Healthcare SEO: YMYL, Provider Pages and HIPAA
Healthcare SEO, often called medical SEO, is the work of making a practice, clinic or health system the source patients find when they search for a condition, a treatment or a provider: in Google’s results and map pack, and in the answers AI assistants give. It is harder than most SEO for three reasons. Google holds health content to its highest trust standard, patients choose clinicians rather than organizations, and privacy law restricts the tracking and remarketing tools most marketers rely on.
This guide is for marketing leads at practices, clinics and health systems, and for the agencies that support them. Dental practices have their own guide in SEO for dentists, which covers HIPAA-safe review replies in detail; related specialties include med spa SEO and SEO for therapists.
On this page
- What is SEO in healthcare?
- Why YMYL raises the bar for medical content
- Medical review bylines and MedicalWebPage markup
- Provider pages as entities
- Do tracking pixels on a healthcare website break HIPAA?
- Local visibility for clinics and departments
- How do AI assistants answer health and provider questions?
- Where healthcare SEO goes next
What is SEO in healthcare?
SEO in healthcare means earning visibility for three kinds of search: condition and treatment questions, provider searches, and local care searches. Each needs a different kind of page, and all three depend on trust.
The local volume alone is large. In Google Ads keyword data we pulled through DataForSEO in September 2026, “urgent care near me” averaged about 4.09 million US searches a month. Those searches are decided mostly by map listings. Condition searches are decided by content quality and authority. Provider searches, such as a doctor’s name or “cardiologist accepting new patients”, are decided by provider pages and third-party profiles.
The thread through all three is that patients, Google and AI engines need to know who is behind the information and whether they are qualified. The diagram below shows the layers of trust a healthcare site has to make visible.
Scroll the diagram sideways to see all of it.
Why YMYL raises the bar for medical content
Health is the clearest case of what Google calls Your Money or Your Life content, and Google says its systems weight trust signals more heavily for it. Google’s guidance on creating helpful content says its systems give “even more weight to content that aligns with strong E-E-A-T for topics that could significantly impact the health, financial stability, or safety of people,” and that “of these aspects, trust is most important.” The same page says E-E-A-T itself “isn’t a specific ranking factor.” It is a description of what the ranking systems try to reward, not a checkbox.
The 2024 leak of Google’s internal API documentation shows health classification in practice. It includes PerDocData.ymylHealthScore, which “stores scores of ymyl health classifier,” and a field named nsrIsCovidLocalAuthority in the same module. Google stores these attributes; the leak does not show how much they are weighted. iPullRank’s analysis describes the YMYL health and news classifiers in more detail, and our Google leak explainer covers what the documents do and do not prove.
In practice, that means medical content from a practice has to beat, or at least match, the big health publishers on accuracy and clarity, and it has an advantage they lack: first-hand clinical experience at a real, local practice. Our guide to E-E-A-T covers how to show it.
Medical review bylines and MedicalWebPage markup
Every clinical page should name a qualified author or reviewer, show when it was last reviewed, and cite its sources, in visible text and in markup. A medical review byline is only useful if it is true: the named clinician actually read and approved the page.
Schema.org gives you the vocabulary. The MedicalWebPage type describes “a web page that provides medical information,” and the WebPage properties it inherits include lastReviewed, the “date on which the content on this web page was last reviewed for accuracy and/or completeness,” and reviewedBy, the “people or organizations that have reviewed the content.” The table below maps healthcare page types to the markup we recommend.
| Page type | Schema type | Key properties |
|---|---|---|
| Condition or treatment page | MedicalWebPage | reviewedBy (Person), lastReviewed, author, about |
| Clinician bio page | Person (with Physician for a solo practice) | jobTitle, hasCredential, medicalSpecialty via the practice, worksFor, sameAs |
| Practice or clinic location | MedicalClinic, Physician or another MedicalBusiness subtype | address, telephone, openingHoursSpecification, isAcceptingNewPatients |
| Health system | MedicalOrganization or Hospital | department, subOrganization, sameAs |
A workable review process for a busy practice: clinicians review each clinical page once a year and whenever guidance changes, the reviewer and date update only when a review actually happens, and every page links to the primary sources it relies on, such as specialty society guidelines or government health agencies. Our guide to Person schema for author entities covers the markup side.
Provider pages as entities
Provider pages are the pages patients use to choose, so each clinician should have one page that states who they are, what they treat, where they practice and whether they are taking new patients, in text and in structured data. They are also what AI engines and directories use to connect a name to a practice.
The schema.org Physician type describes “an individual physician or a physician’s office” and sits under MedicalBusiness and MedicalOrganization. It carries useful properties: medicalSpecialty, usNPI for the provider’s National Provider Identifier, isAcceptingNewPatients and hospitalAffiliation. The anatomy below shows how a provider page maps to that markup.
Scroll the diagram sideways to see all of it.
For groups and health systems, the hard part is data, not markup. Provider details live in credentialing systems, scheduling systems, directories and the website, and they drift. Pick one source of truth, generate provider pages and schema from it, and push the same data to directories. Our guides to entity SEO and Organization schema for AI search cover the entity side.
Do tracking pixels on a healthcare website break HIPAA?
They can. HHS guidance says tracking technologies on logged-in pages such as patient portals generally have access to protected health information, and that a 2024 court ruling narrowed only part of that position. Any HIPAA-covered practice should review every script on its site before adding more.
The current position, from the HHS page on use of online tracking technologies by HIPAA covered entities:
- Logged-in pages: tracking technologies on user-authenticated pages, such as patient portals or telehealth platforms, “generally have access to PHI.”
- Vendors: tracking vendors are business associates if they create, receive, maintain or transmit PHI on behalf of a covered entity, which requires a business associate agreement and a permitted disclosure.
- Public pages: tracking on many unauthenticated pages is not regulated by HIPAA, but tracking on an unauthenticated page “that permits individuals to schedule appointments or use a symptom-checker tool without entering credentials may have access to PHI in certain circumstances.”
- The court ruling: on June 20, 2024, in American Hospital Association v. Becerra, a federal court in Texas vacated the guidance to the extent it said HIPAA is triggered when technology connects an IP address with a visit to an unauthenticated page addressing specific health conditions or providers.
The decision tree below turns that into a first-pass check. It is not legal advice; involve your privacy officer.
Scroll the diagram sideways to see all of it.
For SEO measurement, this pushes practices toward first-party, aggregate analytics and away from ad pixels on clinical and scheduling pages. You can still measure what matters: organic sessions by page type, calls from the Business Profile, and booked appointments reported in aggregate by the scheduling system. Our guide on tracking AI traffic in GA4 and Search Console shows what can be measured without personal data.
Local visibility for clinics and departments
Local visibility for healthcare follows the same Google rules as any business, with two provisions that matter more here: practitioner profiles and department profiles. Google’s Business Profile guidelines name doctors as individual practitioners who may have their own profiles if they work in a public-facing role and can be contacted at the verified location during stated hours, and they allow titles such as “Dr.” or “MD”. Departments within hospitals “may have their own Business Profiles,” but each needs a distinct name and a category different from the main hospital’s.
Two more details. Google’s Local Services Ads setup guide lists primary care physicians as an eligible US category, but notes that booking leads are not available for health care verticals. And reviews matter across platforms: BrightLocal’s 2026 survey found that 97% of consumers read reviews for local businesses, that 74% look for reviews written in the last 3 months, and that Healthgrades was among the review sites whose use increased. Replies to reviews must never confirm someone is a patient; the HIPAA enforcement cases in our dentist guide apply to every provider.
How do AI assistants answer health and provider questions?
AI assistants answer health questions by retrieving and summarizing pages they trust, and answer provider questions from business, directory and review data. Being indexed and clearly reviewed is the entry ticket for the first; accurate provider data is the ticket for the second.
Patients already ask them. In KFF’s May 2026 tracking poll, 29% of US adults said they use AI tools or chatbots for health information and advice monthly, up from 17% in June 2024. For finding a provider, the same BrightLocal survey found that use of ChatGPT and other generative AI tools for local recommendations rose from 6% to 45% in a year.
Google says AI Overviews and AI Mode use a “query fan-out” technique across subtopics and data sources, and that there are “no additional requirements to appear in AI Overviews or AI Mode” beyond being indexed and eligible for a snippet, per its page on AI features and your website. OpenAI’s ChatGPT search help page says ChatGPT rewrites prompts into searches sent to third-party providers and uses approximate location for local results.
For a practice, that means:
- Write condition pages whose sections each answer one question in the first sentence, with a named reviewer. Our guide to appearing in Google AI Overviews covers structure.
- Keep provider data identical across your site, Google and the major health directories, so an assistant can state specialty, location and availability without hedging.
- Watch what assistants say about your providers and correct errors at the source.
Where healthcare SEO goes next
Healthcare SEO is moving toward verifiable trust at every layer: an organization entity that is consistent everywhere, provider pages built from one source of truth, clinical content reviewed and dated by named clinicians, and measurement that respects HIPAA rather than working around it. Those same assets are what AI engines draw on when patients ask them for care.
The work is as much process as marketing, and it goes faster with a plan that clinicians, compliance and marketing agree on. If you want help building that plan, including how your providers and content appear in AI answers today, our AI SEO service starts with that assessment.
Frequently asked questions
What is SEO in healthcare?
Healthcare SEO, also called medical SEO, is the work of making a practice, clinic or health system visible when patients search for care, conditions or providers, in Google's results, the map pack and AI answers. It differs from other SEO because health content is held to a higher trust standard, provider pages carry most of the weight, and privacy law limits the tracking most marketers take for granted.
Can a healthcare website use Google Analytics or Meta pixels?
Carefully. HHS guidance says tracking on patient portals and other logged-in pages generally has access to protected health information, and that vendors receiving it may be business associates. A June 2024 court ruling vacated part of that guidance for some public pages, but tracking on scheduling pages and symptom checkers can still involve PHI. Get a privacy review before adding any pixel.
How much does SEO cost for a hospital or health system?
It scales with the number of locations, providers and service lines, so there is no typical figure. A single clinic mainly needs profile, provider page and content work. A health system with hundreds of providers needs data management for provider profiles, a content review workflow with clinicians, and technical work across a large site.
Is SEO replaced by AI in healthcare?
No. AI Overviews, AI Mode and assistants like ChatGPT draw on pages that are indexed and trusted, and on business and provider data. Google says there are no special requirements beyond being indexed and eligible for a snippet. The work shifts toward clear, reviewed answers and accurate provider data rather than disappearing.
Which schema types should a medical practice use?
Use the most specific type that fits the organization, such as MedicalClinic, Physician or Dentist, all subtypes of MedicalBusiness. Mark up clinical content pages as MedicalWebPage with lastReviewed and reviewedBy, and use Person markup for each clinician, connected to the practice.
Should each doctor have a Google Business Profile?
Google allows it for individual practitioners in a public-facing role who can be contacted at the verified location during stated hours, and names doctors as an example. Practitioner profiles can include titles such as Dr. or MD. Decide deliberately, because they split reviews between the practice and the individual.