AEO for healthcare practices: being the clinic the engine recommends, within HIPAA

Last updated October 14, 2026. Written by the Third Coast AI team.

Answer engine optimization for a medical, dental or specialty practice is the work of getting the practice and its named providers recommended when a patient asks ChatGPT, Google AI Overviews and AI Mode, Gemini, Perplexity and Copilot who to see for a specific problem, in a specific place, with a specific insurance plan, and it is won on provider and service pages that state those facts plainly, on a Healthgrades and Google record that agrees with them, and on never using patient information to do any of it. We wrote this page for the independent practices and clinic groups of West Michigan, where we meet clients in person, and the mechanics apply to a practice anywhere, with your own state's rules layered on top of HIPAA.

Health is the category where the engines answer most readily. Semrush's September 2024 sample of 100,000 desktop keywords put health among the top three categories triggering AI Overviews, and a patient who asks "orthopedic surgeon near Grand Rapids who does outpatient knee replacement and takes Priority Health" gets a written answer with three to five names before they ever see a website. This page covers what those prompts look like, which decision factors come back when we mine them, which sources the engines cite for providers, what the HIPAA marketing rule permits, and a plain plan.

Which questions do patients ask the engines?

Patient prompts carry three things at once: the problem, the place and the constraint. In our prompt banks they look like "pediatric dentist in Holland accepting new patients with Delta Dental," "dermatologist in Traverse City with an appointment this month," "physical therapy in Kalamazoo for a torn rotator cuff that takes Medicare," "urgent care in Grand Haven open on Sunday that does stitches," and "therapist in East Lansing who does EMDR and takes Blue Cross." The engine answers each as a shortlist, and it also answers the question before the question, which is "do I need to see someone for this," from pages that explain conditions plainly; the practice cited for the explanation is often the one named when the follow-up is "who."

The click pattern matters more here than in most categories. Pew Research measured click-through on Google results pages at 8% when an AI summary was present against 15% without one (July 2025), and a patient who gets a name, a phone number and "accepting new patients" inside the answer has little reason to click. Being described correctly inside the answer is the outcome, and the audit measures that at the prompt level rather than reporting traffic.

How much of the engine's choice comes down to a fixed set of factors?

Most practice sites state the specialty and the address and leave the rest to the front desk, which the engine never calls. Aggarwal and colleagues at Princeton (KDD 2024) measured what specific, sourced writing does for citation, with statistics lifting a page's visibility in generated answers by about 33%, cited sources by about 28% and quotations by about 41%, and for a practice the statistics are plans accepted, hours, provider counts and wait times rather than outcomes claims.

Do directories matter more than the practice's own site?

• Healthgrades, which describes itself as taking the guesswork out of finding doctors, hospitals and care and says it holds more than 10 million patient reviews. A claimed, accurate profile per provider is cited; an unclaimed one with an old address is cited too, with the old address.
• Google Business Profile and its reviews. Google's local ranking help page says local results are ranked on relevance, distance and prominence and that businesses with complete and accurate information are more likely to show up, and the AI features read the same profile.
• Health system and hospital pages for affiliated providers, such as Henry Ford Health, which describes itself as headquartered in Detroit with more than 550 sites, or Munson Medical Center in Traverse City, whose provider directories the engines read as corroboration.
• Insurer provider directories, which the engines use to confirm the plans a practice says it accepts.
• Local news and the practice's own condition pages, read to confirm what the third parties said and to answer the explanatory prompts.

The 5W citation index attributed 85.5% of AI citations to earned, third-party media rather than brand-owned content, and Ahrefs' 75,000-brand study found brand web mentions correlated with AI Overview visibility at 0.664 against 0.218 for backlinks. For a practice the record that matters is Healthgrades, Google, the health system directory and the insurer directory all saying the same thing, which is the work of the citation and entity program. The reviews and reputation page covers how to ask for reviews without crossing the FTC's rule.

Does HIPAA limit what a practice can publish for this?

It limits one thing absolutely, and the rest is ordinary caution. Under HIPAA, 45 CFR 164.508(a)(3) requires a covered entity to obtain the patient's authorization for any use or disclosure of protected health information for marketing, with exceptions only for a face-to-face communication made by the covered entity to the individual and for a promotional gift of nominal value, and if the marketing involves financial remuneration from a third party the authorization must say so. For an AEO program that means no patient stories, photos, testimonials or case descriptions on the site or in review responses without a signed authorization on file, and it means the practice never confirms in a public reply that a reviewer was a patient.

None of that touches what the engines want. Provider credentials, conditions treated, plans accepted, hours, locations, affiliations and plain explanations of conditions contain no protected health information, and they are the whole of the on-site work. The FTC's Consumer Reviews and Testimonials Rule, announced August 14, 2024, separately prohibits conditioning incentives on positive reviews and suppressing negative ones, which governs how review requests go out. State medical and dental board advertising rules add their own limits on superlatives and outcome claims, and the responsible provider approves every page before it goes live.

Can you describe a plain plan for a practice?

1. Prompt bank by condition and constraint. 60 to 120 prompts written the way patients ask, with insurance, city, provider-type and urgency variants, across visibility, decision-factor, competitor and fact-check prompt types.
2. Mining with retrieval on. Each prompt run more than once across the engines, with the hidden searches and the citations captured, so we know which directories and which competitor pages the engine reads for your conditions.
3. Proof audit. The factor list checked page by page against the site, the provider profiles and the location pages, with a compliance read for protected health information and outcome claims.
4. Provider, condition and location pages. One profile per provider, one page per condition or procedure, one page per location with plans, hours and access stated plainly, plus explanatory pages for the questions patients ask first, all checked at the publish gate.
5. Record reconciliation. Healthgrades, Google, health system and insurer directory entries brought into agreement with the site, a Wikidata item created for the practice, and a correction page for anything the engines currently get wrong (a provider who left, an old address, a plan no longer accepted).
6. Verification. The prompt set re-run after indexing and monthly after that, tracked in PromptWatch and Profound alongside our own prompt miner, and reported at the prompt level with the misses included.

The audit takes about three weeks, the ongoing work runs through the GEO content program and the citation and entity program, and fees are quoted after a short scoping call. The page on fixing wrong AI answers covers the most common healthcare finding, which is a provider the engine still lists at a practice they left two years ago, and the Grand Rapids page covers the market where we see the most competition among practices.

Frequently asked questions