How to Respond to a Negative Google Review as a Dentist in Ontario (Without Breaking PHIPA)

Key takeaway: an Ontario dentist can reply publicly to a negative Google review, but the reply must never confirm that the author is a patient, and must never mention a treatment, an appointment date or an amount billed. Under the Personal Health Information Protection Act, 2004 (PHIPA), even the identification of a person as your patient is personal health information (section 4(1)(b)), and section 29 prohibits disclosing it without consent. The safe reply is short, calm, focused on your process rather than the person, and it moves the conversation to a private channel.

Why this matters more in 2026 than it did five years ago

An unanswered negative review used to be a nuisance. It is now a data point that AI assistants read. When a patient asks ChatGPT, Gemini or Perplexity for "a good dentist in Mississauga" or "best dental clinic near Vaughan", the answer is built from public reviews and from what the practice says back. A listing with 150 reviews and zero owner replies reads as an empty storefront to an AI.

In the first batch of dental and medical aesthetic clinics in Ontario and Quebec that we measured in September 2026, most qualified practices sat at a 0% owner response rate, with between 6 and 30 negative reviews left without a reply. This is rarely indifference. It is a time problem, and above all a fear problem: many dentists do not reply because they are not sure what they are allowed to write.

What the law actually says

PHIPA does not mention Google. It defines personal health information, and that definition is enough.

Section 4(1) says that "personal health information" means identifying information about an individual that, under clause (b), "relates to the providing of health care to the individual, including the identification of a person as a provider of health care to the individual."

Section 29 sets the rule: "A health information custodian shall not collect, use or disclose personal health information about an individual unless" the individual has consented, or the disclosure is otherwise permitted or required by the Act.

Read together, these two provisions mean that saying "you were our patient" in a public reply is a disclosure of personal health information. The Royal College of Dental Surgeons of Ontario's Professional Liability Program says it in one line on its patient privacy page: "even the fact that someone is a patient is private."

Three practical consequences follow.

1. You do not confirm the author is a patient. Even when they say so themselves. Their disclosure is theirs to make; yours is a breach.
2. You do not mention any detail of care. No procedure, no tooth, no diagnosis, no appointment date, no invoice amount. Not even to defend yourself. Especially not to defend yourself.
3. You do not correct facts in public. If the review is inaccurate, the correction happens privately with the person, or through a report to Google if the review breaks its content policies.

The five-step method

This is what we apply to every reply we write for a clinic, and what you can apply yourself.

1. Wait 24 hours, not 24 days

A reply written within the hour is often a reply written in anger. A reply written three weeks later tells every reader that nobody watches the listing. The useful window is one to three days. If you cannot hold that rhythm alone, that is exactly what a response service takes off your plate.

2. Name the emotion, not the event

"We are sorry your experience did not meet the standard you expected." That sentence acknowledges dissatisfaction without confirming an appointment, a treatment or a bill. It is true whatever the situation, including when the author was never a patient at all.

3. Talk about the process, never the person

If the complaint is about waiting time, talk about how you manage the schedule. If it is about cost, talk about how you explain estimates before treatment. If it is about the front desk, talk about how you train the team. You describe how the practice works, not what happened that day with that person.

A rule we hold to: always prefer a reply about a process (an unexplained estimate, a wait, a late policy) to a reply about a person. A sentence aimed at an employee or at a patient reads as an accusation in both directions.

4. Invite the conversation to a real private channel

"We would like to understand what happened. You can reach our office manager at [phone] or [email]." The channel must exist and must be read. An invitation that lands in a full voicemail box does more harm than silence.

5. Reread once with the privacy question

Before you publish, reread the reply with a single question: "If I did not know this person, would my reply be exactly the same?" If any word depends on the chart, remove it.

Three templates you can adapt

These are deliberately short. A two or three sentence reply gets read; a twelve sentence reply reads like a court filing.

Complaint about waiting time

Thank you for taking the time to write. We are sorry the wait was longer than what we aim for. Our team reviews the schedule every week to limit these situations. If you would like to discuss it, our office manager can be reached at [phone].

Complaint about cost or billing

We understand your frustration and we take it seriously. We are committed to explaining every estimate before treatment, and we want to know where that explanation fell short. Please reach [first name], our office manager, at [email].

A review you believe is false or unfair

We take every comment seriously. We cannot identify a situation matching this description, and we would welcome a direct conversation to understand it. Our office manager can be reached at [phone].

In that last case, two things happen in parallel: report the review to Google if it breaks its content policies (conflict of interest, content unrelated to a customer experience, harassment), and document internally. Never promise in the reply that the review will be removed. You do not control that decision.

What you must never write

• "According to our records, you were seen on March 12 for..." A confirmation of the care relationship and a disclosure of detail: two breaches in one sentence.
• "You cancelled three times." The same thing, phrased as a reproach.
• "We did everything possible for your crown." A disclosure of treatment.
• "This review is false." You cannot prove it publicly without opening the chart.
• A template reply copied fifty times. Readers see it, AI assistants see it, and it damages the listing instead of helping it.

What about positive reviews?

Reply to them too, under the same rule. Thanking a person by the first name that appears on Google is fine; naming the treatment they received is not. "Thank you, Sarah, your note made the whole team's day" is enough. An unanswered positive review is a missed opportunity, and AI assistants read those replies as much as the others.

When to hand it off

If your practice has more than 25 unanswered reviews, the catch-up is several hours of delicate writing. That is the point where a response service takes over: a person writes every reply in the patient's language, English or Quebec French, with the PHIPA rule applied to every line, and nothing is published without your approval. You can see how we work on our Google review response service for dental and medical aesthetic clinics page, and ask for a free Review Snapshot: your measured response rate, your recent unanswered negative reviews and the five complaints that come up most, before any offer.

Frequently asked questions

Is a dentist allowed to reply to a Google review in Ontario? Yes. Nothing in PHIPA or in RCDSO guidance prohibits replying. What is regulated is the content of the reply: no personal health information, no confirmation of the care relationship.

Should we reply to a one-star review with no text? A brief, neutral reply is enough: you are sorry to see this rating and you remain available to discuss it. It shows every other reader that the listing is watched.

Can a negative review be removed? Only if it breaks Google's content policies, and Google makes that call. A calm reply is the only thing you fully control.

Is an AI-generated reply acceptable? Nothing forbids it, but the privacy obligation stays with the custodian, not the tool. A generated reply that names a treatment or confirms an appointment is your breach, not the software's. That is why every reply we deliver is written by a person and approved by the clinic.

Does this apply to medical aesthetic clinics too? When the clinic is a health information custodian under PHIPA, yes, the same rules apply. Cosmetic treatments are still health care information about an identifiable individual.

Written by Darly Robert Cham, founder of IntelliAIScale. Multi-role clinical research background at Hôpital Maisonneuve-Rosemont (clinical research coordination, clinical data management, clinical research operations), CCRP, CCRC and CCRA certified. Sources: Personal Health Information Protection Act, 2004, S.O. 2004, c. 3, Sched. A, sections 4(1)(b) and 29 (Ontario e-Laws); RCDSO Professional Liability Program, "Patient privacy"; Google Maps content policies; IntelliAIScale internal measurement, September 2026.