Guides/8 min read/Updated

Can health clinics use Google reviews in marketing?

Short answer

Usually yes for collecting them, often no for republishing them, and the difference is what most clinics get wrong. Asking patients for Google reviews is permitted in Australia, New Zealand and the United States. Taking a review that praises your clinical care and putting it on your website or social media is prohibited outright in Australia, constrained in New Zealand, and requires pre-approval in Dubai. The rule to hold onto is that a review sitting on Google is the patient speaking, while a review you republish becomes advertising you control.

Key points

  • Australia prohibits testimonials about clinical care in advertising under section 133 of the National Law. Penalties reach AUD 30,000 per offence for an individual and AUD 60,000 for a corporation.
  • AHPRA has confirmed practices may ask patients to leave ratings on third-party sites such as Google, and does not require you to police or disable unsolicited reviews.
  • The line in Australia is republishing. Embedding a review on your site or screenshotting it for social media turns it into advertising you control.
  • New Zealand's Therapeutic and Health Advertising Code applied to all advertising from 1 July 2026 and expressly covers user-generated content.
  • Under the New Zealand code, responsibility for compliance is shared between the advertiser, the agency and the media organisation.
  • In Dubai the DHA pre-approves every piece of health advertising, and the facility is liable for content published even on a doctor's personal account.
  • In the United States, HIPAA bars a provider from even acknowledging that someone is a patient. Civil penalties run from $145 to $2,190,294 per violation as of 28 January 2026.

What is the difference between collecting reviews and using them in advertising?

This single distinction explains almost every rule below, and getting it wrong is what turns a marketing decision into a regulatory one.

A review sitting on your Google Business Profile is the patient speaking in public. You did not write it, you cannot edit it, and in most jurisdictions you are not held responsible for it.

The moment you lift that review and place it somewhere you control, it stops being the patient speaking and becomes your advertising. Embedding it on your homepage, screenshotting it for Instagram, quoting it in an ad. Same words, different legal status.

Clinics tend to err in one of two directions. Some assume the rules ban reviews entirely and stop asking for them, losing rankings for no reason. Others treat a five-star review as free marketing copy and republish it, which is the version that attracts a penalty.

Can Australian clinics ask patients for Google reviews?

Yes. This is the most widely misunderstood point in Australian health marketing, and the confusion costs clinics real visibility.

Section 133 of the National Law prohibits advertising a regulated health service that uses testimonials, that is false or misleading, that offers gifts or discounts without stating terms, that creates unreasonable expectations of beneficial treatment, or that encourages indiscriminate use. A testimonial here means a recommendation or positive statement about the clinical aspects of care: treatment outcomes, the quality of clinical work, the effectiveness of a procedure.

That sounds like a blanket ban on reviews. It is not. AHPRA has confirmed that practices may ask patients to leave ratings on third-party review sites such as Google. It also accepts that a practitioner is not generally responsible for unsolicited reviews on sites they cannot edit, and does not require you to police those reviews or disable them.

What you cannot do is republish clinical praise in your own advertising. Reviews about non-clinical matters, such as parking, reception or waiting times, sit outside the prohibition.

ActionPermitted in Australia?
Asking a patient to leave a Google ratingYes, AHPRA has confirmed this
Leaving unsolicited reviews up on your profileYes, you are not required to police them
Embedding a review about treatment on your websiteNo, this is a testimonial you control
Screenshotting a clinical review for social mediaNo, same problem
Quoting a review about parking or receptionYes, non-clinical is outside the ban

What changed in New Zealand on 1 July 2026?

The Advertising Standards Authority's Therapeutic and Health Advertising Code applied to all advertising from 1 July 2026, having applied to new advertising since 1 April. It is recent enough that a lot of published guidance still describes the previous position.

Five things in it matter for reviews. The scope now expressly extends to digital and social media, including user-generated content. Claims must be substantiated before they are published, not afterwards. Healthcare professional endorsements are prohibited. Patient testimonials must be authenticated, genuine, current and typical, with any payment disclosed. And the code prohibits exploiting emotional vulnerability or creating inappropriate purchase urgency, which matters a great deal in fields like fertility.

There is one line in the code with consequences beyond the clinic. Responsibility for compliance is shared amongst all parties to an advertisement, including advertisers, agencies and media organisations. If an agency publishes non-compliant content on your behalf, both of you are in scope.

What do the rules require in Dubai and the UAE?

The Gulf operates on approval rather than interpretation, which is a genuinely different model from Australia or New Zealand.

The Dubai Health Authority pre-approves every piece of health advertising material that runs in Dubai. That includes paid assets on Meta, Instagram, TikTok and Snapchat that mention a medical service. A facility's account must display its MOHAP medical advertisement licence number, and the Medical Director must formally authorise promotional posts, including anything published by influencers.

Liability is strict and unusually broad. The facility is responsible for media recorded on its premises whether it appears on corporate channels, a doctor's personal account, or a third party's. Patient testimonials that include identifying details are prohibited, as are superlative claims such as best or leading, before-and-after imagery without case-by-case approval and documented consent, and outcome guarantees.

Can a clinic in the United States reply to a patient review?

Carefully, and with far less latitude than most practices assume. HIPAA bars a provider from even acknowledging that someone is a patient, regardless of what that person disclosed about themselves in the review. Replying with a line as ordinary as thanking someone for visiting confirms they attended, which is a technical violation.

Civil penalties range from $145 to $2,190,294 per violation as of 28 January 2026, following the annual inflation adjustment. Enforcement here is not theoretical. Every published action below arose from a provider replying to an online review. What you can safely write instead is covered in how to reply to a negative review.

PracticePenaltyWhat happened
Manasa Health Center, NJ$30,000 plus a 2-year corrective action planNamed a diagnosis and treatment in a reply. Three further patients' information was also found exposed.
North Carolina dental practice$50,000Civil money penalty
New Vision Dental, CA$23,000 plus a 2-year corrective action planSettlement following review responses
Elite Dental Associates$10,000Disclosed a patient's name, condition, treatment plan, insurance and cost

What can a clinic safely do in every market?

The rules differ, but a narrow band of practice holds up across all four jurisdictions.

  • Ask patients for reviews. Collecting is permitted almost everywhere, and it is the part that actually affects your ranking.
  • Leave unsolicited reviews where they are. You are generally not obliged to remove or police what patients write on platforms you do not control.
  • Reply without confirming anyone is a patient. A generic line inviting the person to contact the practice directly avoids the disclosure problem entirely, and the wording that works is worth getting right before you need it.
  • Keep clinical praise on the platform it was written on. Do not lift it into your website, your ads or your social feed.
  • Use non-clinical feedback if you want quotable material. Comments on communication, facilities or waiting times carry far less risk.
  • Check your own regulator before publishing. The differences between markets are large enough that advice written for one country is often wrong in another.

Which professions do these rules actually cover?

Worth checking rather than assuming, because the boundaries are not intuitive.

In Australia, section 133 applies to the 16 professions regulated by AHPRA, which covers dentists, physiotherapists, chiropractors, medical practitioners and others. Veterinary practice is not regulated by AHPRA and sits under separate state and territory veterinary boards, so a vet clinic should not assume the same rules apply to it.

This article describes how these regimes are generally applied and is not legal advice. Before you change how your practice handles reviews, confirm the current position with your regulator or your indemnity insurer, both of whom will give you a view specific to your profession and location.

Related questions

Can I ask my patients to leave a Google review?

In Australia, yes. AHPRA has confirmed that practices may ask patients to leave ratings on third-party review sites such as Google. The same is generally true in New Zealand and the United States. What differs between markets is what you may then do with those reviews, not whether you may collect them.

Do I have to delete or disable reviews on my Google Business Profile?

No. AHPRA accepts that a practitioner is not generally responsible for unsolicited reviews on third-party sites they cannot edit, and does not require you to police them or turn them off. Disabling reviews would also remove one of the strongest signals in local ranking, so it costs you twice.

Can I put a patient's Google review on my website?

In Australia, not if it refers to clinical care. Republishing moves the content from the patient's platform to yours, which makes it advertising you control, and section 133 then applies. Reviews that address only non-clinical matters such as parking or reception fall outside the prohibition.

Does my marketing agency share responsibility for this?

In New Zealand, yes. The Therapeutic and Health Advertising Code states that responsibility for compliance is shared amongst all parties to an advertisement, including advertisers, agencies and media organisations. In Dubai, the facility carries strict liability for content even when a doctor or an influencer published it.

What are the penalties for getting this wrong?

In Australia, AUD 30,000 per offence for an individual and AUD 60,000 for a corporation. In the United States, HIPAA civil penalties run from $145 to $2,190,294 per violation as of 28 January 2026, and published enforcement actions arising from review replies range from $10,000 to $50,000 plus multi-year corrective action plans.

Can I reply to a negative review from a patient?

You can reply, but in the United States you cannot confirm the person was a patient, which rules out most natural responses. The safe pattern is a short, generic reply that invites the person to contact the practice directly, with no reference to their treatment, their visit, or their record.

Do these rules apply to veterinary clinics?

Not the AHPRA ones. Veterinary practice in Australia is regulated by state and territory veterinary boards rather than AHPRA, so section 133 does not apply. Consumer law on misleading advertising still does, and a vet clinic should check its own board's advertising position rather than assuming either set of rules.

Want this handled for your business?

Book a free consultation and we’ll map your local market and show you where the opportunity is.

Book a free consultation