Reviews are the part of a Google Business Profile that treatment centers think about most and handle least carefully. Admissions teams want more of them, marketing wants stars on the website, and whoever has the login writes replies between other tasks. Each of those three habits runs into a rule: one from Google Search, one from Google Maps, and one from federal privacy law. This post walks through all three, in the order we usually find them during a behavioral health profile audit.
The star widget on your homepage earns no stars in search
Since September 16, 2019, Google has not shown star ratings in search results for LocalBusiness or Organization pages that display reviews the business itself controls, and that includes reviews pulled onto the site through an embedded Google Business Profile or Facebook widget. A treatment center that adds AggregateRating markup about itself to its own homepage will not get review stars for that page. Google also says the site will not receive a manual action just for having the markup, so nothing visibly breaks. The markup simply does nothing for the listing.
That rule is written into Google’s review snippet structured data documentation, which states that when the entity being reviewed controls the reviews about itself, its pages using LocalBusiness or any other Organization type are ineligible for the star review feature. The reasoning is laid out in the original Google Search Central announcement, which calls these reviews “self-serving” and specifically names embedded third-party widgets as a form of control.
We still see review plugins sold to behavioral health providers on the promise of “stars in Google.” That is seven years out of date. A review carousel can still be useful to a prospective family, but judge it as on-page content, not as a search feature. If you want the underlying logic of which markup Google actually uses, our guide to schema markup for small business websites covers the types worth maintaining.
Run this check today: open Google’s Rich Results Test, paste your homepage URL, and look for “Review snippets” in the detected items. If AggregateRating appears on a LocalBusiness, MedicalBusiness or Organization entity describing your own facility, you now know it will not produce stars. You can leave it (Google says removal is not required) or remove it to cut plugin weight, but stop paying for it as a ranking or visibility feature.
Incentives are prohibited, and in treatment they are a worse idea still
Google’s Business Profile Help page on getting more reviews is direct: reviews must reflect a genuine experience, and offering incentives such as free or discounted goods or services in exchange for posting, changing, or removing a review is treated as fake and misleading content and is strictly prohibited. The same page points to Business Profile restrictions for policy violations, which is the mechanism Google uses to limit a profile when it finds this pattern.
For a treatment provider, the incentive problem reaches past Google. Gift cards to alumni, a discount on a family program, or a “thank-you” tied to a five-star review all create a financial inducement attached to a patient relationship. Regardless of Google’s enforcement, that is the kind of arrangement a compliance officer should see before it launches, not after.
What Google does endorse is simple: ask. The same help page recommends reminding customers to leave reviews through a Google review link or QR code generated from the profile, and replying to reviews. In behavioral health, how you ask matters as much as whether you ask:
- Channel exposure: a text message that names your facility and asks for a review of “your stay” reveals the relationship to anyone who glances at that phone.
- Timing: a request sent during early recovery, or to someone who left against medical advice, can land badly and invite exactly the review you did not want.
- Reviewer identity: Google requires reviewers to be signed in to a Google Account, and most people post under their real name. Many alumni will not want their name permanently attached to a rehab listing, and that is their call to make without pressure.
A neutral request, sent through a channel the person chose, with no reference to diagnosis or level of care, respects all three.
The reply is where the HIPAA exposure actually lives
The single most common privacy problem we find in behavioral health review sections is not in the reviews. It is in the replies. Under HIPAA, the fact that a person is or was a patient of a covered provider is itself protected health information. A reviewer can say anything about their own care, because the privacy rule restricts what the provider discloses, not what the patient chooses to share. When the facility replies in a way that confirms the reviewer was a patient, the facility has made the disclosure.
This is not theoretical. The HHS Office for Civil Rights has resolved multiple enforcement cases against healthcare practices over replies to online reviews that disclosed patient information. For substance use disorder programs that fall under 42 CFR Part 2, federal confidentiality rules for patient-identifying information are stricter again. Nothing in this post is legal advice; your compliance counsel should set the policy. But the operational pattern is consistent enough to describe.
Well-meaning replies leak patient status in a handful of repeatable ways:
- Confirming attendance: “We’re so glad your time in our program helped” confirms the reviewer was a patient.
- Naming staff or care details: “We’ll pass this along to your therapist” or “sorry the detox wing was loud” confirms both the relationship and the level of care.
- Correcting the record: “Our records show you left after three days” is the most dangerous reply of all, because a negative review provokes it and it discloses treatment details to rebut the reviewer.
- Replying to family members: answering a parent’s review with details about their adult child’s care discloses information about someone who never posted.
A safe reply acknowledges feedback without acknowledging a relationship. Something like: “Thank you for taking the time to share this. We take all feedback seriously and would welcome the chance to talk directly. Please call our main line and ask for our program director.” That reply works identically whether the reviewer was a patient, a relative, a competitor, or someone who never walked through the door, which is exactly why it is safe. Google’s own reply guidance points the same way: never share a reviewer’s private information, and move complex situations to phone or email.
Audit your existing replies today: open your profile’s reviews, sort by newest, and read your last 50 replies looking for these words: stay, program, treatment, detox, therapist, counselor, discharge, records, “your time with us.” Any reply containing one of them is worth a second look with your compliance lead, and replies can be edited from the same screen.
Why reviews still matter for local visibility
None of this is an argument for ignoring reviews. They show next to your Business Profile in Maps and Search, and prospective families read them closely, often before they read anything on your website. Reviews interact with the fields that decide where the profile appears at all. If your primary category or service areas are wrong, no volume of reviews will put you in front of the right searches, which is why we pair review work with the setup covered in our post on Google Business Profile categories, services and service areas.
Reviews also feed how AI search summarizes a local provider. When a generated answer describes a treatment center, it draws on what is publicly written about the facility, and review text is a large part of that. You cannot write reviews, and you should not try to shape them with incentives. What you control is whether your replies add calm, accurate context or add a privacy problem that sits under your name indefinitely.
A review policy that fits on one page
The treatment centers that handle reviews well usually have a short written policy, and the people who hold the Business Profile login have read it. Ours tends to cover five points:
- Who replies: one or two named people, trained on the reply rules, not whoever has the password.
- What a reply may say: thanks, a general commitment to quality, and an invitation to call a named role. Nothing that confirms a relationship.
- How requests go out: a Google review link from the profile, through a channel the person agreed to, with no mention of diagnosis, level of care, or dates.
- What is never offered: discounts, gift cards, or anything of value tied to a review.
- What gets flagged, not argued: reviews that appear to violate Google’s content policies are reported through the profile, not rebutted in public.
For help putting that policy together with the rest of your local search work, our SEO services include Business Profile audits built around the compliance constraints behavioral health providers actually operate under.
