AHPRA and patient reviews: what practices can and can't do
General information for practice owners, not legal advice. Checked against AHPRA's published guidance on 18 September 2026; these rules change, so check the current version and get your own advice.
If you run a physio clinic, a dental practice, a psychology practice or any other registered health service in Australia, you have probably had this argument with yourself: there is a lovely five-star review on your Google profile, and you do not know whether you are allowed to say thank you.
The rule everyone half-remembers is that health practitioners cannot use testimonials in advertising. That is true, and it is narrower and stranger than most people think.
The law, briefly
Section 133 of the Health Practitioner Regulation National Law prohibits advertising a regulated health service in a way that uses a testimonial or purported testimonial.
Note what is prohibited: using a testimonial in advertising. Not receiving one. Not existing near one. The prohibition attaches to your advertising, not to your patients' opinions.
AHPRA is explicit that the rule does not stop patients sharing information, expressing views online, or posting reviews on review platforms. Your patients can say whatever they like. The question is only ever what you do with it.
What actually counts as a testimonial
This is the part that surprises people.
AHPRA describes a testimonial as a recommendation or positive statement about the clinical aspects of a regulated health service. Clinical aspects are in play when someone talks about symptoms, diagnosis or treatment, outcomes, or a practitioner's clinical skill.
And then the line that changes how you read your own reviews:
Comments about customer service or communication style that do not include a reference to clinical aspects are not considered testimonials for the purposes of the National Law.
So these are different things:
| Review says | Clinical? |
|---|---|
| "Reception were lovely and I was seen on time." | No — service and communication |
| "Parking was easy and the rooms are spotless." | No |
| "Dr Lee explained everything clearly and never rushed me." | Borderline — communication style, but about a practitioner |
| "My back pain was gone after three sessions." | Yes — outcome |
| "Best physio in Sydney, fixed my shoulder." | Yes — outcome and clinical skill |
A review saying your front desk is friendly is not a testimonial. A review saying you cured someone is.
Can you reply to a Google review?
Here is the honest answer: it depends, and AHPRA's own wording is a caution rather than a permission.
The guidance says advertisers should take care if they choose to engage with reviews on third-party websites, because doing so may be considered using a testimonial to advertise a regulated health service.
That is not "you must not reply". It is not "replying is fine" either. It is a warning that engaging with a clinical testimonial can pull it into your advertising, and that the judgement is yours to make and defend.
What follows from that, practically:
- Replying to a review about parking, wait times or reception is a long way from the risk. That is not a testimonial to begin with.
- Replying with thanks to a review that describes a clinical outcome — "so glad we could fix that shoulder!" — is where you are actively adopting and amplifying a clinical testimonial. This is the one to be careful with.
- Never confirm someone is a patient. Separate from the testimonial rule entirely, a public reply that acknowledges a person as a patient discloses their health information. "Thanks for coming in on Tuesday, Jenny" is a privacy problem regardless of what AHPRA says about advertising.
A reply that thanks someone for their feedback and moves anything specific to a private channel handles both problems at once.
Reviews you don't control versus reviews you do
This distinction matters and it is easy to miss.
Platforms you don't control — Google, Facebook reviews on someone else's post, review sites generally. AHPRA's guidance is explicit:
Advertisers do not have to remove or try to remove a review on a website or in social media over which they do not have control.
You are not responsible for policing the internet. A patient praising their treatment on Google is not you advertising.
Surfaces you do control — your own website, and your own social media page where it promotes your service. Here you are responsible. If your practice's Facebook Page is used to promote a regulated health service, it counts as advertising, and it must not carry testimonials. AHPRA notes this may be achieved by disabling the reviews or recommendations function on the page.
So the practical checklist for a surface you control:
- Turn off recommendations and reviews on your practice Facebook Page, or be prepared to moderate every one that mentions a clinical outcome.
- Do not copy a Google review onto your website, into a post, or onto a wall in reception.
- Do not put a "what our patients say" section on your site.
- Be careful with a screenshot of a review in a story or a post. That is you publishing it.
Can you ask patients for reviews?
Asking is not the prohibited act — using a testimonial in your advertising is. But asking for reviews about clinical outcomes generates exactly the content you then cannot use, and it puts you in a position of soliciting it.
The safer framing is to ask for feedback about the things that are not clinical: booking, wait times, the reception experience, the facilities.
Separately, and regardless of AHPRA: under the Australian Consumer Law, any incentive you offer for a review must be offered whether the review is positive or negative, and it must be disclosed. Review-gating — asking how it went and only sending the link to the happy ones — is the practice the ACCC specifically objects to. The Federal Court ordered HealthEngine to pay $2.9 million in penalties over conduct that included publishing misleading patient reviews, which is the clearest possible signal that health and reviews is a watched intersection.
A workable position
Most practices land somewhere like this, and it is defensible:
- Leave Google reviews where they are. You are not required to chase them.
- Reply where a reply is plainly about service, not treatment.
- Where a review is clinical, either do not reply, or reply with a neutral thank-you that neither confirms the person as a patient nor repeats the clinical claim.
- Turn reviews off on the surfaces you control.
- Keep testimonials off your website entirely.
- Write down which position you took and why, so if you are ever asked, you have an answer.
None of this is exotic. It just takes someone deciding it deliberately rather than by default, which is rarer than it should be.
Where software fits
Most tools that reply to reviews for a business have no concept of any of this. They will happily auto-thank a patient for their recovery.
If you use anything automated, the things to insist on are: that nothing is published without a person approving it, that you can leave it that way indefinitely, and that you can switch review replies off entirely while keeping everything else. That is how we have built it, because a compliance decision should not be made by a piece of software's default setting.
Source: AHPRA, Testimonials: understand the requirements, and section 133 of the Health Practitioner Regulation National Law. Checked 18 September 2026.