--- title: "Healthcare SEO: HIPAA checks and medical review." description: "Check your healthcare SEO for patient-data risks. Plan medical review, analytics exclusions, location pages, and review replies with counsel." canonical: "https://scalewithsearch.com/articles/seo-healthcare-compliance" date: "2026-03-20" modified: "2026-09-25" --- ## Site navigation - [Scale With Search](https://scalewithsearch.com/) - Real estate - Real estate - [Real estate](https://scalewithsearch.com/for/real-estate) - Work - Start here - [Send your brief](https://scalewithsearch.com/work#send-your-brief) - [Prepare your six-question brief](https://scalewithsearch.com/work#prepare-your-six-question-brief) - Build - [Site build, content library with SEO, signal desk](https://scalewithsearch.com/work) - For your business - Trades and home services - [Auto body and collision shops](https://scalewithsearch.com/for/auto-body-and-collision-shops) - [Foundation and home repair contractors](https://scalewithsearch.com/for/foundation-and-home-repair) - [Garage door and fencing contractors](https://scalewithsearch.com/for/garage-door-and-fencing-contractors) - [HVAC contractors](https://scalewithsearch.com/for/hvac-contractors) - [Janitorial and commercial cleaning companies](https://scalewithsearch.com/for/janitorial-and-commercial-cleaning) - [Locksmiths](https://scalewithsearch.com/for/locksmiths) - [Moving companies](https://scalewithsearch.com/for/moving-companies) - [Pest control companies](https://scalewithsearch.com/for/pest-control-companies) - [Plumbing and electrical contractors](https://scalewithsearch.com/for/plumbing-and-electrical-contractors) - [Restoration and water or fire damage companies](https://scalewithsearch.com/for/restoration-and-water-fire-damage) - [Roofing companies](https://scalewithsearch.com/for/roofing-companies) - [Towing companies](https://scalewithsearch.com/for/towing-companies) - [Tree services and landscaping companies](https://scalewithsearch.com/for/tree-services-and-landscaping) - [Solar installers](https://scalewithsearch.com/for/solar-installation) - [General contractors](https://scalewithsearch.com/for/general-contractors-and-construction) - [Paving, concrete, and flooring contractors](https://scalewithsearch.com/for/paving) - Practices and professional services - [Bookkeeping and tax practices](https://scalewithsearch.com/for/bookkeeping-and-tax-practices) - [Dental practices](https://scalewithsearch.com/for/dental-practices) - [Family and criminal defense law firms](https://scalewithsearch.com/for/family-and-criminal-defense-law-firms) - [Med spas and aesthetics practices](https://scalewithsearch.com/for/med-spas-and-aesthetics) - [Personal injury law firms](https://scalewithsearch.com/for/personal-injury-law-firms) - [Veterinary clinics](https://scalewithsearch.com/for/veterinary-clinics) - [Gyms and fitness studios](https://scalewithsearch.com/for/fitness) - [Therapy and outpatient health practices](https://scalewithsearch.com/for/therapy-and-outpatient-health) - [Medical billing companies](https://scalewithsearch.com/for/medical-billing) - [Insurance agencies](https://scalewithsearch.com/for/insurance-agencies) - [Financial advisors](https://scalewithsearch.com/for/financial-advisors) - [Property management companies](https://scalewithsearch.com/for/property-management) - [Recruiting and staffing agencies](https://scalewithsearch.com/for/recruiting-and-staffing) - [Architects and interior designers](https://scalewithsearch.com/for/architects-and-interior-designers) - [Logistics and supply chain companies](https://scalewithsearch.com/for/logistics-and-supply-chain) - Agencies, MSPs, and manufacturing - [IT and managed service providers](https://scalewithsearch.com/for/it-and-managed-service-providers) - [Machine shops and precision manufacturers](https://scalewithsearch.com/for/machine-shops-and-precision-manufacturing) - [Marketing agencies and freelancers](https://scalewithsearch.com/for/marketing-agencies-and-freelancers) - [SEO agencies and consultants](https://scalewithsearch.com/for/seo-agencies-and-consultants) - [Small manufacturers and fabricators](https://scalewithsearch.com/for/small-manufacturers-and-fabricators) - Restaurants, shops, studios, and nonprofits - [Restaurants and hospitality businesses](https://scalewithsearch.com/for/restaurants-and-hospitality) - [Retail stores and ecommerce sellers](https://scalewithsearch.com/for/retail-and-ecommerce) - [Photographers, event planners, and travel agents](https://scalewithsearch.com/for/photographers) - [Churches and nonprofits](https://scalewithsearch.com/for/churches-and-nonprofits) - [All industries](https://scalewithsearch.com/for/) - Learn - For your office - [Office job guides](https://scalewithsearch.com/guides/) - [Browser calculators](https://scalewithsearch.com/tools/) - Start here - [How it works](https://scalewithsearch.com/how-it-works) - [Free Starter Kit](https://scalewithsearch.com/kit/business-memory-starter-kit.zip) - [Synthetic specimen](https://scalewithsearch.com/specimen/working-session-specimen.zip) - Guides - [The Complete Guide to Business Memory for AI Agents](https://scalewithsearch.com/articles/business-memory-for-ai-agents-guide) - [The Complete Small-Business Guide to AI Agent Governance](https://scalewithsearch.com/articles/ai-agent-governance-guide-small-business) - [The Complete Guide to Leaving Vendor AI Memory](https://scalewithsearch.com/articles/leaving-vendor-ai-memory-guide) - Articles by cluster - [Business memory](https://scalewithsearch.com/articles/business-memory-for-ai-agents-guide) - [Agent governance](https://scalewithsearch.com/articles/ai-agent-governance-guide-small-business) - [Migration and ownership](https://scalewithsearch.com/articles/leaving-vendor-ai-memory-guide) - For machines - [llms.txt](https://scalewithsearch.com/llms.txt) - [llms-full.txt](https://scalewithsearch.com/llms-full.txt) - [Machine view](https://scalewithsearch.com/?view=machine) - Company - Evidence - [Proof](https://scalewithsearch.com/proof) - Company - [About](https://scalewithsearch.com/about) # Grow patient search traffic without breaking HIPAA or medical content standards. You market a medical practice, a hospital, or a health technology service. Search could bring you patients at the moment they decide on care. Three constraints make healthcare SEO harder than SEO in most industries: - HIPAA limits how you handle patient information, and ordinary marketing tools can leak it. - Google holds medical content to its highest quality standard. - Large health publishers hold the top results for general health questions. This guide covers content standards, privacy in analytics and marketing tools, local search, patient education content, technical setup, paid search, and reputation. It is not legal advice. Take each privacy decision to healthcare compliance counsel. ## Meet Google's standard for medical content Google classifies health and medical content as Your Money or Your Life (YMYL). Wrong medical information can harm a reader who acts on it, so Google applies its strictest quality standard. Google evaluates health content with E-E-A-T: Experience, Expertise, Authoritativeness, and Trustworthiness. For a medical site, each element has a specific meaning: | Element | What it means for a health site | |---|---| | Experience | First-hand involvement in care: physicians who treat the condition, nurses who give patient care, administrators who run facilities. | | Expertise | Formal medical credentials, such as MD, DO, RN, or PA. | | Authoritativeness | External recognition: media citations, academic publications, professional awards. | | Trustworthiness | Clear organization details, a clear privacy policy, and visible privacy practices. | For the same standard in another YMYL sector, read [SEO for financial services](/articles/seo-financial-services-ymyl). ### Show author credentials on every page A name alone is not enough. Do not write "Written by Dr. Jane Smith". Write "Written by Jane Smith, MD, Board-Certified Cardiologist with 15 years treating cardiovascular disease at [Hospital Name]." Give each author a bio page with a professional photo, education, certifications, publications, and hospital affiliations. Where appropriate, link to credentials that a reader can verify, such as the NPI number or the state medical board record. ### Cite authoritative sources Support each claim about a treatment, medication, symptom, or outcome with a source. Use peer-reviewed research, government health agencies such as the NIH, CDC, or FDA, or established medical organizations. Write the citation clearly, for example: "According to a 2024 study published in the Journal of the American Medical Association...". Link to the original source, so the reader can verify it. ### Review content before publication Set up an editorial review in which a board-certified physician approves each health page before it goes live. Document the process. Many healthcare organizations show a "Medically Reviewed by [Name, Credentials]" label with a review date. The label shows that someone still checks the content. ### Do not promise results Do not write absolute claims such as "this treatment cures diabetes" or "you will lose 20 pounds". Individual health situations are too complex for a guarantee. Use qualified language: "Studies show this treatment may improve blood sugar control in some patients." When you state a typical range, add that results vary by patient. ## Keep patient data out of analytics and marketing tools HIPAA (the Health Insurance Portability and Accountability Act) restricts how providers handle patient information. Your SEO and analytics setup must not expose protected health information (PHI). The rules for tracking technology changed between 2022 and 2024. HHS issued guidance on online tracking in December 2022 and revised it in March 2024. In June 2024, a federal court in Texas vacated part of that guidance, and HHS withdrew its appeal in August 2024. Ask counsel how the current position applies to your site. ### Configure analytics so it cannot capture PHI A standard analytics setup on booking pages or a patient portal can capture PHI in URL parameters. This URL exposes a name and a condition: `healthcare.com/appointment?patient=JohnSmith&condition=diabetes`. Take these steps: 1. Remove PHI from URLs at the source. Do not put names, conditions, or record numbers in query strings. 2. Exclude sensitive URL parameters in the analytics configuration. 3. Do not place analytics tags on pages that contain PHI, such as patient portals and booking confirmations. 4. Consider server-side analytics that keeps data under your control and sends no PHI to a third party. Google states that it does not offer a Business Associate Agreement (BAA) for Google Analytics, including the paid Analytics 360 product. Do not plan on a BAA as the fix. GA4 does not log or store IP addresses, but that alone does not make it safe for pages with PHI. ### Use forms that meet HIPAA Contact forms, appointment requests, and symptom checkers that collect health information must use HTTPS. The data must go to a HIPAA-compliant CRM or electronic medical record system, not to an ordinary marketing platform. As of March 2026, Formstack and JotForm offered HIPAA-compliant form products with a BAA. ### Get a HIPAA authorization for testimonials A patient review that names a treatment or condition contains PHI. Before you publish or reuse it, get a signed HIPAA authorization. A general consent form does not replace it. Under [45 CFR 164.508](https://www.law.cornell.edu/cfr/text/45/164.508), a covered entity needs an authorization for a use or disclosure of PHI for marketing, with narrow exceptions. The same section defines the elements of a valid authorization. It must include: - A specific description of the information that you will use or disclose. - The person or class of persons who makes the disclosure, and the person or class of persons who receives it. - The purpose of each use or disclosure. - An expiration date or an expiration event. - The patient's signature and the date. - Statements of the right to revoke in writing, of whether treatment or payment can depend on the authorization, and of possible redisclosure by the recipient. Write the authorization in plain language, and give the patient a copy of the signed form. Ask healthcare counsel to review the form before you use it. The "no PHI" test applies only to the text of a review. A generic review, such as "Great doctor, very professional", names no treatment or condition. The reviewer's name next to your practice can still show a patient relationship. Your response can disclose PHI even when the review does not. When you reply to a review, do not confirm that the reviewer is a patient, and do not mention a visit, a treatment, or a condition. To reuse any patient review in your marketing, get a signed authorization first. Many practices collect reviews on third-party platforms such as Google Business Profile and Healthgrades. The same reply rule applies on those platforms. ### Restrict retargeting An ad for diabetes treatment shown to a person who read your diabetes page can imply that person's condition. It exposes no PHI directly, but it creates an inference risk. Google's personalized advertising policy also restricts ads targeted on health conditions. Avoid condition-specific retargeting. Use broad awareness campaigns for the institution. Consult healthcare counsel before you run any retargeting. ### Check chat tools for a BAA A chat widget on a page where patients discuss health needs a BAA. Many standard chat tools do not sign one on their default plans. Check the vendor's current terms before you install it. Some vendors, such as OhMD and Luma Health, sell messaging built for healthcare. As an alternative, show chat only on general information pages, and keep it off condition pages and booking pages. ## Win local patient searches Patients who search "cardiologist near me" or "urgent care in [city]" need care soon. Local search brings these high-intent patients to a practice. ### Complete the Google Business Profile Claim and verify a profile for every location. Complete every section: - The official practice name, used the same way everywhere. - The correct address and phone number. - The website URL. - Hours, including holiday closures. - Medical specialties. Upload professional photos of the building exterior, reception area, and exam rooms. Add staff photos only with consent. List every condition you treat and every procedure you offer as a service. Use both medical terms and patient terms, such as "Coronary Artery Disease Treatment" and "Heart Attack Prevention". A complete service list matches more patient searches. For the full setup, read the [Google Business Profile optimization guide](/articles/google-business-profile-optimization). ### Ask for reviews correctly Patient reviews affect local rankings and patient choice. Ask satisfied patients for reviews in a post-visit email. Do not name a treatment or condition in the request. Reply to every review, positive and negative. A reply to a negative review acknowledges the concern and offers to resolve it offline. It never discusses patient details or confirms that the person is a patient. HHS has settled cases against providers who disclosed patient information in review replies. ### Build a page for each location A multi-location practice needs a separate page for each location. Separate pages also prevent keyword cannibalization. Each page needs: - The address and contact details. - Bios of the physicians at that location. - Unique text about the community it serves. - An embedded map, directions from local landmarks, and parking details. Write a unique description for each location. Do not copy text between location pages. ### Keep name, address, and phone consistent Use the same name, address, and phone number (NAP) on every listing: - Your website and Google Business Profile. - Health directories, such as Healthgrades, Vitals, and Zocdoc. - General directories, such as Yelp and the Better Business Bureau. - Social profiles. Inconsistent listings confuse search engines and weaken local rankings. ## Publish patient education content Education content makes you a trusted source. It also reaches patients while they research, before they book. ### Condition pages Target "what is [condition]" queries with a page for each condition. Use this structure: 1. Definition and overview. 2. Symptoms and warning signs. 3. Causes and risk factors. 4. Diagnosis. 5. Treatment options. 6. When to see a doctor. Target the long-tail variants too: "symptoms of [condition]" and "[condition] causes". ### Treatment and procedure pages Answer "what to expect" queries from patients who consider a procedure. Cover the overview, who needs it, preparation, the steps, recovery time, risks, expected outcomes, and cost and insurance information. A video of the facility and an explanation of the procedure answer patient questions before the visit. ### Symptom pages Pages such as "When to Worry About Chest Pain" or "Headache Types and When to See a Doctor" rank for symptom searches. They must guide the reader to the right next step without a diagnosis. Add a clear disclaimer, such as: "This information is educational only and doesn't constitute medical advice. See a healthcare provider for proper diagnosis." Then give a clear route to book an evaluation when the symptoms need one. ### Physician bio pages Bio pages rank for "best [specialty] near me" searches. Include credentials and education, board certifications, specialties, languages spoken, accepted insurance, patient reviews, a professional photo, and a video introduction. A physician who treats several conditions needs content about each condition on the profile page. ### Blog content Answer common patient questions. Topics include chronic condition management, lab results, insurance coverage, appointment preparation, care after treatment, and preventive health. Keep these posts educational, not promotional. Establish expertise before you ask for the appointment. ### Compete with national health publishers WebMD and Mayo Clinic hold the top results for general condition queries. They serve location-specific searches poorly. Target specific local and condition combinations, such as "cardiologist treating [condition] in [city]". Build depth in your specialties that a general publisher cannot match for niche conditions. Show the practicing physicians behind each page. That E-E-A-T signal carries weight against a general information site. ## Fix the technical base Healthcare sites often have slow pages from large medical images, deep structures that bury key information, and poor mobile layouts. Speed matters for users and rankings. Medical images, videos, and booking systems slow pages down. Lazy-load images below the fold. Compress images with a tool such as TinyPNG. Turn on browser caching, and serve media from a content delivery network (CDN). Aim for load times under 3 seconds on mobile and desktop. Mobile use matters for health searches. Patients research symptoms on phones during work breaks, on a commute, or late at night. Use a responsive design. Test the booking form on real phones, with mobile keyboards and small screens. Use HTTPS on every page, not only on forms and the patient portal. HTTPS is a ranking signal, and browsers warn users about sites without it. Add healthcare schema markup: - `MedicalOrganization` for practices and hospitals. - `Physician` for doctor bio pages. - `MedicalCondition` for condition pages. - `FAQPage` for question pages. Since August 2023, Google shows FAQ rich results only for well-known, authoritative government and health sites. Do not build booking as JavaScript only. Put core information, such as services, locations, and physicians, in crawlable HTML. Use progressive enhancement: the basic page works without JavaScript, and the booking widget adds interaction in capable browsers. ## Connect paid and organic search Many healthcare organizations spend heavily on paid search and neglect organic search. A combined plan lets you compare the acquisition cost of each channel on the same queries. For the general method, read [how SEO and paid search work together](/articles/seo-paid-search-synergy). Use paid search data to choose organic targets. If "knee replacement surgeon [city]" converts well in paid search, build a full organic page for the same query. Organic rankings reduce your dependence on paid spend. Build specific landing pages for paid campaigns, one per condition, procedure, or patient group. A specific page serves paid traffic well and can also rank organically. Protect branded searches with strong organic results. SEO cannot stop a competitor from bidding on your practice name. When your homepage and location pages hold the top organic results for your name, patients can click them instead of an ad. Shift the budget as organic rankings grow. A new practice with no organic presence needs paid search for visibility. Each month, check the Search Console position of every keyword that you also buy. When a page holds a stable top-3 organic position, test a lower paid bid on that keyword. Compare booked appointments from both channels for the next month. Move the saved budget to competitive keywords that still need paid support. Measure the timeline for your own site instead of assuming one. Before you start, record a baseline for your target queries: - Organic sessions and organic appointment requests, from Google Analytics. - Impressions, clicks, and average position, from Search Console. - The paid cost per booked appointment for the same queries. Compare each metric with the baseline every month. The first months go to technical work, content, and E-E-A-T signals, so early changes show first in impressions and positions. YMYL topics carry a higher quality bar, so do not borrow a timeline from another industry. Organic search costs less per patient only when its cost per booked appointment is below the paid figure. Include content, review, and SEO costs in the organic figure. ## Manage your reputation Reviews and listings affect patient decisions and local rankings. Monitor reviews and mentions on Google Business Profile, Yelp, Healthgrades, Vitals, RateMDs, and social media. Tools such as Reputation.com and Birdeye collect reviews from several platforms. Early detection lets you reply before a problem spreads. Reply to negative reviews within HIPAA. Acknowledge the concern, state your commitment to care, and invite offline contact. A template: "We're sorry to hear about your experience. Patient care is our priority. Contact our patient relations team at [number] so we can address your concerns directly." Ask for reviews systematically. Many patients leave a review only after a very good or very bad experience. Regular requests capture the moderate positive experiences too. Several recent positive reviews reduce the weight of older negative ones. Correct directory listings. Check the practice name, addresses, phone numbers, website URLs, and provider details on each health directory. Claim and manage your listings. Prepare a crisis plan. A malpractice case, a facility incident, or a regulatory action can bring negative press. Name the spokespersons, and approve statement templates in advance. Plan response content, such as press releases, blog posts, and patient stories. ---- ```text .|########||. .|########||. .|########||. |##||. .||##|. |##||. .||##|. |##||. .||##|. |#|. .|#|. |#|. .|#|. |#|. .|#|. |#| |#| |#| |#| |#| |#| .#| |#. .#| |#. .#| |#. .#. .#| .#. .#| .#. .#| |#. .#| |#. .#| |#. .#| |# ...... #| |# ...... #| |# ...... #| .# ||#########| #| .# ||#########| #| .# ||#########| #| .#. |######||######|. .#. .#. |######||######|. .#. .#. |######||######|. .#. #. .##|###|##|#|######| .# #. .##|###|##|#|######| .# #. .##|###|##|#|######| .# || |##|#||||||||||||#||#| || || |##|#||||||||||||#||#| || || |##|#||||||||||||#||#| || # |#||||||||||||||||||||#| #. # |#||||||||||||||||||||#| #. # |#||||||||||||||||||||#| #. || |#||||||||||||||||||||||#| || || |#||||||||||||||||||||||#| || || |#||||||||||||||||||||||#| || # .#||||||||||||||||||||||||#| # # .#||||||||||||||||||||||||#| # # .#||||||||||||||||||||||||#| # || ....|||#||||||##|#|||#|#||##||||....|. || || ....|||#||||||##|#|||#|#||##||||....|. || || ....|||#||||||##|#|||#|#||##||||....|. || #. . ....|# ....#||| ||| .#||| ....#. .# #. . ....|# ....#||| ||| .#||| ....#. .# #. . ....|# ....#||| ||| .#||| ....#. .# # . ||||#| .#####|| . .#| .#||| ||||# #. # . ||||#| .#####|| . .#| .#||| ||||# #. # . ||||#| .#####|| . .#| .#||| ||||# #. .| ||||| #. |#|||||. || #. |#||. .||||| || .| ||||| #. |#|||||. || #. |#||. .||||| || .| ||||| #. |#|||||. || #. |#||. .||||| || || |.... #. ....|#. |. ...|. ....|| || || |.... #. ....|#. |. ...|. ....|| || || |.... #. ....|#. |. ...|. ....|| || #. .||||||##||||||##||####|||||||#||||||#| .# #. .||||||##||||||##||####|||||||#||||||#| .# #. .||||||##||||||##||####|||||||#||||||#| .# # .||####|###########################|. # # .||####|###########################|. # # .||####|###########################|. # # .#||||||.#.|| # |. ..# #| #|||||#| # # .#||||||.#.|| # |. ..# #| #|||||#| # # .#||||||.#.|| # |. ..# #| #|||||#| # # .#|||||| .. |# ## |#| ...#|#|||#| # # .#|||||| .. |# ## |#| ...#|#|||#| # # .#|||||| .. |# ## |#| ...#|#|||#| # # .#|||#|# .# .#| #| ##|.#..#|||||#| # # .#|||#|# .# .#| #| ##|.#..#|||||#| # # .#|||#|# .# .#| #| ##|.#..#|||||#| # # .#||||||############|######|||||#| # # .#||||||############|######|||||#| # # .#||||||############|######|||||#| # # |...||#||||||#||||#|#||||||#|||||#||| |.| # # |...||#||||||#||||#|#||||||#|||||#||| |.| # # |...||#||||||#||||#|#||||||#|||||#||| |.| # #. .. ||||# .|||##|. |#| .|| || .|||#. #| # .# #. .. ||||# .|||##|. |#| .|| || .|||#. #| # .# #. .. ||||# .|||##|. |#| .|| || .|||#. #| # .# || | ...|| ...##| | #| .|. |. ##### .. .| || || | ...|| ...##| | #| .|. |. ##### .. .| || || | ...|| ...##| | #| .|. |. ##### .. .| || || ||||| || ||||#| . |. |. |#. ||||| |#| || || || ||||| || ||||#| . |. |. |#. ||||| |#| || || || ||||| || ||||#| . |. |. |#. ||||| |#| || || .# |.....#|....|#.||||.|||##.|#|....||.#||.#. #. .# |.....#|....|#.||||.|||##.|#|....||.#||.#. #. .# |.....#|....|#.||||.|||##.|#|....||.#||.#. #. #.|||||||#############################| ||| .# #.|||||||#############################| ||| .# #.|||||||#############################| ||| .# || ##||#||#||||||#||#||#||#||##. || || ##||#||#||||||#||#||#||#||##. || || ##||#||#||||||#||#||#||#||##. || # .#|||||||||#||#|||||||||||#| # # .#|||||||||#||#|||||||||||#| # # .#|||||||||#||#|||||||||||#| # || |#||||||||||||||||||||||#| || || |#||||||||||||||||||||||#| || || |#||||||||||||||||||||||#| || .# |#||||||||||||||||||||#| #. .# |#||||||||||||||||||||#| #. .# |#||||||||||||||||||||#| #. || |#||||||||||||||||||#| || || |#||||||||||||||||||#| || || |#||||||||||||||||||#| || #. .######|#|#########| .# #. .######|#|#########| .# #. .######|#|#########| .# .#. |#####||||#####| .#. .#. |#####||||#####| .#. .#. |#####||||#####| .#. |# ||########|| #. |# ||########|| #. |# ||########|| #. |# ...... #| |# ...... #| |# ...... #| |#. .#| |#. .#| |#. .#| |#. .#. |#. .#. |#. .#. .#| |#. .#| |#. .#| |#. |#| |#| |#| |#| |#| |#| .|#|. .|#|. .|#|. .|#|. .|#|. .|#|. |##||. .||##| |##||. .||##| |##||. .||##| .||########||. .||########||. .||########||. Scale With Search 2026 [scalewithsearch.com](https://scalewithsearch.com) ```