Insurance Agency Online Reviews: A HIPAA-Safe Guide
How to ask clients for reviews and respond to them without the request becoming regulated Medicare marketing material or a HIPAA problem.
A HIPAA-safe review request is a message that asks a client for feedback on service, not on their coverage, health, or claims, sent through a channel the client already expects to hear from the agency on. It avoids plan details, treats the request as routine business communication, and never pressures the client to post publicly.
Why Review Requests Are a Compliance Question, Not Just a Marketing One
Health and Medicare insurance agencies sit in an unusual spot. A dentist's office asking for a Google review only has to worry about HIPAA. An agency has HIPAA on one side and, for Medicare business, Centers for Medicare & Medicaid Services (CMS) marketing rules on the other. Both sets of rules apply to the same five-second text message asking a client to leave a review.
CMS defines marketing broadly: any communication intended to influence a beneficiary's plan selection or retention, or that addresses a plan's benefits, premiums, cost sharing, or star ratings, can qualify. A client review that praises a specific plan's benefits or premium can brush up against that definition. A review that simply says the agent was easy to work with does not.
The compliance risk here has a specific trigger. A review that credits a specific plan's benefits, premium, or star rating, written to influence someone's enrollment or retention decision, can meet CMS's definition of Medicare marketing material under 42 CFR 422.2260. That definition already applies to independent Medicare agents and brokers, who count as a Third-Party Marketing Organization under the same rule. A five-star review that says "my zero-premium Advantage plan covers everything, switch today" carries exactly that intent and content. A review that says "my agent returned every call and explained my options clearly" does not, because it never touches a plan's benefits, premiums, or ratings. The difference is not the client's enthusiasm, but whether the words describe the agent's service or the plan's specifics, and that distinction is what every review request and every reply should be built around.
Can Medicare Agents Ask Clients for Online Reviews?
Yes, agents can ask clients for reviews, as long as the request and the resulting review stay focused on service rather than plan specifics. The consumer-facing marketing rules page on Medicare.gov describes the kinds of contact and content CMS treats as regulated marketing for Medicare Advantage and Part D plans. A review request that avoids plan names, premiums, and benefit comparisons sits outside that definition entirely, which is the simplest way to keep the ask low-risk.
The safer pattern most agencies land on: ask about the experience of working with the agency, not the plan. "Was the agent responsive? Did they explain things clearly? Would you recommend them to a friend?" None of that references a specific plan's cost or coverage, so it reads as ordinary customer-service feedback rather than Medicare marketing material.
What Makes a Review Request HIPAA-Safe?
A HIPAA-safe request never names or implies a client's health condition, diagnosis, medication, or claim history, and it treats the fact that someone is a client at all as information to protect. The HIPAA Privacy Rule's minimum necessary standard requires a covered entity to limit the use and disclosure of protected health information to what is needed for the purpose at hand. Asking for a review on service quality needs none of a client's health information, so none of it belongs in the request. A broader rundown of what a BAA and HIPAA obligations cover for an agency is in AgencyView's HIPAA basics guide.
The same rule cuts both ways: the request itself must stay generic, and so must any follow-up. An agent should never reply to a private message about a review by referencing why the client enrolled, what plan they chose, or any detail tied to a health condition. The safest version of a review request could be read by anyone, including someone who is not a client, without learning a single fact about that person's health or coverage.
A Review Request Workflow That Doesn't Create Risk
A workflow beats a one-off ask, because it removes the guesswork about timing, wording, and who gets asked. Four steps cover most agencies:
- Pick a neutral trigger. Ask after a policy is delivered and confirmed, not right after an enrollment call or a plan comparison, so the request is clearly separate from the sales conversation.
- Use a channel the client expects. A text or email sent from the same number or address the agency already uses for service communication reads as routine. A new, unfamiliar sender reads as a cold marketing message.
- Write the ask once, and keep it short. One or two sentences, no plan name, no premium, no mention of a health condition or claim. A single link to the review page is enough.
- Log who was asked. A simple record of who received a request and when prevents the same client from being asked twice, and gives the agency a defensible record if a client ever disputes receiving a message. Agencies that bundle a referral ask with the review ask should keep the two requests separate and logged separately, following the same pattern as AgencyView's referral program compliance checklist.
Safe Language vs. Language to Avoid
| Safe to include | Avoid |
|---|---|
| "Thanks for working with us. Mind leaving a quick review of your experience?" | Naming the plan, carrier, or premium the client chose |
| A generic link to the agency's review page | Any mention of a diagnosis, medication, or claim |
| A thank-you after a policy is delivered | A request sent during or right after the enrollment call |
| "Every review helps other families find us." | Comparing the client's plan favorably to a competitor's plan |
Responding to Reviews Without Creating a New Problem
Replying to a review is where most of the risk shows up, because the reviewer often volunteers details the agency should not confirm. A client might write, "Helped me switch off my old plan after my surgery," and name a specific condition or procedure. The agency's reply has to stay just as generic as the original request, regardless of what the reviewer disclosed.
A workable reply template covers three things: thank the reviewer for their time, avoid repeating or confirming any health or coverage detail they mentioned, and invite further conversation through a private channel instead of the public thread. That pattern works whether the review is glowing or critical, and it keeps the agency's public response free of anything that could read as a HIPAA disclosure.
Where to Point Clients for Reviews
Most agencies pick one or two review destinations and stick with them, rather than asking for reviews everywhere at once. A Google Business Profile is the most common choice, since it is also where most prospective clients look first. A second destination, such as a social media page or an industry-specific directory listing, gives clients who do not use Google an alternative without multiplying the number of requests sent. Posting content about a client to that same social page raises its own set of rules, covered in AgencyView's social media compliance checklist for Medicare agents.
Fewer destinations also make the record-keeping in step four of the workflow above easier. One link, sent once, to one place, is simpler to track than three separate asks spread across different platforms and different months.
Frequently Asked Questions
Can insurance agents ask Medicare clients for a Google review?
Yes. A request that asks about service, not about a specific plan's benefits or cost, falls outside CMS's definition of Medicare marketing material and can be sent like any other client communication.
Is a client testimonial considered a Medicare marketing material?
A testimonial can count as marketing material if it references a plan's benefits, premium, or star rating in a way intended to influence an enrollment or retention decision. A testimonial about service alone does not meet that definition.
Can an agent respond to a negative review?
Yes, but the reply should never confirm or repeat any health, coverage, or claim detail the reviewer disclosed, and should move the specifics of the complaint to a private conversation.
Do review request texts need to follow the same texting rules as other client messages?
Yes. A review request is still an outbound text to a client, so the agency's existing consent and opt-out practices for texting apply to it the same way they apply to any other message. AgencyView's texting compliance checklist covers the opt-in and opt-out basics those practices rest on.
Should a review request mention the client's plan or carrier?
No. Leaving out the plan name, premium, and benefit details keeps the request focused on service and out of CMS's marketing-material definition.
Most of this workflow runs on infrastructure agencies already have. The same CRM that logs texting consent and delivery for other client communication can log review requests the same way. Many insurance CRMs, including the one built into AgencyView, include a built-in review-request action on the contact record, so the ask goes out from a channel the client already recognizes instead of a separate tool. AgencyView keeps that request next to the client's policy history and the agency's HIPAA documentation, in one record.
Where AgencyView fits
Keep reading
- The Insurance Agency Client Intake Form Template
- A Role-Based Access Control Checklist for Insurance CRMs
- Medicare Extra Help (LIS): What Agents Should Track