SEO, AEO, and GEO for healthcare companies

AI search optimization for healthcare is the work of making a healthcare organization's clinicians, locations, services, and health information easy for search engines and AI assistants to find, cite, and recommend. It rests on SEO, including local search, because assistants that search the web draw on search indexes and business listings. For healthcare, the research points to four additions: accurate listings for every location and clinician, health content written or reviewed by named clinicians and tied to primary sources, patient stories and reviews handled within HIPAA and FTC rules, and measurement that keeps patient information away from analytics and advertising vendors.

Much of this work touches patient information or health claims, and both are regulated. HIPAA's Privacy Rule requires "an individual's written authorization before a use or disclosure of his or her protected health information can be made for marketing," with limited exceptions (opens in a new tab), and U.S. Federal Trade Commission (FTC) staff guidance says that, as a general rule, claims about the health benefits or safety of health-related products "require substantiation in the form of competent and reliable scientific evidence" (opens in a new tab). A patient testimonial, a tracking tag on an appointment page, and a symptom checker can each bring these rules into play. This page therefore covers both sides: what helps a healthcare organization appear in search results and AI answers, and what the rules let it publish and measure there.

This page is part of AEO HQ's guides by industry. It covers SEO, answer engine optimization (AEO), and generative engine optimization (GEO) together, as one practice that AEO HQ calls SEO+. Google's guidance on outside services uses both names for the same work, referring to "AI experiences (sometimes called AEO for 'answer engine optimization' or GEO for 'generative engine optimization')" (opens in a new tab) (official documentation). Facts on this page link to their sources, evidence strength is labeled where it matters, and recommendations are marked as ours. Much of the evidence on which sources AI assistants cite comes from companies that sell software or marketing services, and the text says so each time. The summary of rules is not legal advice, and AEO HQ does not review the clinical accuracy of content.

Scope and definitions

This page is for marketing teams at U.S. hospitals, health systems, medical and dental practices, clinics, and telehealth providers; for companies that sell health technology or services to them; and for the agencies that work for both. It covers unpaid visibility in search results and AI answers, and the pages, profiles, reviews, and analytics behind it. It does not cover paid search, drug or device labeling, or the clinical accuracy of content. The rules covered are federal rules and guidance from the U.S. Department of Health and Human Services (HHS), the FTC, and the U.S. Food and Drug Administration (FDA); the ethics codes of the American Medical Association and the American Dental Association; and one California statute as an example of state law, all as read on 27 September 2026. Other state health-privacy and professional-advertising laws add requirements and differ from state to state.

• Answer engine. An AI system that answers a question in its own words and names or links its sources, such as ChatGPT, Gemini, Claude, Perplexity, Microsoft Copilot, and Google's AI Overviews and AI Mode.
• Retrieval. The step in which an assistant fetches pages from a search index while it writes an answer.
• Covered entity. Under HIPAA, a health plan, a health care provider that conducts standard health care transactions electronically, or a health care clearinghouse (opens in a new tab).
• Business associate. A company or other entity that helps a covered entity carry out its health care activities and functions, or provides certain services to it, involving access to protected health information (opens in a new tab).
• Protected health information (PHI). In the FTC's summary, "most 'individually identifiable health information' held or transmitted by a covered entity or its business associate, in any form or medium, whether electronic, paper, or oral" (opens in a new tab).
• Tracking technology. HHS defines it as "a script or code on a website or mobile app used to gather information about users or their actions as they interact with a website or mobile app" (opens in a new tab). Its examples include cookies, web beacons or tracking pixels, session replay scripts, and fingerprinting scripts (opens in a new tab).
• Individual practitioner. Google's term for "a public-facing professional, typically with their own customer base" (opens in a new tab); its examples include doctors and dentists.
• Your Money or Your Life (YMYL). Google's term for topics that could significantly affect people's health, financial stability, or safety (opens in a new tab). Its rater guidelines name "YMYL Health or Safety" as one type: "Topics that could harm mental, physical, and emotional health, or any form of safety" (opens in a new tab).

How patients and healthcare buyers use AI

Patients now use AI assistants for health information, and a growing share use them when choosing a clinician. Part of this evidence comes from a national probability sample; most of the rest comes from vendor surveys. No study was found on how hospitals, health systems, or practices use AI to choose technology vendors. The table gives each finding with its sample.

Google's results pages are changing as well. An SEO software company that tracked 2,760 healthcare keywords found AI Overviews on 88% of them in December 2025, up from 72% in May 2024 (opens in a new tab). In a separate set of December snapshots, the same company found AI Overviews on 100% of treatment and procedure queries and 93% of symptom and condition queries, but on none of its local provider queries, such as "dermatologist near me," which had all shown AI Overviews in 2023; queries about self-harm, specific eating disorders, crisis intervention, and addiction showed no or almost no AI Overviews in any of the three years (opens in a new tab) (vendor data). An independent audit of 900 health queries in February 2026 found AI Overviews on 87.7% of them (opens in a new tab) (peer-reviewed short paper). Our reading: for questions about conditions and treatments, Google now answers at the top of the page; for finding a clinician nearby, Google's local results still carry the search, at least in this vendor's data.

Limits. All of the survey figures are self-reported. rater8 and BrightLocal sell software to the businesses their surveys concern, and both samples come from online panels. BrightEdge does not publish its keyword lists. No study found for this page measures how often AI assistants name individual practices, hospitals, or clinicians, and none covers buyers of health technology. The direction of the evidence is consistent (moderate); the exact shares are uncertain.

How assistants find and choose healthcare sources

An assistant can answer from what its model learned in training, its parametric knowledge, or it can search the web and write from the pages it retrieves. For health questions, two patterns matter:

• Assistants that search rely on search indexes. Google says its generative AI features are "rooted in our core Search ranking and quality systems" (opens in a new tab) and that optimizing for them "is optimizing for the search experience, and thus still SEO" (opens in a new tab). OpenAI says ChatGPT search "sometimes partners with other search providers," and it names Microsoft and Shopify (opens in a new tab) (all official documentation).
• Questions about local care use location and listings. ChatGPT may use an approximate location based on the user's IP address "to provide relevant local results," and may share location with third-party providers of local information "such as nearby business listings" (opens in a new tab). Google says Business Profiles "can help your products and services to be visible in both AI responses and other Google Search results" (opens in a new tab) (official documentation).

Evidence on what AI answers cite for health questions comes from two academic studies and several vendor studies:

The two overlap figures measure different things, by different methods, and should not be compared directly. Answers also change from one run to the next. When the same prompt was repeated, ChatGPT and Google's AI returned the same list of brands less than once in 100 runs, and Claude only slightly more often (opens in a new tab) (2,961 runs, November–December 2025; industry study; a co-investigator works for a tracking vendor). How ChatGPT, Gemini, Claude, Perplexity, and Copilot find and cite sources describes each assistant's index and crawlers.

Our reading of these studies: for questions about conditions and treatments, AI answers lean on large clinical institutions, government health sites, and video. For questions about finding care, they lean on listings and directories. A practice's condition pages compete with Mayo Clinic and Cleveland Clinic; its listings compete with other practices' listings.

The questions patients and healthcare marketers ask

Questions patients ask

The example wording below is illustrative. The evidence column shows why each kind of question matters.

What healthcare marketers ask about AEO and AI search

In AEO HQ's keyword data for the United States, pulled on 27 September 2026, two healthcare queries about AI search had measured demand: "ai search optimization for healthcare" (about 300 searches a month, with an estimated keyword difficulty of 2) and "best aeo tools for healthcare content marketing" (about 80, with an estimated difficulty of 0). Volumes this low are estimates.

In AEO HQ's query research (Google and Bing suggestions and forum thread titles, 27 September 2026), and in the question headings of a healthcare marketing agency's FAQ, marketers' questions fell into the groups below.

Local search, listings, and entity signals

For practices and clinics, local results and Business Profiles are where search and AI answers meet. For every healthcare organization, the aim is one set of facts that every source repeats.

Google Business Profiles for locations, departments, and clinicians

In the local-search test cited above, Google's AI Mode relied on Business Profiles as a primary source (opens in a new tab) (small vendor test). In the vendor data on AI Overviews above, Google showed no AI Overviews for local provider searches in December 2025, so for those searches patients see the map results and Business Profiles (our reading).

One set of facts everywhere

An entity is a person or organization that search systems treat as one distinct thing. Keep each location's name, address, phone number, hours, services, and accepted insurance plans, and each clinician's name, credentials, specialties, and locations, identical on the website, the Business Profiles, the provider directories, and the insurers' directories. The reasons are indirect: language models often merge information about different entities that share a name (opens in a new tab) (peer-reviewed), and in lab trials consistent rather than contradictory claims raised a source's odds of being cited first in at least four of six models (opens in a new tab) (peer-reviewed; laboratory setting; the authors work for a marketing software vendor). In rater8's survey, two thirds of AI users had seen incorrect provider information (above). No study has tested whether consistent listings raise AI recommendations of clinicians, so treat this as an inference, not a measured effect. The entity and brand consistency checklist lists the checks.

Structured data: useful, but not an AI citation lever

Structured data is code that describes a page to search engines. It helps Google identify an organization and its locations; the evidence does not show that it earns AI citations.

• Identify the organization and each location. Organization markup on the home page helps Google "disambiguate your organization in search results" (opens in a new tab), and for each location Google asks for the most specific LocalBusiness subtype (opens in a new tab). Schema.org's MedicalBusiness type, "a particular physical or virtual business of an organization for medical purposes," lists more specific types that include Dentist, MedicalClinic, Pharmacy, and Physician (opens in a new tab), and it defines Physician as "an individual physician or a physician's office considered as a MedicalOrganization" (opens in a new tab).
• Do not expect stars for your own reviews. If the entity being reviewed controls the reviews about itself, its pages that use LocalBusiness or Organization markup are ineligible for review stars, including reviews shown through an embedded Google or Facebook widget (opens in a new tab) (official documentation).
• FAQ markup no longer earns a Google feature, even for health sites. In September 2023, Google updated its FAQ documentation to say the feature was shown only for "well-known, authoritative government and health websites" (opens in a new tab), and it stopped showing FAQ rich results on May 7, 2026 (opens in a new tab).
• Do not sell markup as an AI tactic. In a matched study of 1,885 pages that added structured data, AI Overview citations fell 4.6%, and changes for AI Mode (+2.4%) and ChatGPT (+2.2%) were statistically indistinguishable from zero (opens in a new tab) (vendor study; all pages were already heavily cited). Google says "there's no special schema.org markup you need to add" (opens in a new tab) for its AI features.
• Keep hidden fields honest. Google asks site owners to make sure structured data matches the visible text on the page (opens in a new tab). Titles, meta descriptions, alt text, and markup should make only the claims the visible page can support (our recommendation).

Crawling and indexing

Assistants can cite only pages their crawlers can reach. Sites that block OAI-SearchBot "will not be shown in ChatGPT search answers" (opens in a new tab); blocking Claude-SearchBot may reduce visibility in Claude's search results (opens in a new tab); and PerplexityBot access is controlled by robots.txt (opens in a new tab). Google's AI features can show only pages that are indexed and eligible to appear with a snippet (opens in a new tab) (all official documentation). Keep clinician bios, locations, hours, services, and insurance lists in the HTML the server sends: in December 2024, none of the major AI crawlers rendered JavaScript (opens in a new tab) (network measurement). Patient portals sit behind a login and are not indexed; the public facts patients check belong on public pages (our recommendation).

Which third-party sources carry weight

Patients and assistants both lean on sources a healthcare organization does not control. The table gives the evidence that AI answers or patients use each source, and what to check first.

What the evidence does not show. None of these studies says whether the directory profiles cited were free or paid, and none measured how often assistants name individual clinicians or practices. The studies also do not show that adding a listing causes a recommendation; established practices tend to have listings anyway (our reading).

Our recommendations:

1. Claim and correct the free profiles first: Business Profiles, the directories that answers cite for your specialties in your own measurement, and insurers' directories.
2. Ask every patient for reviews the same way, within the rules below.
3. Cite primary sources (clinical guidelines, peer-reviewed research, and government health agencies) in your health content, so readers and assistants can check it.
4. Earn mentions honestly. Google says "seeking inauthentic 'mentions' across the web isn't as helpful as it might seem" (opens in a new tab). The evidence on brand mentions has its own guide.

Rules that limit healthcare marketing

This section is not legal advice; ask your privacy officer or counsel. It summarizes federal rules and guidance, two professional associations' ethics codes, and one state statute, as read on 27 September 2026. Rules change, part of HHS's tracking guidance was vacated by a court, and state laws and licensing boards add requirements. HIPAA applies to covered entities and business associates. The FTC says the FTC Act's obligations apply to HIPAA-covered entities and business associates, "as well as to companies that collect, use, or share health information that aren't required to comply with HIPAA" (opens in a new tab).

HIPAA: marketing and patient stories

Online tracking technologies

OCR's bulletin on tracking technologies (last reviewed June 26, 2024) applies directly to the analytics and advertising tags that measurement depends on:

• Logged-in pages. Tracking technologies on user-authenticated pages, such as patient portals, "generally have access to PHI" (opens in a new tab).
• Vendors. A tracking vendor that receives PHI on a regulated entity's behalf is a business associate, and the regulated entity must have a business associate agreement (BAA) with it (opens in a new tab). A notice in a privacy policy does not by itself permit disclosures of PHI to a tracking vendor, a vendor's promise to remove or de-identify PHI after receiving it is not enough, and cookie banners "do not constitute a valid HIPAA authorization" (opens in a new tab). One option OCR describes is a customer data platform vendor that signs a BAA, de-identifies the data, and passes only de-identified data to tracking vendors that will not sign one (opens in a new tab).
• Public pages. Tracking on public pages that let people schedule appointments or use a symptom checker without logging in "may have access to PHI in certain circumstances" (opens in a new tab).
• The court ruling. On June 20, 2024, a federal court in Texas vacated the part of the bulletin that said HIPAA obligations are triggered when a technology connects a person's IP address with a visit to a public page "addressing specific health conditions or healthcare providers"; HHS said it "is evaluating its next steps" (opens in a new tab). HHS still publishes the rest of the bulletin, with the court's order noted at the top.
• The FTC Act. The FTC says tracking technologies that share consumers' sensitive health data "in contradiction of your privacy promises" violate the FTC Act; that health information includes browsing and location data, such as "data showing a consumer visited a cancer center"; and that its BetterHelp, GoodRx, and Premom cases "make clear that disclosing consumers' health information for advertising without their affirmative express consent may be an unfair practice" (opens in a new tab). Vendors of personal health records that HIPAA does not cover, such as some health apps, may fall under the FTC's Health Breach Notification Rule (opens in a new tab).

Professional ethics codes: physicians and dentists

The national medical and dental associations' ethics codes cover much of the same ground as the FTC, in the professions' own words. State licensing boards set the binding rules for each license, and they differ from state to state; the codes below are the associations' guidance to their members.

Chat assistants and AI-written patient messages

• Disclose AI in clinical messages (California). Since January 1, 2025, California has required a health facility, clinic, physician's office, or group practice that uses generative AI to write "patient communications pertaining to patient clinical information" to include a disclaimer that the message was generated by generative AI, "prominently displayed throughout the interaction" for chat, along with "clear instructions describing how a patient may contact a human health care provider." The requirement does not apply when a licensed or certified health care provider reads and reviews the message, and "patient clinical information" excludes "appointment scheduling, billing, or other clerical or business matters" (opens in a new tab). Other states differ.
• Symptom checkers and chat widgets can collect PHI. OCR's bulletin covers public pages where a person "enters symptoms in an online tool to obtain a health analysis" (opens in a new tab) (above), so the vendor behind a chat or symptom tool may need a BAA (our reading).
• Our recommendation: a chat assistant on a provider's site should say that it is an AI system, send clinical questions to a person, and keep what patients type away from vendors without a BAA.

Health claims, endorsements, and AI claims

Reviews and platform rules

Responding to reviews

Patients read replies. In rater8's survey, 66% of patients said that seeing a provider respond to online reviews influences their trust, up from 42% the year before (opens in a new tab) (vendor survey), and Google says replying to reviews "shows that you value their feedback" (opens in a new tab). The FTC says a business may respond publicly but may not make a false accusation about the reviewer (opens in a new tab). For covered entities, HIPAA sets a stricter limit, and OCR has enforced it. In 2023, OCR settled with a New Jersey psychiatric practice that had disclosed the PHI of four patients in response to their negative reviews on Google Reviews; the practice paid $30,000 and accepted a two-year corrective action plan that includes revising its notice of privacy practices to describe the uses that need a patient's authorization, such as "posting on Manasa's website, social media pages and/or other public platforms" (opens in a new tab). Our recommendation: reply without confirming that the reviewer is a patient and without any detail of care, and invite the person to contact the office directly.

Content that complies and still answers the question

Assistants favor specific, checkable facts. In lab trials, being on topic, stating a price, and carrying a recent date raised a source's odds of being cited first in all six models tested (opens in a new tab) (peer-reviewed; laboratory setting). Google's systems "give even more weight to content that aligns with strong E-E-A-T" (opens in a new tab) (experience, expertise, authoritativeness, and trustworthiness) for topics that could significantly affect people's health. Its rater guidelines ask raters to consider whether pages on such topics are "accurate and consistent with well-established expert consensus" (opens in a new tab) and list "different treatment options for liver cancer and the associated life expectancies under each treatment" (opens in a new tab) as information best left to experts. The guidelines also tell raters to expect reputation information on "professionals such as lawyers and doctors" (opens in a new tab), and in Article markup Google asks for an author URL that "uniquely identifies the author" (opens in a new tab).

Our recommendation: publish each health page under the name of the clinician who wrote or reviewed it, linked to a bio with credentials, and add what your clinicians see in practice rather than restating what Mayo Clinic already says, since Google asks for non-commodity content (opens in a new tab).

How to measure SEO and AEO for a healthcare organization

Measure AI visibility as a rate across repeated runs, per assistant, per service line, and per location, and connect it to appointments by asking new patients how they found you. Keep patient information out of every step: write test prompts as a patient would phrase them, never from a real patient's details, and keep tags that could capture PHI off pages where people book, describe symptoms, or log in unless a BAA and a Privacy Rule permission cover them (our recommendation, based on the OCR bulletin above).

Change one thing at a time, keep a group of pages you did not change, and record the date of each change. In the only controlled field study found, ChatGPT referrals to pages that were not changed grew 3.5 times over the same period (opens in a new tab) (preprint; one site), so a before-and-after comparison without a control would have credited that growth to the changes.

How to do SEO and AEO for a healthcare organization

These steps are recommendations. Each draws on the evidence above.

1. Map the data flows first. List every tag, pixel, chat tool, and form on the public site, and decide with your privacy officer which may run on scheduling, symptom, and login pages.
2. List the questions patients ask, by service line and location, in their words, from call-center logs, front-desk staff, and search data. Remove anything that identifies a patient.
3. Fix the Business Profiles for each location, department, and public-facing clinician, following Google's practitioner and department rules.
4. Make the directories, the insurers' listings, and the website state the same facts.
5. Publish clinician-reviewed pages that answer first and cite their sources: location pages, clinician bios, service pages, and condition pages, each with a named reviewer and a date. Check each claim for substantiation before it goes live.
6. Ask every patient for a review the same way, with no incentive and no screening. Reply without confirming that anyone is a patient, and publish patient stories only with written authorization.
7. Make the pages crawlable and indexable, allow the search crawlers, and keep facts in the HTML.
8. Measure with a fixed prompt panel and a source question at scheduling, and change one thing at a time.

Checklist for healthcare

What the evidence shows and does not show

Antipatterns in healthcare marketing

Each antipattern below is common in healthcare marketing and fails for a documented reason.

Frequently asked questions

How do I get my practice or clinic recommended by ChatGPT?

No one can guarantee it; OpenAI says of ChatGPT search results, "Placement is not guaranteed." (opens in a new tab) A practice controls whether its pages can be crawled and whether its facts agree everywhere: allow OAI-SearchBot, complete the Business Profiles and the directory profiles that answers cite, and publish clinician-reviewed pages that state locations, hours, services, clinicians, and plans accepted. How to get recommended by ChatGPT covers the details.

Is AI search optimization worth it for a healthcare organization?

Patient behavior says the channel matters: about a third of adults used AI for health information in the past year, and 47% of patients in one vendor survey had used AI to research providers (see the table above). The returns are harder to measure, because AI referrals are a small share of visits and HIPAA limits how visits can be tracked. In our view, the lowest-cost parts of the work, such as accurate listings, clinician bios, and clear location pages, also serve patients who never use an assistant. Is AEO worth it? What the evidence says reviews the general case.

Can we use patient testimonials in marketing?

For a covered entity, generally only with the patient's written HIPAA authorization; OCR's director said so when announcing the Cadia settlement (opens in a new tab). The FTC adds that a testimonial cannot substantiate a health claim and that results must be typical or come with a clear statement of what people generally experience (rules above).

Can doctors respond to Google reviews?

Yes, but a reply must not disclose PHI. OCR settled with a psychiatric practice that had disclosed four patients' PHI in replies to their negative Google reviews (opens in a new tab), and confirming that a reviewer is a patient, or describing the visit, can itself disclose PHI (our reading). Google says replies show that you value feedback, and rater8's survey found that most patients say replies influence their trust (above). Our recommendation: thank the reviewer, say nothing about care, and invite them to call the office.

Can we track AI referral traffic under HIPAA?

Yes, with care about where tags run. OCR says tags on logged-in pages generally have access to PHI and that tags on public scheduling and symptom-checker pages may, and that a cookie banner is not a HIPAA authorization (rules above). Google says authenticated pages "are likely to be HIPAA-covered" and that customers "should not set Google Analytics tags on those pages" (opens in a new tab), and it does not offer a BAA for Google Analytics. Our recommendation: measure AI referrals on pages that carry no PHI, keep tags off scheduling and symptom pages unless a BAA covers the vendor, and use a "How did you hear about us?" question in scheduling for attribution. How to track AI referral traffic in GA4 covers the setup.

Does schema or FAQ markup help healthcare sites in AI search?

Not as a citation lever. In a matched study, adding structured data did not reliably raise AI citations (opens in a new tab), and Google's FAQ rich results, which in 2023 were limited to authoritative government and health sites, stopped appearing on May 7, 2026 (opens in a new tab). Keep Organization and LocalBusiness markup that repeats visible facts, because it helps Google identify your organization and locations.

What are the best AEO tools for healthcare content marketing?

AEO HQ is not a software vendor and does not rank tools. Measurement does not require a subscription: Search Console's generative AI report, Bing Webmaster Tools' AI Performance report, and GA4's AI Assistant channel are free, and a fixed prompt panel can be run by hand, provided each prompt runs several times on each assistant. For healthcare, add one check before buying: any tool that places a script on your site falls under OCR's tracking guidance if it can see pages where people book or describe symptoms (our reading).

Should AI write our health content?

Google's spam policies define scaled content abuse as unoriginal content made at scale to manipulate rankings, "no matter how it's created," and its raters are told to check health pages against well-established expert consensus (above). For dentists, the ADA's code adds that an article under a dentist's byline must truthfully disclose its source and authorship (rules above). Our recommendation: a clinician should write or review every health page, and the page should say who wrote it, who reviewed it, and when.

How long does healthcare SEO or AEO take to work?

No study has measured it. A 2026 review of 45 studies found no technique with a stable, longitudinal, cross-platform causal effect on organic discoverability (opens in a new tab) (preprint), so there is no evidence base for a timeline. Google says crawling a URL "can take anywhere from a few days to a few weeks" (opens in a new tab). Treat a promised timeline as a sales claim.

How much does AEO cost for a healthcare organization, and which agency should we hire?

We found no published survey of what healthcare organizations pay for SEO or AEO. A software company that sells its own AEO product puts agency work at about $3,000 and up for a one-time audit or sprint, and about $9,000 to $15,000 or more a month for ongoing programs (opens in a new tab) (September 2026); the index of what AEO costs compares published prices. AEO HQ sells this work itself (see Answer engine optimization (AEO) services), so we have an interest, and we do not rank agencies. Google says third-party tools "can't guarantee performance," and lists AEO and GEO tools among the services to evaluate critically (opens in a new tab). How to choose an AEO or GEO agency lists the questions to ask; for healthcare, add two: will the agency sign a BAA if its tools will touch PHI, and who reviews its health claims?

Next steps

AEO HQ sells this work at fixed, published prices, from a $499 automated audit to $8,995 for an audit, a plan, and technical implementation that includes analytics setup. We do not give legal or HIPAA compliance advice, and we do not review clinical accuracy: your privacy officer approves tracking, and your clinicians approve health claims. See the prices and what each package includes.

Change log

• September 28, 2026: First published.