews or comments function entirely rather than leaving the risk live.
• Google. A Google review is the patient's own speech on a platform you don't control. You are not required to chase it down or ask for its removal, and AHPRA says so explicitly. Your obligation starts the moment you try to use it somewhere you do control.
• Booking and directory platforms. Where a service like HotDoc or HealthEngine runs its own reviews function that you cannot edit, responsibility for that function sits with the platform, not you. You remain responsible for anything else you control on that same page, and for anything you separately pull from it into your own marketing.

Inviting feedback without stepping over a line

Asking patients for a review is generally fine. The sharp edges are incentives and selection, and Australian Consumer Law guidance is specific about both. An incentive for leaving a review risks being misleading unless it is offered regardless of whether the review turns out positive or negative, and disclosed as an incentive. Sending the review link only to patients who smiled on the way out, while quietly skipping anyone who seemed unhappy, has the same effect as writing the reviews yourself: it presents a picture that is technically real but deliberately incomplete.

Fake and incentivised reviews cost real money

The ACCC has taken this seriously for over a decade, and the numbers have grown with the law. A removalist business was fined $6,600 in 2011 for publishing testimonials copied and altered from an unrelated website and presented as its own. An online tasking platform that let businesses draft their own reviews, auto-published if the customer didn't respond within three days, was ordered to pay $600,000 by the Federal Court. HealthEngine, a booking platform used by health practices across the country, admitted it had quietly withheld a large volume of negative patient reviews over three years and edited others to remove the negative parts. The Federal Court ordered $2.9 million in penalties covering that conduct alongside other unrelated issues in the same case. Since March 2026, the maximum civil penalties under the Australian Consumer Law for misleading representations have risen again, and now reach well into eight figures for a corporation. Whatever your practice's size, the direction of travel is the same: this is not a grey area regulators are relaxing on.

Replying to a negative review without a second breach

The instinct when a review is unfair is to correct it publicly, with specifics. That instinct is where a bad review turns into two problems instead of one. Health information, including the fact that someone is or was a patient, is sensitive information under the Privacy Act, and every organisation that provides a health service and holds health information is covered by that Act regardless of its size. Confirming, denying or discussing someone's attendance in a public reply discloses exactly that kind of information, whether the review itself was accurate or not.

Deleting a genuine negative review because it is inconvenient sits closer to the conduct the ACCC has fined businesses for than to a fix. If a review is abusive, clearly about the wrong business, or breaches a platform's own policies, report it through the platform rather than arguing the point yourself in public.

What compliant social proof looks like instead

None of this leaves a practice with nothing to show. You can state plain facts: how long the practice has operated, the qualifications your team actually holds, accreditations, and the breadth of services on offer. You can maintain a well-answered, current Google Business Profile that patients find on their own, which does real work for local search independent of anything you publish yourself. You can publish genuinely useful content that demonstrates how you think about care, rather than asserting how good you are. In our experience, a practice that does these things consistently reads as more trustworthy than one with a wall of five-word raves pinned to its homepage, and it carries none of the risk.

• The reviews checklist
• Reply warmly to non-clinical reviewsPraise about staff, parking or booking ease isn't a testimonial, so thanking or even quoting the reviewer on your site is fine
• Leave clinical reviews exactly where they areDon't link to, quote, screenshot or feature a review mentioning a diagnosis, treatment or outcome, however flattering
• Never like, comment on or reshare a clinical review from a practice accountA like counts the same as a repost, and a story that disappears in a day counts the same as a permanent one
• Invite reviews from everyone who attended, not just the happy onesSelective invitations can misrepresent the overall picture under Australian Consumer Law
• Disclose any incentive, and offer it regardless of what the review saysAn incentive tied to sentiment is the kind of conduct the ACCC has fined businesses over
• Never confirm or deny that a negative reviewer was a patientThat confirmation is itself health information, protected whether the review is fair or not
• Take clinical disputes off the platformA short public reply plus a direct invitation to call beats a public argument every time
• Never edit, delete or cherry-pick reviews to look better than you arePublishing only the positives, or trimming a mixed review, is its own breach separate from the testimonial rule

If you're not sure whether a specific reply or repost crosses a line, the safest move is to ask before you post rather than after. It is exactly the kind of case-by-case judgement call we help with in a free growth plan, alongside everything else your website and Google presence touch.