Search your own practice name some quiet evening, the way a prospective client would. Right next to your listing sits a shop two towns over with four times the Google reviews, and you know your work holds up fine against theirs. The gap isn't about quality. It's about asking, and asking is exactly where things get complicated for you.
For most businesses the review advice is blunt. Ask everyone, ask often, put a link on every receipt. If you run a law office, a dental or medical practice, or a financial advisory shop, that same advice can walk you into a problem. Bar rules limit how you use testimonials, HIPAA limits what you can even confirm about a patient, and the marketing rules for advisors treat a review you solicited as an endorsement with strings attached.
So a lot of good practices just do nothing, and the listing stays thin for years. There's a middle path. It keeps a steady trickle of legitimate reviews coming in without handing you a compliance headache, and it comes down to four things: who you ask, when you ask, how you word it, and where a sensitive reply ends up.
Start with the fence you're actually standing near
The three worlds overlap, but they're not the same, and the rule that bites you depends on your license. Here's the short map.
- Law offices. Most state bar rules allow a truthful client review, but they restrict testimonials that mislead or imply a guaranteed result. You usually can't chop a client's words into an ad without care. Check your state's advertising rules before you reuse anything.
- Dental and medical practices. The review itself is usually fine. The trap is your reply. Confirming that someone is a patient, or referencing their treatment, can be a HIPAA disclosure even if they posted publicly first.
- Financial advisors. The SEC's marketing rule now permits testimonials, but with disclosures and oversight. A review you solicit and then use can count as an endorsement, which brings recordkeeping and disclosure duties along with it.
None of that means reviews are off limits. It means the ask has to stay neutral, the reply has to stay careful, and somebody has to keep a record of what went out. Before you switch any of this on, walk the final version past whoever owns compliance in your shop, whether that's your managing partner, your privacy officer, or outside counsel.
Ask for feedback, not a five-star rating
The riskiest habit is steering the outcome. A message that says we'd love a five-star review reads like you're buying the result, which is the precise thing the rules against solicited endorsements are built to catch. It backfires anyway, because coached-sounding reviews are the ones readers quietly discount.
Word the ask so it invites an honest account of what happened. You're holding a door open, not pointing at a number.
Skip wording like this:
- "Leave us a five-star review."
- "We're going for 5 stars, help us get there."
- Anything that offers a discount, a gift, or a drawing entry in exchange. Paying for reviews breaks Google's rules, and for advisors it drags in cash-compensation disclosure on top.
Try wording like this:
- "If you have a minute, we'd appreciate an honest review of your experience. Here's the link."
- "Your feedback helps other people in town decide. Good or bad, we'd like to hear it."
- "Would you be willing to share how the process went for you?"
None of those promise anything or aim at a score. An honest ask that now and then earns a three-star review is both safer and more believable than a wall of suspiciously perfect fives.
Decide who gets asked, and when
Blanket asking is where practices get into trouble. Some clients shouldn't be asked at all, and the timing of the request matters as much as the wording.
- Ask people who finished something. A closed matter, a filed return, a cleaning with no complications. Someone mid-dispute or mid-treatment is a poor target, and in sensitive matters the ask itself can feel like pressure.
- Skip the categories your rules flag. Litigation clients whose case is still open, patients in active mental health or substance treatment, anyone whose relationship with you is itself confidential. When in doubt, leave them off.
- Send it a day or two after the good moment, not during it. A short gap gives an honest response room to form and keeps the request from feeling transactional.
- Ask once, maybe twice, then stop. One reminder is a nudge. A third is nagging, and it reads that way to the client.
- Let staff pull names off the list. Your front desk knows which relationships are delicate. Give them a simple way to flag a do-not-ask client before the message ever goes out.
Route the sensitive reply to a private channel
The dangerous move for a medical or dental practice isn't collecting the review. It's replying in public. If a patient posts about their root canal and you respond thanks, glad the crown fits, you've just confirmed they're a patient and named their treatment somewhere the whole internet can read it. That's a disclosure, even though they went public first.
Build the flow so anything sensitive has a private path before it can reach the public thread.
- Offer a fork in the request. "Happy with how it went? A public review helps others. Something we should fix? Reply straight to us and we'll handle it privately." One link goes to Google, one goes to a private inbox.
- Route the private replies to a monitored address or a simple ticket, never a public channel. That's where unhappy clients and any protected details land.
- Keep public replies generic and identity-free. "Thank you for the kind words, we appreciate it" says nothing about who the person is or what you did. Use the same neutral line every time.
- Never confirm a relationship in a public reply, not to accept a compliment and not to correct a false review. If a review is defamatory or fake, that's a matter for counsel and Google's removal process, not a public back-and-forth.
What the automation handles, and what it doesn't
The mechanical parts of this are a good fit for automation. The judgment parts are not, and it's worth being honest about the line.
A simple system can watch for a triggering event, wait the right number of days, send one neutrally worded message that points to your Google Business Profile, send a single reminder, and split responses into a public link and a private inbox. That's your steady trickle, running without anyone having to remember it.
What it can't do is decide whether a given client is safe to ask. It doesn't know the case is still open or that the relationship is confidential. So the automation should always defer to a human flag, and the default for anything uncertain should be don't send. A missed review costs you nothing. A wrong one can cost quite a bit more.
This is roughly the setup we build for Massachusetts practices at AI Agency Mass: a quiet flow that asks the right people the right way and keeps the sensitive stuff off the public page.
Worth doing this week
- Search your practice on Google and count your reviews next to two local competitors. That number is your starting line.
- Write one neutral ask, in your own voice, that invites honest feedback and links to your review page. Read it out loud. If it hints at a rating, rewrite it.
- Make a short do-not-ask list with your front desk: the client types you'll never send this to. Put it in writing so it survives a busy week.
- Set up a private reply path, even just a dedicated inbox, so sensitive responses have somewhere to go that isn't the public thread.
- Run the whole thing past your compliance person before the first message goes out. Ten minutes now saves a grievance later.