The HIPAA Review Trap: How Chiropractors Get Named by AI Without Breaking the Law

OCR has imposed a $50,000 penalty in a review-response case

A HIPAA-covered practice that names a patient, or merely confirms one, in a public review reply is disclosing protected health information, and the Office for Civil Rights has penalized that. In March 2022 OCR imposed a $50,000 penalty on U. Phillip Igbinadolor, D.M.D. & Associates, a dental practice that had answered a negative Google review by naming the patient and describing his treatment (ArentFox Schiff). That is one enforcement action against one practice, not a price list: penalties turn on the facts, the harm and the practice's compliance history, and no published figure attaches to a review reply in the abstract. What the case does establish is that OCR treats a review reply as a disclosure like any other.

Patients read replies as evidence. In a June 2026 survey of about 1,000 US adults by rater8, a firm that sells review-collection software to medical practices (weigh its numbers accordingly), 66% said a practice's responses to reviews shape their trust, up 24 points from 2025 (rater8). In BrightLocal's survey of 1,002 US consumers, run by a vendor selling local SEO and reputation tools, 89% expect a business to answer reviews (BrightLocal).

So the loudest trust signal in local search, recent reviews with visible owner replies, is the one a chiropractic clinic cannot produce freely. What works instead: a two-line reply template the front desk uses on every review, never confirming anyone was here.

Can a chiropractor legally answer a patient review under HIPAA?

Absent a valid, signed HIPAA authorization from the individual, a chiropractor whose practice is a HIPAA-covered entity cannot safely confirm that a reviewer was ever a patient. Protected health information is any information that identifies a patient, and that includes the bare fact that someone is a patient at all. Whether your clinic is a covered entity is a threshold question worth answering with counsel before you decide what you may write.

Bass Berry & Sims states it without hedging: "Even a well-meaning response to a positive review is technically a HIPAA violation if the response confirms or implies the reviewer's status as a patient." Replies, the firm advises, should "generically describe the provider's processes without confirming or denying that the reviewer is or has been a patient" (Bass Berry & Sims).

New Vision Dental in California paid $23,000 in 2022 for the same category of disclosure in a review reply (ArentFox Schiff). No chiropractic clinic sits in the published OCR settlements yet. One caveat decides whether any of this binds you: HIPAA reaches a practice only if it is a covered entity, which turns on whether the practice transmits health information electronically in connection with a standard transaction such as an insurance claim or an eligibility check. A clinic that bills insurance electronically is squarely inside; a strictly cash-only practice that runs no such transactions may sit outside the rule, and state privacy law, board rules and consumer-protection law still apply to it. Confirm your own status with counsel rather than assuming either way, because the same reply is a violation in one clinic and merely a bad idea in the next.

Testimonials are the second tripwire: publishing a patient's story, photo or before-and-after image requires written HIPAA authorization first (Compliancy Group, ChiroHealthUSA). That is not a checkbox you bury in the intake stack: a HIPAA marketing authorization is a separate, standalone document with its own required elements, and burying it in a pile of new-patient paperwork is how practices end up with an authorization that will not hold. Have counsel draft or review a dedicated HIPAA-compliant authorization, and have the patient sign it as its own document when the testimonial is actually being published.

A compliant reply is boring by design: thank the reviewer, invite a phone call, add nothing else. No treatment detail, no dates, no "thanks for coming in."

Do back-pain patients actually ask AI for a chiropractor? The 45-to-60 group leads

Yes, and the age curve runs opposite to the assumption: 47% of US patients now use AI to find a new provider, and the heaviest users are 45-to-60-year-olds, a commercially important age band for most back-pain clinics.

AI visibility is how often, and how prominently, ChatGPT, Gemini and Perplexity name your clinic when someone asks them for a recommendation. rater8's June 2026 survey put the share of patients using AI to find a provider at 47%, up from 31% in late 2025 (rater8).

By age, 64% of 45-to-60-year-olds search this way, against 52% of 30-to-44s and 28% of the 18-to-29 group (TechTarget on the rater8 study). Degenerative disc disease, sciatica and chronic low-back pain cluster in that older band, inverting the story clinic owners were sold about who uses AI.

Inside Google, patients trust the AI Overview most (37%), ahead of organic results (20%), the local map pack (13%) and ads (7%) (PR Newswire). The map pack your agency has optimized for a decade now ranks third in trust for a patient hunting a chiropractor.

The sources AI actually cites when a patient asks for a chiropractor nearby, ranked

Your own site goes first, and not because it is cited most: it is the only source where a fact about the clinic is asserted rather than repeated. Conditions treated, insurers accepted, cash price per adjustment, hours. A directory can corroborate that fact or, left stale, contradict it; it cannot originate it. The list below is ordered by that leverage, not by measured citation volume. For chiropractor-style provider questions AI then leans on general healthcare directories, its own grounded map data and public forums, not on the chiropractic profession's association directories. Work the ranked list below in order.

• 1. Your own website. We measured this ourselves: in the three markets we did cover, dental, med spa and plastic surgery in Dallas, July 2026, 73% to 79% of the citations behind AI recommendations pointed at the businesses' own websites rather than at directories (our benchmark). Chiropractic was not in that sample, so read it as direction, not as your number. Dallas, July 2026 — one market, one day, and a primary measurement: the raw answers are stored, the method is published, and the run repeats against any city. Yext, a listings vendor with the opposite interest, reports the same tilt: Gemini takes 52.15% of its citations from brands' own sites, ChatGPT 48.73% from third-party listings (Yext). The engine reads page text, not a license registry and not your practice-management system, so a fact you never wrote down does not exist for it. Put services, hours, accepted insurers and cash prices in readable page text, never inside a booking widget.
• 2. General healthcare directories (WebMD, Vitals, Healthgrades). They supplied 52.6% of healthcare citations in Yext's October 2025 analysis of 6.8 million citations across 1.6 million AI answers; Yext sells listings management, so read the emphasis accordingly (Yext). Claim both profiles and make them repeat what your site already states. The same fact asserted by two independent sources is the most verification an engine can get; a profile that disagrees with your site subtracts confidence rather than adding it.
• 3. Zocdoc, for Perplexity. Zocdoc dominates provider queries there, ahead of Healthgrades and Vitals (rater8 on the Yext data). If you bill insurance and take online bookings, it is the strongest Perplexity-specific corroboration a chiropractic clinic can add, and corroboration is what it is: not a substitute for the page.
• 4. Reddit and Wikipedia, for ChatGPT. Semrush's AI Visibility Index (126 million prompts, 1,200+ brands, 22 verticals, January to April 2026) found ChatGPT cites 15.4 sources per answer, leaning on Reddit and Wikipedia, while Gemini uses 3.3 (Semrush, via PPC Land). Semrush sells AI-visibility tracking. City subreddits and back-pain threads carry recommendations you do not control.
• 5. Yelp and social profiles, for Google AI Mode. AI Mode cites 11.4 sources per answer and reaches for Facebook, Instagram and Yelp; AI Overviews use 9.2, with YouTube the largest single source (Semrush, via PPC Land). Yelp feels irrelevant to a spinal adjustment practice, and the engine still reads it.
• 6. Chiropractic directories: plausible, unproven. Perplexity takes 24% of citations on subjective queries from niche industry directories (Yext), yet no study confirms ChiroDirectory, the ACA Find-a-Doc or the ICA directory as AI sources. Listing is cheap, so list, and log it as a hypothesis.

Who controls a chiropractic clinic's citations? Yext and Semrush do not agree

There is no consensus. Yext reports 86% of citations come from sources a brand controls, while Semrush finds ChatGPT leaning on Reddit and Wikipedia, which no chiropractic clinic controls.

Yext gives 44% of citations to a brand's own site and 42% to its listings, 86% under brand control (Yext). Note which half is larger: even in a listings vendor's own data the brand's site outranks its listings, and the site is the only one of the two where a fact is stated first rather than echoed. Yext is a listings vendor, so read any emphasis on listings accordingly. Semrush's index of 126 million prompts points instead at forums and encyclopedias nobody can edit to order.

Semrush adds a wrinkle: the overlap between the brands an answer mentions and the sources it cites runs only 30% to 64% (Semrush, via PPC Land). A chiropractor chasing citations alone can end up a footnote in an answer that recommends a competitor.

Whoever is right, the patient checks. BrightLocal found 63% of consumers trust AI recommendations and 71% trust AI review summaries, yet 88% still fact-check and 42% always verify on a review site (BrightLocal). Treat the AI answer as a shortlist your own site then has to hold up, with your Google and Healthgrades profiles agreeing with it rather than telling a different story.

Nobody has measured AI visibility for chiropractic, and collections sit at 57% of billed charges

No published study measures how AI recommends chiropractors, and this profession has the least room to guess: the average chiropractor collected only 57% of what was billed to insurers in 2024.

Reimbursement has not meaningfully risen in more than twenty years (Chiropractic Economics, Chiropractic Future). In 2025 one clinic's second-largest insurer cut payments 20%, and another raised self-pay rates after a 14% cut from Aetna (My Chiro House Call); that is two practices talking, not a survey.

Here is the gap nobody selling to you will mention. Every consumer number in this article comes from a healthcare-wide sample (rater8 surveyed patients of physicians) or a local-business-wide one (BrightLocal, SOCi). Nobody has run the study on chiropractic, and the chiropractic-specific "AI research" from marketing agencies publishes no methodology. Carrying these figures to your clinic is a defensible hypothesis, not a measurement.

Guessing is expensive because local-search strength does not transfer: SOCi's 2026 index, published by a company that sells local-marketing software and therefore has an interest in the gap it reports, found that in retail only 45% of the top-20 brands in traditional local search reached the top of AI recommendations (Search Engine Land). That gap is the difference between AI visibility and local SEO.

Six questions a back-pain patient types, and how to run them yourself in 15 minutes

Any chiropractor can measure this free in about fifteen minutes: put these six patient-style questions to ChatGPT, Gemini and Perplexity, in a fresh chat each time, and write down every practice named, in order.

Then check what they say about you, not only whether they say it. SOCi's 2026 index of roughly 350,000 locations measured business-data accuracy at about 68% for ChatGPT and Perplexity, against 100% for Gemini, which is grounded in Google Maps (SOCi).

Patients rarely catch the error: 60% accept an AI summary without verifying it, although 66% report hitting inaccurate provider information in AI answers (rater8, June 2026). Wrong insurance, hours or address data therefore reaches a patient who, on those numbers, is more likely to accept it than to check it against your own site.

The manual method has a hard limit: one pass is a snapshot. The three assistants answer differently across runs, cities and model updates, so a notepad cannot track a competitor's share over a quarter.

One objection surfaces in every clinic: an AI tool must mean handing over patient data. It does not. Measuring what the assistants say publicly about your practice reads public answers to public questions, touching no PHI, no EHR and no patient record. RecoSignal runs these same queries on a schedule.

• "Who is the best chiropractor in [city] for a herniated disc?"
• "I threw my back out lifting. Do I need a chiropractor or a physical therapist in [city]?"
• "Chiropractor in [city] who takes Blue Cross and can see me this week."
• "Cash-pay chiropractor in [city], no insurance. How much per adjustment?"
• "Which chiropractor in [city] is good for sports injuries and has evening hours?"
• "Is [your clinic name] in [city] any good?" That one shows what the engines already believe.

Five questions chiropractors ask before changing anything

Five questions come up in nearly every conversation with a chiropractor about AI search, and each has a number attached rather than an opinion.

• Do I really need a 4.0 star rating? Effectively yes, on vendor-reported numbers. 75% of patients will not book with a provider rated below 4.0 (rater8, June 2026). The assistants filter too: the average rating of locations ChatGPT recommends is 4.3 stars, Perplexity 4.1, Gemini 3.9 (SOCi Local Visibility Index 2026).
• How old can my reviews be? Past three months, many people stop counting: 74% of consumers read only reviews from the last three months, and 47% avoid a business with fewer than 20 reviews, per BrightLocal, which sells local SEO and reputation tools (BrightLocal, n=1,002). Five new reviews a month beats a review drive every spring.
• Can I advertise a free exam or free X-ray? Only with the disclosure your state board demands. Washington requires a signed disclosure telling the patient "when the free services have been completed and that any additional services the patient requests are subject to charge", and bans "advertising which guarantees any result or cure" (WAC 246-808-600).
• Insurance keeps squeezing me. Is this worth the hours? Limited coverage already discourages patients from returning for regular visits, and the practices holding up are cash-based niche clinics living on referrals (SkyQuest chiropractic market report). Referrals are what an assistant now hands out at scale.
• Does the phone still work as a booking channel? Barely. 67% of patients prefer to book online and 40% would go to a competitor rather than call, per bspkn, a chiropractic marketing agency selling patient-acquisition services, so treat it as a vendor's figure (bspkn).

What a chiropractor can fix this week without tripping a state board rule

A chiropractor can fix three things this week: the page text on the clinic's own site that states services, cash prices, insurers and hours, since that is where the fact exists before any directory can repeat it; profile accuracy across the directories AI reads, so they corroborate that text rather than contradict it; and any ad copy a state board would question.

State chiropractic boards regulate the exact promises AI-facing content tempts you into. Florida's rule holds that "it is misleading and deceptive for a chiropractor to advertise free services (i.e., x-rays, examination, etc.) or services for a specific charge when in fact the chiropractor is transmitting a higher charge for the advertised service to a third party payor for payment" (Fla. Admin. Code R. 64B2-15.001). Ohio (OAC 4734-9-02) and New York (advertising alert) publish comparable rules.

In practice: no "best chiropractor in town", no guaranteed outcomes, no cure claims, no free-X-ray offer that hides when charges begin. What you publish for an engine has to be factual and checkable, which is what engines reward anyway.

The patients in play are already leaving someone. Among patients who switched providers, AI was the top digital influence at 39% (rater8), and 55% say they have ruled out at least one doctor based on what they found online (PR Newswire on the rater8 survey).

Start from a measurement rather than a guess. RecoSignal's free AI Visibility Snapshot puts patient-style questions to ChatGPT, Gemini and Perplexity, then reports how often your clinic is named, your share of recommendations against nearby chiropractors, and the biggest single gap. For how engines pick names, see how businesses get recommended by ChatGPT; for the same HIPAA problem in the field already fined over it, see AI visibility for dentists.