Yelp doesn't disclose your full name. Yelp foreshortens your name to first name, last initial.

A doctor responding to a patient cannot therefore violate HIPAA unless that doctor discloses the patient's full name in their response.

Defending yourself against a negative review on Yelp isn't that tough - you write a response that says "we're so sorry that you had a negative experience with us. Please contact us directly so that we can remedy the situation with you". If you see one or two of those, you know you have a responsive vendor. If you see a thousand of those, you know you have a shitty office with someone running damage control.

My wife had one where she wrote "I'm sorry you had such a bad experience at my office... but are you sure you were ever my patient? Your name doesn't match anything in our records and your location is 180 miles away from us. Please call us if you'd like to give us another chance." Within two days we had "upgraded one star for being nice" and within a week they'd deleted the review.