Google Business Profile for dental practices: what changes

How can a dental practice use patient photos in profile marketing?

If a covered entity uses or discloses an identifiable patient image for marketing, it needs HIPAA authorization, except for a face-to-face communication by the covered entity to an individual or a promotional gift of nominal value.³

For a covered entity, the marketing rule requires authorization for a use or disclosure of protected health information. The source lists exceptions for a face-to-face communication by the covered entity and a promotional gift of nominal value.³ The authorization must identify the information, the people allowed to disclose and receive it, the purpose, an expiration date or event, and the individual's signature and date. It must also include the regulation's statements about revocation, conditioning, redisclosure, plain language, and a copy for the individual.³

A practice can instead feature the operatory, equipment, team, and entrance without making a patient the subject. Have the practice's privacy lead or counsel review a proposed patient image and its authorization.

Which Google Business Profile categories can a dental practice use in US English?

Google's United States / English categories.list snapshot, read 2026-09-30, contains 4,049 category records and these exact dental labels:¹⁴

• Dentist
• Dental clinic
• Cosmetic dentist
• Orthodontist
• Pediatric dentist
• Dental implants provider
• Emergency dental service

Select the primary category that best describes the practice and add only relevant additional categories. These labels are not a ranking order or a list of every treatment the practice offers. Procedures belong in Google's Services editor when the practice offers them, and Google says not to select a category for every product or service.²⁵

How should a dental practice choose its primary and additional categories?

Choose the most specific available category that describes what the dental practice is, use only a few additional categories for relevant departments or services, and do not create a category for every procedure.²

Google's general category guidance says custom categories are not allowed. If the specific category is unavailable, choose a more general category from the list.² A separately owned, independently operated public-facing department should have its own Business Profile rather than being added as a category to the practice's profile.²

Use the current picker in this order:

1. Open the verified Business Profile and select Edit profile.²
2. Next to Business category, select Edit.²
3. Enter a category in Primary category, then select the option shown in the list.²
4. If a truthful additional category is needed, select Add another category, enter it, and select the option shown.²
5. Select Save.²

The primary category should describe the practice's main activity. An additional category should describe a relevant department or service. A procedure belongs in Services when it is an offering, but it does not automatically become a category.²⁵

Where should a dental practice list its procedures?

Build the service list from the procedures the dental practice actually offers, using Google's suggested services where available and a custom service only when the needed procedure is not listed.⁵

Open the Business Profile and select Edit services. Select suggested services that match the practice, or select Add more services and then Add custom service when necessary. Group different types of services, and add a description or price where useful.⁵

Google says custom service names can be rejected when they contain profanity, gibberish, personal information, prices, or phone numbers. Keep procedures in the services editor instead of adding a category for each one.⁵

When should a dentist have a separate Business Profile?

A dentist should have a dedicated practitioner profile when the dentist is public-facing and can be contacted directly at the verified location during stated hours; Google describes individual practitioners as typically having their own customer base.⁶

Dentists are individual practitioners under Google's guidance. A dentist should not create multiple profiles to cover specializations. Support staff, sales associates, and corporate lead-generation agents do not qualify under the dedicated-practitioner rule.⁶

When several public-facing dentists share a location, the organization should have a separate profile. Each practitioner profile's title should contain only the practitioner's name. When a dentist is the only public-facing practitioner at a location and represents a branded organization, Google says it is best to share one profile named [brand/company]: [practitioner name].⁶

What should a dental practice put in its Business Profile name?

Use the dental practice's real-world name consistently used on its storefront, website, stationery, and as known to customers; put category, address, service area, and hours in their own fields.⁶

Do not add procedure or location keywords, service claims, or other unnecessary information unless it is part of the practice's real-world name. Google says address, service area, hours, and category belong in other fields, and that unnecessary information in the name is not permitted and could result in suspension.⁶

How should a dental practice reply to Google reviews?

To apply the HIPAA privacy rule, a dental practice should keep a public review reply generic, avoid confirming a reviewer is a patient, and move any account-specific discussion to an appropriate offline channel.⁷

The general review-request process still applies. For a dental practice, the public reply adds a privacy checkpoint. The federal rule says a covered entity or business associate may not use or disclose protected health information unless the HIPAA rules permit or require it. When the minimum-necessary standard applies, it requires reasonable efforts to limit PHI to the minimum necessary for the intended purpose; the regulation excludes treatment disclosures and requests, uses or disclosures to the individual, uses or disclosures under an authorization, and certain disclosures required by law or for compliance.⁷

To reduce disclosure risk, do not thank a reviewer for coming in, mention a procedure, or correct the reviewer's account of a visit when doing so would confirm a patient relationship or disclose PHI. Unless another HIPAA permission applies, state the practice's policy, offer an appropriate private channel, and keep patient-specific detail out of the public response.⁷

What did HHS OCR settle with New Vision Dental about review replies?

On December 14, 2022, HHS's Office for Civil Rights said it settled with New Vision Dental over impermissible PHI disclosure in responses to online reviews; HHS said the practice paid $23,000 and agreed to a corrective action plan.⁸

The HHS settlement announcement describes responses to patient reviews as the conduct at issue. The New Vision Dental Resolution Agreement and Corrective Action Plan says OCR received a 2017 complaint about the practice's Yelp responses, including alleged full names and details about visits and insurance, and that OCR confirmed the responses compromised PHI.⁸⁹

The agreement separately lists impermissible PHI disclosure, deficient Notice of Privacy Practices content, and missing PHI policies and procedures among the covered conduct. It also says the agreement is not an admission of liability by New Vision Dental. The case is an enforcement example, not a numeric limit on review replies. Use it with the generic-reply rule: do not add patient-specific detail to a public response.⁸⁹