FAQ — Questions practices ask

What does STAT Studio do, in one sentence?

We are a specialty practice: Google Business Profile management for healthcare, and nothing else. That means replying to patient reviews, publishing posts, keeping your profile information accurate, and reporting reviews that break Google’s rules — so that nobody at your front desk has to decide what is safe to write back.

Why does replying to a review need a specialist at all?

Because the obvious reply is usually the unsafe one. “So glad we could help with your knee!” reads as warm and ordinary. It also confirms, publicly and permanently, that the person was your patient and what you treated. The patient is free to post their own health information. You are not free to confirm it.

Most people writing replies know what Google allows a reviewer to post. Far fewer know what HIPAA allows the practice to say back — and that is the side that carries the penalty.

Do you handle Facebook and Instagram too?

No, and that is deliberate. Google Business Profile management for healthcare practices is the whole of what we do.

A general agency covers a dozen platforms across a dozen industries. We cover one platform, for one kind of client, where the wrong sentence is a privacy problem rather than an awkward post. That focus is why the response library exists, why every scenario carries a caution note, and why we can tell you which reporting category Google will actually act on.

If you need social media management, we are not the right fit — and we would rather say so than take the work.

We are not in Florida. Does that matter?

We work with practices nationwide. Everything is handled remotely by email, so it makes no difference where your practice operates. Wherever you are, we are glad to help.

Do Google posts help our ranking?

Google does not say they do, so neither will we.

Posts put something current on your profile for a patient who lands there. That is the honest case for them. Anyone telling you weekly posts move you up in the map results is describing something Google has not published.

We post weekly because a profile that looks maintained reads differently to a patient than one whose last update was two years ago — not because we can promise it changes where you appear.

What happened to the Q&A section on Google Business Profiles?

Google removed it. The Q&A feature was discontinued in late 2025, and the public questions and answers disappeared from Search and Maps.

In its place, Google added an AI feature — “Ask about this place,” often called Ask Maps. A patient types a question in plain language and Google’s AI writes an answer on the spot. There is no thread to monitor anymore; the answer is generated fresh each time someone asks.

Where does Ask Maps get its answers about our practice?

From what is already published about you. Google’s AI draws mainly on your Business Profile — your description, hours, services, and attributes — plus your public reviews and the replies posted to them, your website, and your photos. It does not check with you first.

A wrong answer used to be one stale Q&A thread. Now it can be regenerated for every patient who asks, from whatever the profile says that day.

Can we control what Ask Maps says about us?

Not directly — nobody can. Google generates the answer and Google decides what goes into it.

What a practice controls is the source material: a complete and accurate profile, current hours and services, and the replies published under its name. Keeping those right is the only lever there is.

Does Ask Maps change what should go in a review reply?

It raises the stakes on discipline that should already be there. Your published replies are part of what the AI reads, so a reply that confirmed a patient relationship or mentioned care details would no longer sit quietly in one thread — it could be repeated, in the AI’s own words, any time someone asks about your practice.

Our replies never contain any of that, and this is one more reason why: nothing on a profile should say what a practice would not want repeated.

Are you HIPAA certified?

No, and neither is anyone else. HIPAA has no certification program. HHS does not certify vendors, and any marketing company telling you it is “HIPAA certified” is describing something that does not exist.

What we can tell you is what we actually do. We sign a Business Associate Agreement. Everyone who touches a client account — including our contracted writers — completes HIPAA privacy and security training for business associates before they are given access, and renews that training every year. We keep the completion records. And our operating standards are published on this site rather than described to you on a call.

Is responding to a Google review a HIPAA violation?

Replying is not a violation. Confirming a patient is where practices get into trouble.

HIPAA does not stop you from having a Google profile, or from answering the people on it. What it restricts is disclosing protected health information — and a reply can disclose it without naming anything. “We are sorry your wait was long, and we will pass this to our front desk” confirms the person was seen. So does “thank you for trusting us with your care.” The reviewer is free to publish their own information. You are not free to confirm it.

Every reply in your library is written to answer the person without confirming anything about them.

What is a Business Associate Agreement?

A contract that lets a vendor handle protected health information on your behalf.

HIPAA requires one wherever a practice gives a business associate access to protected health information, or where the vendor could encounter it in the course of the work. It sets out what the vendor may do with that information, what safeguards they keep, and what happens if something goes wrong.

We do not ask for records access, and the work does not require patient information. The agreement exists anyway, because “we probably will not see anything” is not a compliance position.

Will you sign a Business Associate Agreement?

Ours is already part of the contract. Yours we will review.

The Business Associate Agreement is Schedule B of our Client Services Agreement, executed by the same signature — so you sign once rather than twice, and it is written for this specific service rather than adapted from a general template. If your compliance program has its own form, send it and we will review it. Nothing that touches protected health information starts until one of them is signed.

Do you need access to our records, EHR, or billing system?

No. We never ask for records access, and we would decline it. The work does not require patient information, and we do not go looking for it. We will also never ask you to look up a reviewer in your own records — using protected information to identify someone who left a review is a worse disclosure than the review.

Do you use AI to write review responses?

For our own writing, yes — the way most people who write for a living now do. AI helps us draft and edit our materials. A person then reviews and edits everything before it is published or sold, and you approve your response library in writing before anything goes out under your name.

Where we draw the line is your patients. No patient information is ever entered into an AI tool, and no AI system publishes to your profile. When a reply appears under your practice’s name, a person put it there, from a library you already approved.

A patient wrote something detailed about their care. Can you respond to it?

We can respond to the review. We will not respond to the care. A reply from your approved library never repeats what they disclosed, never confirms they were seen, and never references a condition, a procedure, or a visit — even when the reviewer named all three themselves. Reviewers edit their reviews. When they do, your reply is what stays on the page.

Can we use a patient’s photo or testimonial in our marketing?

Only with a signed HIPAA authorization from that individual — not a photo release, not a model release, not a general testimonial consent form. A release covers the right to use someone’s likeness. It does not satisfy HIPAA, which requires a specific written authorization with its own required elements, including the individual’s right to revoke. Send the signed authorization with the content, and we will hold the material back until it arrives.

What happens if something goes wrong?

You hear from us within two business days of discovery, at the privacy or compliance contact you name at onboarding rather than only your marketing contact. That is far shorter than the sixty days the law allows a business associate, and it is deliberate — the determination of whether something is a reportable breach is yours to make, and you should not inherit a deadline that has already run.

Can you get us more reviews?

No — and be careful with anyone who says they can. We do not solicit reviews, run review campaigns, or send review requests on your behalf. What we do is make sure the reviews you already have are answered properly, and that the ones breaking Google’s rules get reported.

Google’s rules here are stricter than most people realize. Rating manipulation expressly includes a business asking staff to solicit a certain number of reviews, or to solicit reviews mentioning specific content — including content that names a particular staff member. Review gating, where you ask satisfied patients for a review and route unhappy ones somewhere private instead, is prohibited as well.

Two different bodies police this, and they do different things. Google removes reviews and restricts profiles. The Federal Trade Commission can go to court for civil penalties. Its rule on consumer reviews prohibits conditioning an incentive on a review being positive, and prohibits suppressing reviews you do not like — and the FTC has said that soliciting only the customers you expect to be happy can violate the FTC Act even though the rule does not name that practice directly.

So a vendor promising you fifty new reviews is either not doing it the way they implied, or is doing something you would not want your practice’s name attached to. Either way, the exposure lands on you, not on them.

Can you get a bad review taken down?

Sometimes, and we will not tell you otherwise. Google decides, not us, and most reviews are not removable. A review has to violate Google’s content policy — it is not enough that it is unfair, or wrong, or written by someone who was never a patient.

What we can do is choose the reporting category deliberately. Google allows one report and one appeal per review, so a report filed under the wrong category spends the attempt. Reporting everything indiscriminately lowers your success rate; reporting genuine violations does considerably better.

How long does it take Google to remove a review?

There is no published timeline, and the status field will not tell you.

Decisions on reported reviews often come back within a few business days. Some never resolve at all. In Kristen’s agency work, reviews reported in the autumn of 2025 still read “Decision pending” the following August. The reliable signal is whether the review is still on the profile, not what the tool says.

That is why your monthly report tells you what was reported and when, rather than promising an outcome.

How many reviews will you report?

Up to the monthly cap set in your agreement. The cap exists on purpose — a profile that reports everything looks different to Google than one that reports selectively.

What happens with a review that threatens to sue us?

It comes to you, not to a reply box. Legal threats, allegations of clinical harm, references to a regulator or licensing board, requests for records, demands for payment, and reviews naming another patient are escalated to your designated contact rather than answered. Anything that threatens harm goes to you immediately.

How quickly do you reply to a new review?

We monitor multiple times per week on business days. This is not real-time coverage, and we would rather say so plainly than imply someone is watching your profile overnight.

If something appears that worries you — over a weekend, or a review you would rather we saw today — email us and we will look at it.

Urgent and fast are not the same thing, though. A negative review is usually best answered once we know what we are dealing with and once the person who wrote it has had time to cool off. The reply written in the first hour is the one most likely to create a second problem.

Who actually writes what gets posted under our name?

Work is performed by STAT Studio and, for routine replies, by a small number of contracted writers. Every one of them completes HIPAA privacy and security training before first access and renews it every year, signs an agreement binding them to the same obligations we hold, and works only from your approved library. Access is individual and revoked the day their engagement ends.

You approve that response library in writing before anything is published. We reply only from it. Nothing is improvised, and nothing is written on the spot because a review looked urgent.

Can we edit the wording of the replies?

Not the wording itself, and this is deliberate. Some replies contain bracketed fields — a practice name, a department, a contact — and those get filled in. Everything outside the brackets stays as written. The language was settled carefully, before anyone was under pressure, and a reply that has been rewritten is a different reply.

If a reply does not fit your situation, decline it and tell us. We will use a different one, or write a new one to the same standard and put it to you for written approval. You can withdraw the library, in whole or in part, at any time, and we stop using it that day.

Can we still reply to reviews ourselves?

Always. It is your profile. This governs only what we publish on your behalf.

What access do you need to our Google profile?

Manager access — the minimum level Google provides that allows replying to reviews and publishing posts. It does not let us transfer or remove your profile; that stays with your Owner. Access is granted through delegated permissions, and we will not accept a password, even if you offer one.

Will you publish our prices or the insurance we accept?

No — not on your profile, not in a reply. Both change, and a figure that was right last quarter reads as current to whoever is looking at it today. Those questions get routed to your office, where the answer is current.

Who will actually be working on our Google Business Profile?

Kristen Jones, who founded STAT Studio, and a small number of contracted writers working from your approved library.

Before marketing, she spent two decades inside healthcare — ten of those years as a CT technologist in hospital imaging. Those credentials expired in 2019 and she does not practice. The decade in imaging is why our replies never mention a procedure. She knows what a detail like that gives away.

Since then: four years marketing healthcare facilities, twenty of them across Florida. She has restored Google verification for eight healthcare facilities that had lost it, most within four to six weeks. She completed the Google Product Experts Academy in 2025, and is finishing the University of South Florida’s Digital Marketing and Science for Business program this October.

The written products are separately reviewed by practicing licensed clinicians for tone and clinical realism. That is a different thing from the compliance review, and we never present it as the same.

How many meetings will this put on our calendar?

None. There is no recurring call, no monthly check-in, and no standing meeting.

You get a written report each month: who we replied to and when, any posts published, and any reviews reported, escalated, or removed.

Anything that should not wait for the report does not wait for it. A legal threat, a review that needs your decision, or anything else that could become a problem comes to you by email as soon as we see it.

Who at our practice needs to be involved?

Two people who can approve work, and one privacy or compliance contact — often not the same person. Keeping approvals with two named people is what prevents conflicting direction. Onboarding takes most practices a single sitting.

What does it cost?

Full pricing publishes at launch, for every tier, with no “contact us for pricing” — hiding a price would sit badly with a service built on not taking up your time. Founding pricing goes to the Founding Access List first.

If we stop, what happens to the replies already posted?

They stay. Everything published to your profile is your content and remains on your profile. We keep no right to remove it, and you can edit or delete any of it whenever you like. On termination we stop publishing, you revoke our access, and we hand over the publication log and the final report.

We want to handle this ourselves. Is that an option?

Yes, and it is a legitimate one. The Review Field Guide explains how Google review policy actually works — what gets removed, what does not, and what to do about it. The Reply Library adds the written replies themselves, with a searchable tool. Both are yours to keep.

Is any of this legal advice?

No. STAT Studio is not a law firm and does not offer legal advice. Our materials are educational, and they do not replace your own compliance program or your own counsel. The legal language has been reviewed by a healthcare compliance attorney, and the tone and clinical realism have been reviewed by practicing licensed clinicians — two separate reviews, completed before anything is offered for sale, and the clinician review is never presented as compliance authority.

Will the templates work for our specialty?

They are written to work across specialties, because the rule they are built on does not change with specialty: a reply must make sense even if the person had never set foot in your practice. The scenarios cover what any practice meets on a Google profile — the angry review, the warm one, the former employee, the one naming somebody else.