The problem
Reviews matter for practices as much as for any local business, and replying is easy to put off. Health care adds a trap: a reply that says 'we're glad your crown came out well' or 'sorry about your wait for the MRI' confirms the reviewer is a patient and discloses treatment. In 2022 a California dental practice paid HHS $23,000 to settle over review replies that disclosed patient information. Many offices either never reply or reply in a hurry and get it wrong.
Keep out of the AI
- Patient names matched to any visit, treatment or appointment
- Anything from the practice management system or EHR, including the list of who was seen yesterday
- Charts, notes, images or insurance details
- Any detail from your records added to a reply, even if the reviewer mentioned it first
Every dental and medical idea here is designed so no protected health information (PHI) ever goes into Claude. Anthropic offers HIPAA only on Enterprise plans; Team plans can’t enable it. Under the HIPAA configuration, Cowork runs in local mode on a desktop and Cowork in the cloud (including cloud scheduled tasks) isn’t available. Anthropic’s documentation says connectors and MCP servers aren’t covered by its BAA. Nothing here makes a practice HIPAA compliant; ask your privacy officer before you start.
What Cowork does
- Once a day, Cowork reads new review text. Google Business Profile has no official Claude connector, so this runs through Zapier or a vetted third-party connector, if available; or the office manager pastes new reviews into a sheet.
- It drafts a reply from the practice's approved reply library: thanks for kind words, and for complaints a short invitation to call the office manager, with no mention of any visit, treatment, provider or appointment.
- It flags any review that mentions health details so the office manager reads it before anyone replies.
- Once a quarter it rewrites the review-ask message templates that your existing patient messaging system (for example Weave or NexHealth) sends after visits. Cowork writes the template text only; the messages go out from that system, not from Claude.
Where the draft lands
Reply drafts in a Google Sheet for the office manager, and template text in a Google Doc.
What stays with you
Posting replies in Google Business Profile, calling unhappy reviewers back, and running the review-ask schedule inside your patient messaging system.
5 stars, "Friendly team, great experience": Thank you for taking the time to leave a review. We're glad you had a good experience with our team.
2 stars, mentions a long wait and a procedure: Flagged, mentions health details. Suggested reply: Thank you for the feedback. We'd like to hear more. Please call our office manager, Dee, at the main number. (No visit or treatment mentioned.)
Watch-outs
- HIPAA note: the review text is public, but your reply is the practice speaking. Never confirm the reviewer is a patient or add anything from your records. Have your privacy officer approve the reply library.
- Review gating (asking only happy patients) breaks Google's policies. Ask everyone, through your patient messaging system.
- If your messaging vendor offers its own review tool, use it for sending. This idea only writes the words.
Questions owners ask
Can Cowork send the review requests to patients?
Not in this setup. A list of who was seen is patient information, so the asks stay in your patient messaging system. Cowork only writes the template text.
What about one-star reviews with health details?
Those are flagged, not answered. The office manager decides, and replies stay generic: please call us at the office.