Hospital review management must treat public replies as permanent institutional statements rather than personal debates. Publishing patient health details or clinical context in a review reply breaches patient trust and creates serious compliance exposure under India's DPDP Act, 2023. Protecting institutional credibility requires a mandatory cooling-off period, designated single reply ownership, and moving clinical disagreements entirely offline.
In healthcare, prospective patients read negative review replies not to judge the reviewer, but to evaluate how the institution treats vulnerable people who raise concerns before committing to its care.
A Bengaluru hospital’s own replies to negative reviews (not the reviews themselves) turned a Google listing into a crisis. Here is what every hospital administrator should take from it before it happens to them.
Most hospital reputation advice is built around one fear: the bad review. Get more good ones, respond fast, bury the negative under volume. That advice is incomplete, and in some cases it is actively dangerous, because it treats the reply as a defensive reflex instead of a permanent public document.
In February 2024, a hospital in Bengaluru found out the hard way.
What Actually Happened
According to reporting by The South First (Chetana Belagere, published February 21, 2024), a patient posted on Reddit’s r/bangalore forum under the title “Rude and unprofessional hospital,” describing a visit to Athreya Hospital’s Chandapura location. The patient said they had paid to see an orthopaedic specialist, were told the specialist had an emergency, were instead seen by a duty doctor who prescribed only a painkiller, and were refused a refund or a free follow-up. The post included a screenshot of a Google review and the hospital’s reply, and asked other users to leave their own negative reviews.
The post was shared more than 1,780 times and drew hundreds of comments. It then moved to X, where users began posting screenshots of other replies the hospital had left on its Google Business profile, a profile that, the article notes, carried a 4.7-star rating at the time.
What made those replies spread was not that they existed. It was what they said.
One reply, reportedly from the hospital’s technician team, responded to a parent’s one-star review about a difficult blood draw on their baby. The parent had written that staff repeatedly failed to find a vein on a crying infant and warned other parents: “Do not visit here if you want your kids safety.” The hospital’s reply called the baby “chubby,” said the baby was “very sick and dehydrated,” and suggested the parent should have taken the child to a specialist and been more patient.
Other replies, per the same report, went further: one publicly referenced a reviewer’s pregnancy and a termination-related dispute; another accused a reviewer’s friend of having had a “sixth abortion in nine months”; another mocked a reviewer’s educational background in response to a complaint about the hospital’s billing motives.
The South First reported that several of these replies were deleted after the story broke, though some remained visible on Google when the outlet checked. When the outlet contacted the hospital, its owner, Dr. Narayanaswamy, said: “I need to review those reviews. You know how everyone behaves,” adding that patients were waiting and he would get back to them. He did not confirm the hospital had written the replies, and could not be reached again for further comment.
That is the full, verifiable record. No embellishment is needed: the facts carry the lesson on their own.
The Point This Case Actually Proves
Every hospital will get a negative review eventually. That is not a crisis. A crisis is manufactured the moment someone on staff, without training or oversight, decides to answer that review in anger.
A negative review is one person’s account, visible once, competing with however many positive reviews surround it. A hospital’s reply to that review is fundamentally different in kind:
- Permanent: Reviews get buried under newer ones. A reply sits directly under the original complaint indefinitely, and is often screenshotted before anyone can delete it.
- Institutional, not personal: A reviewer’s bad day reads as one person's opinion. A hospital’s sarcastic or defensive reply reads as an institutional position: this is how we treat people who complain.
- Read by prospective patients: The audience for a review reply is not the reviewer. It is every prospective patient who finds the page later, mid-decision, specifically looking for a reason to trust or distrust the institution.
In the Bengaluru case, the original complaints (a missed specialist consultation, a refused refund) were ordinary service failures that happen at any hospital. They would likely have stayed as isolated one-star reviews. What converted them into a viral, multi-platform story was the hospital’s own choice of words in response.
The reply was the risk. The review was just the trigger.
Why Disclosing Patient Details in a Reply Is a Separate, More Serious Failure
Tone is one problem. What several of these replies did is a different and far more serious one: they referenced specifics of a patient’s medical situation, including pregnancy-related matters, in a public, searchable response visible to anyone with the link.
Set aside the sarcasm for a moment. A hospital does not need a reviewer’s permission to disagree with their account. It does need the reviewer’s permission, or a lawful basis, to discuss their health information in public.
A Google review reply is not a private rebuttal. It is published content, indexed and shareable, authored by the institution.
India’s Digital Personal Data Protection Act, 2023 sets out, among its core principles, that personal data processing should be grounded in consent that is specific and informed, limited to the purpose for which it was given, and not disclosed beyond what the individual agreed to. The Act does not carve out a separate, stricter category for health information the way the older Sensitive Personal Data Rules did, but that does not loosen the standard; it means health data is still subject to the same core consent and purpose-limitation principles as every other piece of personal data a hospital holds.
A patient who leaves a review has not consented to their diagnosis, procedure, or medical history being referenced in a public reply. Whatever the eventual regulatory interpretation, the trust violation is immediate and the compliance exposure is real enough that no hospital should be testing the boundary in a comment box.
This is the detail hospital administrators most often miss when they think about “online reputation.” The risk is not only reputational. It is a data-handling incident, created voluntarily, by the hospital’s own marketing or front-desk team, with no attacker and no breach required.
A Practical Framework: Before Anyone Hits “Publish” on a Reply
This does not require a large team or new software. It requires a rule that currently does not exist in most hospitals: nobody replies to a public review alone, in the moment, without a check.
-
Decide who is allowed to reply, and take that decision away from the person being criticized.
The individual named or implicated in a review (the technician, the duty doctor, the front-desk staff member) should never be the one drafting or approving the reply. They are not in a position to be dispassionate, and they are usually the angriest person in the building at that moment. Replies should come from one designated role, typically the marketing head, administrator, or a nominated patient-experience owner, never from whoever logs into the Google Business account first.
-
Set a mandatory cooling-off period.
No reply goes out within the same hour the review is read. Even a 24-hour delay changes the tone of what gets written. Anger written at 11 p.m. and read again at 9 a.m. rarely survives unedited.
-
Apply a two-line tone test before anything is posted.
Every drafted reply should answer two questions in writing:
- Would we be comfortable if this reply were read aloud to the patient’s family, in person?
- Would we be comfortable if a journalist quoted this reply in a news story?
If either answer is no, it does not go out as written.
-
Build a one-page escalation path.
- Front-line staff flags the review to the designated reply-owner, never replies directly.
- Reply-owner drafts a response using a short, factual, non-defensive template: acknowledge, do not litigate the clinical details publicly, and offer an offline channel to resolve it.
- A second person, ideally someone with authority over both marketing and clinical operations such as the medical superintendent or administrator, reviews and approves before posting.
- Anything involving a clinical dispute, a threatened legal action, or any patient-identifiable detail is escalated further and handled offline, by phone or in writing, never adjudicated in the reply box.
-
Maintain a short, explicit “never do this” list, visible to everyone with account access:
- Never name a patient, a family member, or any detail that could identify them (diagnosis, procedure, outcome, or visit date combined with other identifying detail).
- Never use sarcasm, mockery, or a dismissive tone, regardless of how unreasonable the review seems.
- Never argue the clinical facts of a case in public; that conversation belongs offline, with the patient directly.
- Never let the person being criticized write or approve the reply.
- Never post without the second-person sign-off, regardless of how minor the review seems.
-
Audit existing replies, not just future ones.
Most hospitals have years of unmonitored replies sitting on Google, Practo, and other listings, often written by whoever had account access at the time. A one-time audit to read every existing reply and flag anything sarcastic, defensive, or identifying is worth doing once, deliberately, rather than discovering the worst one when a patient screenshots it.
The Calm Version of This
A negative review is a service-recovery opportunity. It is not a personal attack on the person who receives it, even when it reads like one.
The hospitals that come out of a bad review looking credible are the ones whose reply is short, calm, and takes the specifics offline. The hospitals that end up as a cautionary story are the ones that let whoever was angriest in the moment have the last public word.
The reply is not a smaller risk than the review. For a hospital’s credibility, it is usually the larger one, because it is the one piece of content the hospital itself controls completely, and therefore the one piece of content it has no excuse for getting wrong.
Sources
- This Bengaluru hospital’s Google review responses are going viral — and not for the right reasons — The South First, Chetana Belagere, February 21, 2024
- The Digital Personal Data Protection Act, 2023 – Key Highlights — Mondaq