45 CFR 164.508
HIPAA stops the one reply that would settle it
A dental practice cannot say "this person has never been in our chair" in public. Confirming or denying treatment is a disclosure. That single restriction is why a pediatric dentistry that gets a review from a non-patient has to use the platform's policy process rather than the reply box.
U.S. Department of Health and Human Services — HIPAA Privacy Rule: uses and disclosures for marketing (45 CFR 164.508(a)(3))
Genuine experience required
Reviews from people who were never patients are reportable by policy
Google's contributions policy requires content to reflect a genuine experience with the business, and Yelp's guidelines say the same. Non-patient reviews, mistaken-practice reviews and former-employee reviews all fall under that ground.
Google Maps Help — Prohibited and restricted content policy for Maps user contributions
16 CFR Part 465
Buying reviews to bury a bad one is a federal violation, not a shortcut
Since October 21, 2024 the FTC rule on consumer reviews bans fake reviews, insider reviews presented as customer reviews, and paying for positive or negative reviews, with civil penalties available per violation. For a pediatric dentistry that leaves two lawful moves: earn real reviews, and report the ones that break platform policy.
U.S. Federal Trade Commission, 2024 — Rule on the Use of Consumer Reviews and Testimonials (16 CFR Part 465)
Policy grounds only
Google removes reviews that break a policy, not reviews you dislike
Google's own help documentation says any review can be reported but only content that violates its policies is eligible for removal. That is why a case starts by matching the wording to a named policy: fake engagement, off topic, impersonation, harassment, personal information or conflict of interest.
Google Business Profile Help — Report inappropriate reviews on your Business Profile