A patient leaving you a glowing five-star Google review about how you fixed their knee isn’t a breach of anything. You copying that review onto your home page is.
That distinction is most of what health practitioners need to understand about reviews. AHPRA regulates advertising, and the testimonial ban applies to advertising you control. Reviews on platforms you don’t control are mostly someone else’s business, until you start using them.
This is general information about how AHPRA’s guidance applies to reviews at the time of writing (late 2026), not legal advice. AHPRA’s testimonial tool is the official reference and worth reading in full.
What counts as a testimonial
AHPRA defines a testimonial as a recommendation or positive statement about the clinical aspects of a regulated health service: symptoms, diagnosis, treatment or outcome. Patient stories and success stories count. So do fake or made-up reviews, which AHPRA calls purported testimonials.
Reviews about non-clinical things aren’t testimonials. “Easy to book, ran on time, lovely reception staff, plenty of parking” is fine to use in advertising.
Most real reviews mix both. “Dr Chen was so kind and my migraines have improved hugely” is a testimonial because of the second half.
What you can do
Let patients review you on Google. AHPRA says advertisers aren’t responsible for removing reviews on platforms they don’t control, such as review sites, directories and Google. Clinical reviews can sit on your Google Business Profile without you having to do anything.
Reply to reviews, carefully. More on how below.
Show non-clinical reviews in your own advertising, if they’re complete and unedited. A review praising your front desk and parking can go on your website.
Report reviews that break Google’s policies, such as fake reviews, abuse, or reviews from people who were never patients. Google decides whether to remove them.
Ask for reviews, with care. Patients are entitled to review you. Keep any request neutral (“We’d welcome your feedback on Google”), send it to all patients rather than only the happy ones, and don’t offer anything in return, which breaches Google’s own rules. Check your National Board and indemnity insurer’s current view before building review requests into your booking system. Our general guide to getting more Google reviews covers the mechanics for other businesses, and most of it applies with the extra caution above.
What you can’t do
Put clinical reviews on your website. That’s the big one. Review widgets that pull your Google reviews onto the home page don’t filter by content, so they will eventually display a testimonial. Remove them.
Pick only the safe ones and trim the rest. AHPRA warns that selectively editing reviews, or choosing which ones to include or exclude, may be misleading. If you show reviews at all, show complete ones that aren’t testimonials.
Share or repost clinical reviews on social media. Your practice Facebook or Instagram is advertising. Resharing a patient’s post about their recovery is using a testimonial.
Leave review functions open on your own social pages. Business pages where patients can post recommendations count as advertising you control. AHPRA’s suggestion is to switch off review or testimonial functions where you can.
Quote reviews in ads, brochures or emails. Same rule, different channel.
Write, buy or swap fake reviews. Purported testimonials are covered by the rules, and fake reviews also breach Google’s policies and consumer law.
Responding without breaching confidentiality
This is where well-meaning practitioners get into trouble. A bad review stings, and the instinct is to explain what really happened. Don’t.
The RACGP’s guidance on responding to online reviews is written for GPs but applies across health: you must not breach a patient’s privacy no matter what they’ve posted themselves, don’t confirm whether the reviewer is a patient, don’t discuss clinical details, and keep public replies simple and general.
There’s an AHPRA angle on positive reviews too. The testimonial guidance warns advertisers to take care engaging with reviews on third-party sites, because that could be treated as using a testimonial. Replying “So glad your back is better!” to a clinical review is an easy trap.
Some replies that work:
For a positive review that mentions treatment:
Thank you for taking the time to leave a review.
Short is fine. You don’t need to echo anything they said.
For a positive non-clinical review:
Thanks so much. We’ll pass your kind words on to the front desk team.
For a complaint about wait times, billing or the building:
Thanks for the feedback. We’re sorry your experience wasn’t what you expected. We’ve been reviewing how we manage appointment times. If you’d like to talk it through, please call our practice manager on 02 5550 4321.
For a complaint about clinical care:
We take all feedback seriously. We can’t discuss anyone’s care in a public forum, but we’d welcome the chance to talk. Please contact our practice manager on 02 5550 4321.
For a review you suspect isn’t from a patient: use the clinical care reply above. It’s tempting to write “we have no record of you”, but that tells the world who is and isn’t a patient, which is exactly what you’re not supposed to reveal. Report the review to Google instead.
A process for negative reviews
- Don’t reply on the day. Draft it, leave it overnight.
- Check whether the review breaches Google’s policies. If so, report it.
- If it’s clinical, talk to your indemnity insurer before replying. Most have advice lines for exactly this.
- Reply with a short, general response that invites contact.
- If the person makes contact, handle it through your normal complaints process.
- If you believe a review is defamatory, get legal advice rather than arguing in public.
What this means for your website
Reviews have value for search, including in Google’s AI-generated results and other AI search tools, but that value comes from them sitting on your Google Business Profile, not from being copied onto your site. Your website’s job is to send people to a well-maintained profile: accurate hours, categories, photos and regular updates.
If your current site has a review slider, a patient story page or an embedded social feed, that’s the first thing to remove. We handle those clean-ups as part of website work for practices, and look after Google Business Profiles through our local SEO service.
Replying to reviews is one confidentiality risk. Your website contact form is another, covered in privacy and contact forms for health practices.