Respond to an online patient review without violating HIPAA

Help me respond to an online review of our practice. Platform: [Google, Yelp, Healthgrades, Facebook, etc.] The review: [PASTE THE REVIEW] Star rating: [1-5] What we know internally: [BRIEF facts for my eyes only - do not put these in the reply] Who will post it: [e.g. practice manager, office] Contact route for offline follow-up: [e.g. "call our patient experience line at ..."] The public reply must: - Not confirm or deny that the reviewer is or was our patient, even if they identified themselves. No names, dates, visit details, diagnoses, treatments, or billing details. - Not argue with facts, even if the review is inaccurate. - Speak about our general policies in neutral terms (e.g. "Our practice aims to return calls within one business day"). - Invite the person to contact us directly, by role, not by a clinician's name. - Stay under 80 words, warm and professional. Return: 1. Two reply options: one brief, one slightly fuller. 2. A version for a positive review that thanks them without confirming a care relationship. 3. Internal next steps: log as a complaint if it describes a care or service issue, who should investigate, and when to escalate to the privacy officer or risk management. 4. A short note on when to request platform removal (e.g. reviews containing another patient's information or threats). Have our privacy officer approve any reply template before it is used widely.