TL;DR: GEO for healthcare is local AI visibility work constrained by HIPAA at almost every step. Reviews drive AI recommendations, and responding to a patient review can be an impermissible disclosure. Testimonials need signed authorisation. Chat widgets that collect symptoms handle protected health information. The provider entity work is high-return and low-risk, so start there while the rest goes through compliance review.
General information about marketing practice, not legal or compliance advice. Have your privacy officer and counsel review anything here before acting on it.
Key Takeaways
Start with provider entity data. NPI records, state board listings, Google Business Profile, Healthgrades and Zocdoc are what assistants draw on for referral questions, and fixing them raises no HIPAA issues.
Responding to patient reviews is a real risk. OCR settled with a New Jersey psychiatric practice in 2023 over protected health information disclosed in responses to negative online reviews, affecting four patients.
Ask for reviews, do not confirm anyone was a patient. That single rule resolves most of the tension between review velocity and the Privacy Rule.
Testimonials and case studies need signed HIPAA authorisation before publication, and clinical outcome claims carry advertising exposure on top.
Your vendors may be business associates. Anything creating, receiving, maintaining or transmitting PHI on your behalf needs a business associate agreement in place before data moves.
Tracking scripts need an audit. Pixels and analytics on pages collecting health details create exposure, and Google does not sign business associate agreements for Google Analytics.
Anchor targets assume your CMS generates slug IDs from heading text. Confirm on staging and adjust the hrefs if your platform slugifies differently.
How patients find providers through AI
Healthcare has a distinctive pattern: patients describe symptoms first and ask for a provider second. Those two questions behave very differently in AI assistants, and only one of them is a visibility opportunity.
The two question types
Type | Example | How assistants behave |
|---|---|---|
Clinical | What causes sharp pain in my lower right abdomen? | Cautious. General information, strong encouragement to seek care, often no provider named |
Referral | Who are the best gastroenterologists in Portland? | Behaves like any local recommendation, drawing on profiles, directories and reviews |
Assistants are deliberately conservative on clinical questions. They tend to give general information and direct the person to a professional rather than naming one, which means the clinical question is rarely where you get recommended.
It is still worth answering clinical questions well, because that content builds the corroboration supporting your provider entity. It is simply not the query that produces the referral.
Where referrals actually come from
For the referral question the answer is assembled from provider directories, your Google Business Profile, review platforms, insurance network listings and local best-of coverage. Your blog is barely involved.
Assistants also rewrite "near me" into a city name using inferred location, so optimise for "best [specialty] in [city]" rather than proximity phrasing.
The honest scale
SOCi's 2026 Local Visibility Index, covering more than 350,000 business locations, found ChatGPT recommended roughly 1.2% of them against 35.9% appearing in Google's local pack, with about 45% overlap. Ranking well on Maps does not mean an assistant will recommend you.
What this means for sequencing
Provider entity data first, content second. That order matters more in healthcare than elsewhere because the entity work raises no HIPAA questions and can start immediately, while most of the content and review work needs compliance review before it ships.
Starting with the unblocked work means the programme produces something while the rest moves through review, which in a hospital system can take a quarter.
The compliance layer
Generic GEO advice assumes you can publish testimonials, respond to reviews, run analytics freely and deploy a chat widget. In healthcare each of those touches the Privacy Rule, which is why a marketing plan built from general guidance can create exposure a normal business never faces.
General information, not legal advice. Your privacy officer and counsel should review anything here before you act on it.
The concepts that matter for marketing
Concept | What it means in practice |
|---|---|
Protected health information | Does not require clinical detail. A single identifier connected to care, such as a name or photo tied to your practice, can qualify |
Impermissible disclosure | Revealing PHI without authorisation, including confirming publicly that someone was a patient |
Business associate | A vendor that creates, receives, maintains or transmits PHI on your behalf |
Business associate agreement | The contract required before that vendor handles PHI, covering safeguards, breach reporting and subcontractor flow-down |
Authorisation | Signed patient permission, required before using PHI for marketing. A cookie banner is not one |
Since the 2013 Omnibus Rule, business associates are directly liable to OCR rather than only contractually liable to you. That matters when choosing marketing vendors, because their exposure is real and so is yours.
Where GEO tactics touch the rules
Tactic | The issue | Approach |
|---|---|---|
Responding to reviews | Confirming a patient relationship is a disclosure | Do not respond substantively. See the next section |
Publishing testimonials | PHI used for marketing | Signed authorisation before publication |
Case studies and outcomes | Same, plus advertising claims | Authorisation, plus review of the claim itself |
Directory and profile updates | None. This is practice information | Proceed freely |
Physician bios and credentials | None. This is provider information | Proceed freely |
Clinical content | Accuracy and YMYL standards rather than privacy | Clinical review before publishing |
Analytics and tracking scripts | Potential disclosure to vendors without a BAA | Audit; see the analytics section |
Chat widgets collecting symptoms | Likely PHI handling | BAA and configuration review before deploying |
Four of eight rows are unblocked. That is the practical insight: a substantial part of healthcare GEO raises no privacy questions at all, and it happens to be the part that drives referral recommendations.
How to sequence around this
Start the compliance review for reviews, testimonials, analytics and chat in week one, then spend the following weeks on the unblocked rows. By the time review completes you have shipped the entity work and have evidence to support the rest.
That sequencing is the difference between a healthcare GEO programme that produces something in a quarter and one that waits on legal and produces nothing.
Reviews: the central tension
Reviews drive local AI recommendations more than almost anything else. They are also where healthcare marketing most often creates privacy exposure. This tension sits at the centre of healthcare GEO and it has a clean resolution.
The enforcement record
In June 2023 OCR announced a settlement with Manasa Health Center, a New Jersey psychiatric practice, resolving allegations that it impermissibly disclosed protected health information in public responses to negative online reviews, affecting four patients. The settlement was $30,000.
OCR has also instructed practices to remove review responses it considered impermissible disclosures. The pattern is consistent: a public response confirming or discussing someone's care is a disclosure, whether or not the patient disclosed it first.
The asymmetry people miss
Patients are not bound by HIPAA. You are. A patient can post anything about their care publicly; you cannot confirm it.
This feels unfair to practices facing an unfair review and it is simply the rule. A response that says we have no record of this visit is itself a statement about records, and a response that explains what actually happened in the appointment is a disclosure.
The rule that resolves it
Ask for reviews. Never confirm anyone was a patient.
Do | Do not |
|---|---|
Ask every patient for a review, in whatever way your policy permits | Respond to a review in a way that confirms treatment |
Post a generic policy response that discusses no specifics | Explain, dispute or correct the facts of a visit |
Invite the person to contact the practice privately | Say you have no record of them |
Build volume and recency through the ask | Incentivise or edit reviews |
Train front-desk staff on the boundary | Let a marketing vendor respond on your behalf without a BAA and training |
The generic response pattern
If your policy permits any response at all, keep it free of any acknowledgement of a relationship. Something that thanks people for feedback generally, states a commitment to patient experience, and gives a phone number for anyone wishing to discuss a concern, with no reference to the reviewer's situation.
Many compliance teams prefer no response at all. That is a defensible position and some guidance recommends it outright.
Why this still works for AI visibility
Review volume and recency are what influence local AI recommendations, and both come from asking rather than from responding. The constraint costs you almost nothing on the thing that actually matters.
Build a documented request process, have your privacy officer approve it once, and the recurring risk becomes a routine.
Testimonials and outcome claims
Patient stories are powerful corroboration and they are PHI used for marketing, which means authorisation before publication rather than consent in principle.
What authorisation requires
A signed HIPAA authorisation, obtained before use, specific about what is being disclosed, to whom, and for what purpose. A verbal yes, a consent clause buried in intake paperwork, or a cookie banner are not authorisations.
Element | Why |
|---|---|
Written and signed | Verbal permission does not meet the standard |
Specific about the disclosure | Blanket permission is not valid |
States the purpose, including marketing | Marketing use must be named |
Includes the right to revoke | Required element |
Retained on file | You will need to show it |
This applies to written testimonials, video, before-and-after photographs and case studies. Photographs are worth flagging because an image alone can identify a person connected to your care.
Clinical outcome claims
The source material for this article recommended publishing clinical outcomes as authority signals. That carries two layers of exposure beyond privacy.
Outcome claims in healthcare advertising are regulated by state medical boards and by the FTC, and a result presented without context about typicality can mislead. A survival rate or success rate quoted without the population it applies to is the kind of claim that invites scrutiny.
There is also a retrieval-specific problem. An assistant may quote your outcome sentence without the surrounding context or any qualifier. Write every outcome statement so that it remains accurate and non-misleading when read entirely on its own, because retrieval strips context by design.
What to publish instead, or alongside
Safer signal | Why it works |
|---|---|
Physician credentials, board certifications, fellowships | Verifiable, no PHI, strong entity corroboration |
Procedure volumes at practice level | Institutional rather than patient-level |
Accreditations and quality programme participation | Third-party verifiable |
Research, publications and teaching roles | Genuine authority, publicly checkable |
Technology and techniques available | Factual service information |
These produce most of the authority benefit of outcome claims with none of the privacy exposure, and they are easier to corroborate across sources, which is what helps an assistant name you confidently.
The process to build once
An authorisation form approved by your privacy officer, a storage location, a named owner, and a rule that nothing patient-specific publishes without a form on file. Build it once and testimonials stop being a recurring question.
Provider entity data
This is the highest-return work in healthcare GEO and it raises no privacy questions, because none of it is patient information. It is also where most health systems have the worst data, because provider records accumulate across hiring, credentialing, insurance contracting and marketing without anyone owning consistency.
The sources that matter
Source | Why it matters | Cost |
|---|---|---|
Google Business Profile | Strongest structured source for location identity; feeds Gemini and AI Overviews | Free |
NPI registry | Authoritative provider identity; widely referenced downstream | Free, already exists |
State medical board listings | Licence verification | Free, already exists |
Healthgrades, Vitals, WebMD Care | Heavily referenced provider directories | Free to claim |
Zocdoc | Strong for specialties with direct booking | Varies |
Insurance network directories | Patients filter by coverage first | Included in contracting |
Hospital affiliation listings | Corroborates provider to institution | Free |
Bing Places and Apple Business Connect | Different assistants, different data | Free |
Where the inconsistency comes from
Source of drift | Typical symptom |
|---|---|
Providers who left | Still listed at your locations |
Providers who joined | Still listed at a previous employer |
Name variants | Middle initials, maiden names, credentials appended differently |
Specialty labels | Taxonomy codes versus plain language versus marketing terms |
Location changes | Old suite numbers persisting in directories |
Multiple locations | Which provider is at which site, on which days |
Phone numbers | Call tracking creating deliberate inconsistency |
That last one is self-inflicted and common. Different numbers per directory is exactly the inconsistency that makes models hedge. Keep one consistent primary number in structured fields.
The audit
Build a grid: providers down the side, directories across the top, checking name, specialty, locations, credentials, affiliations and phone against one canonical record.
For a system with fifty providers this takes a few days and typically finds a surprising number of errors, including providers listed who no longer work there. It is unglamorous, it needs no approvals, and it does more for referral visibility than a quarter of content.
Who should own it
Name someone. Provider data sits between credentialing, HR, contracting and marketing, which means in practice nobody owns it and it drifts continuously.
A named owner and a quarterly review is the whole governance requirement, and it is the single most effective thing a health system can do here.
Physician bios and schema
Patients ask for a person. Physician bio pages are where an assistant connects a named provider to a specialty, a location and a set of credentials, which makes them the most important pages on a health system site for referral visibility.
What a retrievable bio contains
Element | Why it helps |
|---|---|
Full name matching NPI and board records | Entity matching across sources |
Specialty and subspecialty in plain language | Patients do not search taxonomy codes |
Board certifications with the certifying body | Verifiable credential |
Medical school, residency, fellowship with years | Corroborates against other sources |
Hospital affiliations | Links provider to institution |
Locations with addresses and days | Answers the proximity half of the question |
Conditions and procedures treated | How patients describe their need |
Languages spoken | Frequently a filter in real queries |
Insurance accepted | Often the first filter patients apply |
A plain opening sentence | The extractable passage |
The opening sentence
Most physician bios open with a narrative about a calling to medicine. Replace it with a direct sentence naming the specialty, the conditions treated, and the location.
That sentence is what gets lifted into an answer. A bio whose first fifty words are biography has nothing for an assistant to quote.
Plain language over taxonomy
Patients say heart doctor, stomach problems, knee replacement. Models match conversational phrasing. Include both the clinical term and the plain-language version naturally in the text, so the page connects to how the question was actually asked.
Schema
Type | Where |
|---|---|
| Each provider bio |
| Organisation level |
| Each location |
| Within provider markup |
| Condition and procedure question pages |
Schema.org has a developed medical vocabulary and healthcare is one of the verticals where it genuinely helps, because the entity relationships are complex and worth stating explicitly. Validate everything with the Rich Results Test.
Keep the structured data consistent with the visible page and with your NPI and board records. Schema that disagrees with authoritative sources makes the situation worse rather than better.
The maintenance obligation
Provider rosters change constantly. A bio for a physician who left six months ago is actively harmful, since it sends patients toward someone who is not there and undermines the consistency of everything else.
Tie bio updates to your credentialing and onboarding workflow rather than to marketing's content calendar, which is the only version of this that survives contact with reality.
Content and the YMYL standard
Health content is held to a higher standard than almost any other category, by search engines and by readers. Google's quality guidance treats topics that could affect health, safety or wellbeing as requiring particular scrutiny of expertise and trustworthiness.
What that means practically
Requirement | How to meet it |
|---|---|
Named clinical authorship or review | A real physician, named, with credentials and a linked bio |
Visible review date | Clinical information ages; show when it was last checked |
Citations to primary sources | Clinical literature, guidelines, government health sources |
Clear scope limits | What the page does and does not address |
Appropriate care-seeking guidance | When to see someone, and when to seek urgent care |
The medical reviewer byline is not decoration. It is a verifiable credential signal that corroborates across your provider entity data, which is exactly the kind of connection that helps an assistant trust the source.
What to write
Symptom-level and condition-level questions in the words patients use, each on its own page, opening with a direct answer.
Generic, saturated | Specific, winnable |
|---|---|
What is atrial fibrillation? | How long does an atrial fibrillation ablation take to recover from? |
Knee replacement information | What can I do at six weeks after a knee replacement? |
About our cardiology department | Which cardiac tests require fasting, and for how long? |
Diabetes care | How soon after a type 2 diagnosis should I see an endocrinologist? |
The right column reflects how people actually ask, has far fewer competitors, and can be answered specifically by clinicians who do this work daily.
The AI-drafted content question
If you use AI tools to draft clinical content, the clinical review step is not optional and it is heavier here than in any other vertical. Models produce confident, plausible, incorrect medical statements, and a wrong dosage, timeframe or red-flag symptom on a health system site can cause direct harm.
Treat generated clinical content as a first draft requiring physician review before publication, with the reviewer named on the page. Budget for that review properly rather than treating it as a bottleneck.
The maintenance obligation
Clinical guidance changes. A page reflecting superseded guidance is worse than no page, and it will be quoted confidently by assistants that cannot tell it is stale.
Set a review cycle by content type, assign clinical owners, and display the last-reviewed date. Budget roughly 20% of content capacity for review and updating, which is higher than other verticals and appropriate here.
Analytics and tracking scripts
Every GEO guide says connect Google Analytics. In healthcare that instruction needs qualification, and this is an area where the risk is frequently overstated in one direction and understated in another. Here is the accurate version.
General information, not legal advice.
What OCR has said
OCR issued guidance in December 2022, updated in March 2024, stating that tracking technologies on healthcare sites can disclose protected health information to vendors without authorisation. The guidance addressed pixels and analytics scripts on both authenticated and unauthenticated pages.
In June 2024 a federal court vacated part of that guidance, specifically the portion covering certain metadata on unauthenticated public pages. Pixels on logged-in pages, and on pages that actually collect health details, remain exposed, and private litigation was never affected by the ruling.
The state of enforcement, stated precisely
As of late 2026, OCR has not announced an enforcement action premised specifically on website tracking technologies. That is worth saying plainly, because a great deal of marketing content in this space implies otherwise.
What has happened instead is substantial private litigation and state-level action, including cases naming analytics deployments at health systems. The exposure is real; it has simply arrived through a different route than most articles suggest.
What to audit
Check | Why |
|---|---|
Third-party scripts on appointment and symptom-checker pages | These pages collect health details |
Scripts on patient portal and logged-in pages | Highest exposure |
Call tracking scripts | Can transmit identifiers alongside care context |
Ad platform pixels | Meta, Google Ads and similar |
What identifiers each transmits, and to whom | OCR's framing is about knowing where data flows |
Whether any vendor involved will sign a BAA | Google does not offer one for Google Analytics |
The practical approach
Many health systems run general analytics on marketing pages and remove third-party tracking entirely from appointment flows, symptom tools and portals. Server-side tracking and analytics vendors that sign business associate agreements are the common alternatives.
This is a decision for your privacy officer rather than your marketing team, and it needs making deliberately rather than inherited from whoever installed the tag.
What you can always use
Google Search Console, which reports aggregate query and impression data about your pages rather than individual user behaviour, including the generative AI performance report. Your own server logs. Google Business Profile insights.
Those cover most of what a GEO programme needs to measure, and they do not raise the same questions.
Chat widgets and symptom collection
AI chat assistants are commonly bundled with marketing platforms and sold to healthcare organisations as after-hours intake. In this vertical they are the highest-risk item in the stack and the one most likely to be switched on without review.
Why they are different here
A chat widget on a health system site will be told symptoms. Patients volunteer clinical detail readily, whether or not you asked for it.
The moment that happens, your vendor is receiving information about a person's health in connection with your organisation. That is a business associate relationship, requiring an agreement with specified terms before the data moves.
The questions to answer before deploying
Question | Why it matters |
|---|---|
Will the vendor sign a business associate agreement? | Required before PHI flows. Many consumer-grade tools will not |
Where is conversation data stored, and for how long? | Retention and safeguards are BAA terms |
Who are the subcontractors, including model providers? | Flow-down obligations apply to them too |
Is transcript data used for model training? | Needs explicit exclusion in writing |
Can it be configured to refuse clinical questions? | Reduces both PHI collection and advice risk |
What happens to transcripts on termination? | Return or destruction is a required term |
The configuration that reduces risk
Clear disclosure that it is an automated assistant, not a clinician.
An explicit statement not to share medical details in the chat.
Scope restricted to locations, hours, specialties, directions and appointment requests.
A refusal pattern for clinical questions, routing to a phone number or scheduling.
Prominent emergency guidance directing anyone describing urgent symptoms to call emergency services.
Minimal retention, with a documented policy.
Nothing in the transcript flowing to analytics or ad platforms.
The emergency case
This deserves separate attention. Someone describing chest pain to a website chat widget at two in the morning is a foreseeable scenario, and the correct behaviour is immediate, unmissable direction to emergency services rather than a scheduling flow.
Test that case explicitly before launch. If the widget responds to acute symptom descriptions by offering an appointment next Tuesday, it is not ready.
The honest recommendation
For most practices a clear contact form with stated response times, plus prominent emergency guidance, is lower risk and performs comparably. A chat assistant earns its place when after-hours volume is genuinely high, the vendor signs a BAA, and the configuration above is actually implemented and tested.
If you deploy one, your privacy officer reviews the configuration before launch rather than after. This is the single item in a healthcare GEO programme most capable of causing a reportable incident.
Measuring it
Manual checking costs nothing, raises no privacy questions and works until you are tracking roughly fifty prompts. For a single practice or small group that is indefinitely.
The manual check
Ask ten questions your patients ask, twice each, across ChatGPT, Gemini and Perplexity. Record whether your organisation or providers were named, how they were described, and who appeared instead.
For a practice the questions look like:
Best [specialty] in [your city]
Who should I see for [common condition] in [your city]
[Specialty] accepting new patients near [area]
Is [provider name] a good [specialty]
[Your organisation] vs [main local competitor]
[A condition question you have published about]
That last one tests whether your clinical content earns citations, which is separate from whether your providers get recommended.
What the answers tell you
What you see | What it means | What to do |
|---|---|---|
Not named at all | Not in the directories being used | Provider entity audit first |
Named with wrong specialty or location | Your records disagree across sources | Fix consistency |
Provider named but not your organisation | Affiliation is unclear | Strengthen affiliation data and schema |
Named among many | Present but undifferentiated | Reviews, and sharper specialty descriptions |
Competitors cited on your clinical topics | They answered better | Read the page, write a better one |
Free tools that raise no questions
Tool | What it gives you |
|---|---|
Google Search Console | Query data plus the generative AI performance report |
Google Business Profile insights | Calls, direction requests, profile views by location |
Server logs | Which AI crawlers reached you |
Manual prompt checks | AI visibility, twenty minutes monthly |
When to pay
Past about fifty prompts, or when tracking multiple locations, service lines or employed provider groups separately. A large system will cross that quickly; a single practice may never.
If you do buy, the vendor question applies: will they sign a business associate agreement, and do they need to? A tool that only samples public AI answers about your brand is generally not handling PHI, but confirm rather than assume.
The measure that matters most
Ask new patients how they found you and record it. Attribution from AI referrals is difficult technically, and intake is where the honest signal lives. Adding one question to your intake script will teach you more in a quarter than any dashboard.
A 90-day plan
Sequenced so the unblocked work ships while compliance review runs in parallel. That ordering is what makes a healthcare programme produce something in the first quarter.
Days 1 to 30: start reviews, do the unblocked work
Week | Work | Owner |
|---|---|---|
1 | Submit reviews, testimonials, analytics and chat to privacy review | Marketing lead |
1 | Run the manual AI check; record results | Anyone |
1 | Name an owner for provider entity data | Marketing lead |
2 | Complete Google Business Profile for every location | Location managers |
3 | Build the provider grid; audit against NPI and board records | Entity owner |
4 | Begin fixing directory inconsistencies | Entity owner |
Days 31 to 60: bios, schema and content foundations
Week | Work | Owner |
|---|---|---|
5 | Rewrite bio openers as direct specialty and location statements | Marketing, with providers |
6 | Add | Web team |
6 | Check crawler access in server logs | Web team |
7 | List the 20 questions patients actually ask at intake | Front desk and call centre |
8 | Publish the first three, with named clinical review | Marketing and clinical reviewer |
Days 61 to 90: reviews process, measurement, decisions
Week | Work | Owner |
|---|---|---|
9 | Implement the approved review request process; train staff | Practice managers |
10 | Act on the analytics review findings | Web team and privacy officer |
11 | Publish three more clinical question pages | Marketing and clinical |
11 | Add the AI question to intake scripts | Front desk |
12 | Re-run the manual check; compare with week 1 | Anyone |
What you will have at day 90
Accurate provider data across the directories assistants actually use, retrievable bios with valid schema, six clinically reviewed question pages, a compliant review request process, resolved analytics decisions and a measured before-and-after.
Honest expectation setting
The provider entity work can affect referral answers within weeks. Content and review velocity compound over quarters. In a competitive specialty in a major metro, ninety days builds the foundation rather than the result.
The compliance reviews started in week one may not all return within the quarter. That is why they start in week one, and why the plan does not depend on them to produce progress.
Seven mistakes healthcare marketers make
1. Responding to patient reviews. OCR settled with a New Jersey practice in 2023 over PHI disclosed in responses to negative reviews. A response that confirms, disputes or explains someone's care is a disclosure. Ask for reviews; never confirm anyone was a patient.
2. Publishing testimonials without signed authorisation. Verbal permission and an intake-form clause are not HIPAA authorisations. This includes photographs, which can identify a person connected to your care on their own.
3. Starting with content instead of provider data. Referral answers come from NPI records, board listings, directories and your Business Profile. A health system publishing weekly while listing physicians who left two years ago has the sequence backwards.
4. Deploying a chat widget without a BAA. Patients volunteer symptoms to chat widgets whether or not you ask. That makes the vendor a business associate, and many consumer-grade tools will not sign an agreement.
5. Inheriting the analytics setup. Third-party scripts on appointment flows and symptom tools are the exposure, and Google does not sign business associate agreements for Google Analytics. This needs a deliberate decision by your privacy officer, not whoever installed the tag.
6. Publishing AI-drafted clinical content without physician review. Models produce confident, wrong medical statements. On a health system site a wrong timeframe or missed red-flag symptom can cause direct harm, and the named clinical reviewer is what makes the content trustworthy anyway.
7. Letting clinical content go stale. Guidance changes, and an assistant will quote a superseded page confidently. Budget around 20% of content capacity for clinical review and updating.
The pattern
Five of seven are compliance issues that generic GEO advice would never raise, and every one of them is easy to walk into by following general marketing guidance competently.
That is the argument for the sequencing in this article: start compliance reviews immediately, and spend the waiting time on the provider entity work, which is unblocked and happens to be the highest-return activity available.
The one to fix first
Mistake three. The provider entity audit needs no approvals, raises no privacy questions, costs nothing but days, and is what referral questions are actually answered from. Most health systems have never done it properly.
FAQs
What is GEO for healthcare?
Generative engine optimisation for providers: making your organisation and physicians retrievable so AI assistants name them when patients ask for care. In practice it is local entity work across NPI records, state boards, provider directories and your Google Business Profile, plus clinically reviewed content, within HIPAA constraints.
Can we respond to patient reviews?
Not substantively. OCR settled with a New Jersey practice in 2023 over protected health information disclosed in responses to negative reviews. A response confirming, disputing or explaining someone's care is a disclosure. Many compliance teams advise not responding at all.
Can we publish patient testimonials?
With a signed HIPAA authorisation obtained before publication, specific about what is disclosed and naming marketing as the purpose. Verbal permission and intake-form clauses do not meet the standard. The same applies to photographs and video.
Does HIPAA apply to our marketing vendors?
If a vendor creates, receives, maintains or transmits protected health information on your behalf, it is a business associate and needs an agreement in place before data moves. Business associates have been directly liable to OCR since the 2013 Omnibus Rule.
Can we use Google Analytics on our website?
It requires a deliberate decision. OCR guidance addresses tracking technologies disclosing PHI, a 2024 ruling vacated part of it for certain unauthenticated pages, and Google does not sign business associate agreements for Analytics. Audit scripts on appointment, symptom and portal pages specifically.
Should we put an AI chat widget on our site?
Only with a business associate agreement and careful configuration, because patients volunteer symptoms regardless of what you ask. For most practices a contact form with stated response times and prominent emergency guidance is lower risk and performs comparably.
Why are we not recommended despite ranking on Google?
Usually inconsistent provider data across NPI records, board listings and directories, or providers listed who have left. SOCi's 2026 index found only about 45% overlap between businesses in Google's local pack and those AI assistants recommend.
Can we use AI to write clinical content?
As a first draft requiring named physician review before publication. Models produce confident, incorrect medical statements, and health content is held to higher quality standards. The named clinical reviewer is also what makes the page trustworthy to readers and engines.
Getting your practice into AI recommendations
Submit reviews, testimonials, analytics and chat to compliance review in week one. Then spend the quarter on provider entity data, which needs no approvals and is what referral answers are actually built from.
That sequencing is the whole method. Healthcare programmes stall because everything waits on legal; this one ships the unblocked work while review runs.
When to buy nothing
Provider data is inconsistent across directories. Fix that first. It costs days, raises no privacy questions and outperforms any subscription.
You have not run the manual check. Twenty minutes tells you where you stand.
Under fifty tracked prompts. A spreadsheet is sufficient and more honest than most dashboards.
No clinical reviewer available. Without one, content production creates risk rather than visibility.
Where tooling helps
Once provider data is clean and clinical review capacity exists, the constraint becomes producing enough reviewed content. Blazly SEO covers research, planning, drafting and publishing from about $39 a month.
In healthcare, build the clinical review step into the workflow explicitly and confirm with any vendor whether they will handle PHI and whether a business associate agreement is required. A content tool that only drafts marketing pages generally does not touch PHI, but confirm rather than assume, and keep patient information out of general-purpose AI tools entirely.
Summary
GEO for healthcare is local AI visibility work wrapped in HIPAA. Referral recommendations come from provider directories, NPI and board records, your Google Business Profile and reviews rather than from your blog, and that entity work is unblocked, free and where most systems have the worst data. Ask for reviews but never confirm anyone was a patient, because responding to a patient review has produced an OCR settlement. Get signed authorisation before publishing any testimonial or photograph. Treat chat widgets and tracking scripts as privacy decisions rather than marketing ones, and require a business associate agreement wherever a vendor touches patient information. Put a named physician reviewer on every clinical page, and date it.