Blog comments on a practice website: privacy, moderation and spam rules

A practice blog with comments turned on looks friendly: readers ask questions, patients say thank you, and the page seems busy. Then a patient posts the details of their surgery under an article, a reader asks whether the swelling they have is normal, someone leaves a one star rant, and a bot drops forty links to a pill shop. Each of those raises a different rule, and the person who clicks approve at the front desk has to know them all.

This guide covers whether to allow comments at all, what to do when a patient writes about their own care, why staff replies are the riskier part, what Section 230 does and does not do for a practice, when deleting critical comments runs into the FTC review rule, and how to keep comment links from turning into spam. It ends with moderation policy text you can adapt. Replies on review sites and social media follow the same privacy logic, and our guides on HIPAA and negative review replies, patient review replies and a practice social media policy cover those channels. Comments under your videos raise the same questions, and our guide to running a YouTube channel for a medical practice covers YouTube’s moderation settings and reply wording.

The short version

• Comments are optional. A practice blog works without them. If nobody has time to moderate daily, turn them off.
• The patient’s post is theirs; your reply is yours. A reply that confirms someone is a patient or adds details of their care is a disclosure of protected health information that HIPAA does not permit without their authorization.
• Hold comments for approval. Do not publish posts that describe a person’s own treatment, and move medical questions to a phone call.
• Delete by rule, not by rating. If your comments work as a review section, hiding negative ones while presenting the rest as the full picture can break 16 CFR 465.7.
• Mark comment links. Google recommends rel=”ugc” for links in comments and lists comment spam as a spam policy issue.

Should a practice blog allow comments at all?

No law requires comments, and a practice website gives up very little by switching them off. The questions to answer first are practical:

• Who moderates, and how fast? Comments need a named person who checks the queue on working days and knows the rules in this guide. Without that, the queue fills with spam and the occasional patient story sits unread.
• What would comments add? On a practice site, the useful questions are the ones a patient would ask the front desk anyway. A phone number and a contact form answer those faster and in private.
• What would they risk? Patient details in public, medical questions that invite individual advice, critical posts you may be tempted to hide, and spam links on your domain.

For a solo or small office, our default advice is to leave comments off and invite questions by phone or through the contact form. If you do want comments, hold each comment for manual approval, close comments on older posts after a set period, and publish the policy further down this page.

When a patient posts about their own care

Under 45 CFR 160.103, health information is information created or received by a health care provider that relates to a person’s physical or mental health or condition, or to the provision of health care. It is individually identifiable when it identifies the person or there is a reasonable basis to believe it could. A comment that names the commenter and describes their visit, sent to a practice through its own website, fits that description once the practice holds it.

The commenter chose to share their own story, and HIPAA does not regulate what patients say about themselves. The practice’s choices are different. Approving the comment puts it on a page the practice publishes, and a reply from the practice can add to it. Since we found no HHS guidance on this exact situation, the cautious course is simple: when a comment describes the writer’s own diagnosis, treatment or visit, do not publish it. Thank the person privately using the email address they gave, without repeating any detail, and invite them to call the office if they have a question.

Comments that mention another person’s health, such as a parent’s illness or a neighbor’s treatment, belong in the same pile. Do not publish them.

Staff replies are the bigger risk

Under 45 CFR 164.502(a), a covered entity may not use or disclose protected health information except as the Privacy Rule permits or requires. Disclosure to the individual is on the permitted list. A public reply on a blog is not, because anyone who reads the page sees it.

So a reply such as “Glad your crown is holding up, see you at your six month visit” confirms that the commenter is a patient and adds a detail of their care. The OCR settlements described in our review replies guide involved replies on review sites, but the rule in 164.502(a) does not depend on the platform. A reply on your own blog is still the practice speaking.

Safe public replies stay general and never confirm a relationship:

• To a thank you: “Thank you for reading. If you have a question about your own care, please call our office at the number at the top of this page.”
• To a medical question: “We cannot give personal medical advice in comments. Please call the office, or your own clinician, so someone can look at your situation.”
• To a complaint: “We take feedback seriously and would like to talk with you directly. Please call and ask for the office manager.”

If a comment describes symptoms that sound urgent, do not leave it sitting in a queue. Your moderation policy should say that comments are not monitored around the clock and that anyone with an emergency should call 911, or 988 for a mental health crisis.

What Section 230 does and does not do

Under 47 U.S.C. 230(c)(1), no provider or user of an interactive computer service shall be treated as the publisher or speaker of information provided by another information content provider. Under 230(c)(2)(A), a provider or user is not liable for action taken voluntarily in good faith to restrict access to material it considers obscene, harassing or otherwise objectionable.

In plain terms, the law gives website operators broad protection for what other people post, and for good faith removal of objectionable posts. It has limits that matter for a practice:

• Your own words are yours. Section 230(f)(3) defines an information content provider as anyone responsible, in whole or in part, for the creation or development of the information. The practice is that person for its own replies, edits and posts.
• Editing changes things. If staff rewrite a comment, add to it or pick out parts to change its meaning, the practice may become responsible for the result. Approve or decline; do not edit.
• It is not a privacy rule. Section 230 speaks to being treated as the publisher of someone else’s post. Do not rely on it to decide what your staff may say about a patient.
• Stated exceptions. Section 230(e) says the section has no effect on federal criminal law, does not limit or expand intellectual property law, and does not limit the Electronic Communications Privacy Act or similar state laws.

Deleting critical comments and the FTC review rule

The FTC’s rule on consumer reviews and testimonials defines a consumer review in 16 CFR 465.1(d) as a consumer’s evaluation of a product, service or business, submitted by the consumer and published to a website or platform dedicated in whole or in part to receiving and displaying such evaluations. A comment thread under an article is not built for that purpose. A page where you invite patients to share their experience with the practice may be.

Under 16 CFR 465.7(b), a business may not materially misrepresent that the consumer reviews displayed in a review portion of its website represent a majority or all of the reviews submitted, when reviews are being suppressed based on their ratings or negative sentiment.

The rule lists reasons for withholding reviews that do not count as suppression when applied equally to all reviews, whatever their sentiment:

• trade secrets or privileged or confidential commercial or financial information
• defamatory, harassing, abusive, obscene, vulgar or sexually explicit content
• the personal information or likeness of another individual
• content that is discriminatory with respect to race, gender, sexuality, ethnicity or another intrinsic characteristic
• content that is clearly false or misleading
• a review the seller reasonably believes is fake
• a review wholly unrelated to the products or services offered

Section 465.7(a) also bars using an unfounded or groundless legal threat, a physical threat, intimidation or a knowingly false public accusation to stop a review from being written or to get one removed. A message telling a commenter to take down a critical post or hear from a lawyer is the kind of thing to clear with your attorney first.

The practical answer is to write your moderation rules before you need them, apply them to praise and criticism alike, and keep a short note of why each declined comment was declined. A rule against publishing posts about a person’s own care applies to glowing posts as much as angry ones, and that consistency is what the rule looks for.

Comment spam and rel=”ugc”

Google’s spam policies describe user-generated spam as spammy content added to a site by users through a channel intended for user content, and name comment spam on blogs as an example. The same page defines link spam as creating links to or from a site primarily to manipulate search rankings. A practice blog full of unmoderated links to pharmacies and supplement shops is a search problem and a trust problem for patients.

Google’s page on qualifying outbound links recommends marking user-generated content links, such as comments and forum posts, with rel=”ugc”, and says rel=”nofollow” also works when other values do not apply. Values can be combined, as in rel=”ugc nofollow”. Check that your blog software adds one of these to links in comments and in the commenter name field.

Google’s guide to preventing user-generated spam adds practical steps: publish a clear abuse policy, use manual approval for suspicious posts, block repeat offenders, use a human verification challenge, and consider a noindex rule on posts from new users with no track record. For a practice, holding each comment for manual approval covers the bulk of this in one setting, and it also catches the privacy problems above.

Moderation policy text you can adapt

Post this near the comment form and link it from your privacy policy. Replace the bracketed parts and have your attorney review it.

Comment policy for [Practice name]

• Comments are reviewed by our staff before they appear, during office hours only. Comments are not monitored for emergencies. If you have a medical emergency, call 911. For a mental health crisis, call or text 988.
• Please do not share details of your own health, treatment or visits, or anyone else’s. We will not publish comments that include them, whether the comment is positive or negative.
• We cannot give personal medical advice in comments. For questions about your care, call our office at [main number].
• We do not publish comments that are abusive, harassing, obscene or discriminatory, that include another person’s personal information, that are clearly false or unrelated to the article, that we reasonably believe are fake, or that are advertising or spam. We apply these rules the same way to positive and negative comments.
• We do not edit comments. We approve them as written or decline them.
• Links in comments are marked so search engines do not treat them as endorsements. Comments that exist mainly to post links will not be published.
• Your name and comment will be public. Our privacy policy [link] explains what we collect when you comment, such as your email address.

Link the words privacy policy to your own policy page. If you collect email addresses or IP addresses with comments, say so there; our practice website privacy policy guide covers what to include.

Questions to ask before you turn comments on

• Who checks the comment queue, on which days, and who covers when they are out?
• Is manual approval switched on for all comments, including from returning commenters?
• Does the comment form say that comments are public and not for emergencies?
• Where are comments, names, email addresses and IP addresses stored, and who can see them? Does the hosting agreement cover that data?
• Do comment notification emails go to a shared practice inbox rather than a personal account?
• Do links in comments and in the name field carry rel=”ugc” or rel=”nofollow”?
• Do we keep a short record of why each declined comment was declined?

Use and avoid

• Use: “Thank you for reading. For questions about your care, please call the office.” Avoid: “Great to see you at your last visit!”
• Use: “We cannot give personal medical advice in comments.” Avoid: “That swelling is normal after the procedure.”
• Use: declining a comment under a written rule. Avoid: deleting a comment because it is negative while keeping praise of the same kind.
• Use: approve as written or decline. Avoid: editing a commenter’s words.
• Use: rel=”ugc” on comment links. Avoid: followed links in comments and commenter names.
• Use: a polite request to talk directly. Avoid: threatening a commenter with legal action without advice from your attorney.

An illustration

This example is invented. [Practice name], a physical therapy clinic in [Town], posts a guide to recovering from knee surgery and leaves comments open. Within a week the queue holds three posts. A patient thanks [therapist first name] by name and describes their surgery and progress. A reader asks whether the pain they feel at night is a warning sign. A third commenter says the front desk was rude and the wait was long.

The office manager follows the clinic’s written policy. The patient’s comment describes their own care, so it is not published; the manager sends a short private email thanking them for reading and inviting them to call with any question, without mentioning the surgery. The night pain question is not published either, and the reply by email says the clinic cannot give personal advice in comments and suggests calling their own clinician, or 911 if the pain is sudden and severe. The complaint contains no health details, no abuse and nothing false the manager can identify, so it is approved, with a public reply asking the writer to call the office manager. The manager notes the reason for each decision in the moderation log.

Checklist

• A decision on record: comments on with a named moderator, or comments off.
• Manual approval for all comments, and comments closed on older posts.
• A published comment policy with the emergency line, the no health details rule and the moderation rules.
• Staff replies stay general, never confirm that someone is a patient and never mention care.
• Medical questions are moved to a phone call, not answered in public.
• Comments are approved as written or declined, never edited.
• Declines follow written rules applied to positive and negative comments alike, with a short reason logged.
• Comment links and commenter name links carry rel=”ugc” or rel=”nofollow”.
• The privacy policy explains what the comment form collects.

How we help

We build practice websites, local SEO, Google Ads and lead generation and an AI front desk for independent practices. On the practice blogs we build, comments are off unless the practice names a moderator, and when they are on, each comment waits for approval and comment links are marked rel=”ugc”. Our tools are built with HIPAA in mind. We confirm in writing what a BAA covers before any patient information flows through a tool, and if it is not covered, we do not route patient information through it. We are not a healthcare provider and we do not give legal or medical advice. For the wider rules, see our healthcare marketing rules guide.

Sources

• 45 CFR 160.103: Definitions (health information, individually identifiable health information)
• 45 CFR 164.502: Uses and disclosures of protected health information, general rules
• 47 U.S.C. 230: Protection for private blocking and screening of offensive material
• 16 CFR 465.1: Definitions (consumer review)
• 16 CFR 465.7: Review suppression
• Google Search Central: Spam policies for Google web search (last updated August 28, 2026)
• Google Search Central: Qualify your outbound links to Google (last updated December 10, 2025)
• Google Search Central: Prevent user-generated spam on your site and platform (last updated October 26, 2026)

More in Practice websites, privacy and tracking