SEO for Healthcare: A Playbook for Hospitals and Clinics

SEO for healthcare is the work of getting a hospital, clinic group, lab, pharmacy or telehealth service found by patients searching for the care it provides, in the places it provides it. For an organisation, that means six jobs: a site built around services, locations and clinicians; medical pages written or reviewed by named experts; a Business Profile for every site; honest structured data; analytics that do not leak patient data; and a content library kept current.

This playbook is for organisations with several sites, departments and dozens of clinicians, where the hard problems are structure, review workflow and privacy law. If you run a solo practice, our guide to SEO for dentists is closer to your situation.

#Why healthcare pages are held to a higher bar

Google's Search Quality Rater Guidelines, the September 2025 edition that human raters use to judge results, define "Your Money or Your Life" (YMYL) topics as those that could significantly affect people's health, financial stability or safety. The first example they give of where "mild inaccuracies or content from less reliable sources" could do damage is "symptoms of a heart attack".

Three passages in that document shape how a health site should be built:

• "Pages on clear YMYL topics require the most scrutiny for Page Quality rating."
• "If the purpose of a page on a clear YMYL topic is to give information or offer advice, a high level of expertise may be required for the page to be trustworthy."
• "Consistency with well-established expert consensus is important for medical advice."

Raters do not move pages up or down. The guidelines say their ratings "are used to measure how effectively search engines are working", and Google's own guide to helpful content says those systems "give even more weight to content that aligns with strong E-E-A-T" on health topics. Our breakdown of helpful content covers the self-assessment questions in full.

For a hospital, the practical reading is simple. A condition page with no named author, no reviewer and no date is weaker than the same text signed by a cardiologist who reviewed it last month.

#Step 1: Plan the site around services, locations and clinicians

A healthcare organisation's website is really four directories that cross each other: what you treat, where you treat it, who treats it, and what patients want to understand before they book.

The links between them matter as much as the pages. A condition guide on atrial fibrillation should link to the cardiology service page, the service page should list the sites that offer it, and each site page should list its cardiologists.

Two rules keep this from turning into thin content. First, build a service-and-location page only when that site really offers the service with its own details: different clinicians, hours or booking. Google's spam policies name "multiple domain names or pages targeted at specific regions or cities that funnel users to one page" as doorway abuse, and a template with only the city name swapped is exactly that. Second, a diagnostics chain with 40 collection centres usually needs 40 location pages and a handful of test guides, not 40 copies of every test guide.

#Step 2: Put a named clinician on every medical page

Google's helpful content guidance asks a direct question of every page: "Is this content written or reviewed by an expert or enthusiast who demonstrably knows the topic well?"

A workable review process for a content team looks like this:

1. A writer drafts from your clinical guidelines and named sources such as NHS, CDC or ICMR material.
2. A clinician in the relevant specialty reviews for accuracy and consensus, and signs off by name. Their profile page lists qualifications and registration.
3. The page shows both names and two dates: when it was published and when it was last clinically reviewed.
4. A review date is set in your CMS or a spreadsheet. We suggest 12 months for stable topics and sooner for drug, vaccine or guideline topics that change.
5. Changes to clinical facts go back to a clinician; copy edits do not need to.

Google is plain about bylines: "We strongly encourage adding accurate authorship information, such as bylines to content where readers might expect it." The same page warns that "fabricating creator profiles (such as by using AI-generated headshots, made-up names, or false credentials...)" is deception. Never invent a doctor, and never let a clinician's name sit on a page they have not read.

A hospital that generates 500 condition pages with AI and puts one doctor's name on all of them has a review problem and possibly a spam problem. Google's rules on scaled content abuse target pages produced in bulk to rank, "no matter how it's created". Publish fewer pages, each one genuinely reviewed.

Schema.org has a MedicalWebPage type with two properties that describe this exact workflow: reviewedBy and lastReviewed. Use them only to mirror what the page already shows.

#Step 3: One Business Profile per site, department and clinician

Most healthcare searches are local, and the map results come from Business Profiles. Google's guidelines for representing your business are unusually specific about hospitals and clinicians.

One profile per location. The rule is "Do not create more than one page for each location of your business." The same sentence makes the exception that matters to you: "departments within businesses, universities, hospitals, and government buildings may have separate pages."

Departments get profiles only if they act like separate places. "Publicly-facing departments that operate as distinct entities should have their own page." The name must differ from the main hospital and from other departments, and so must the primary category. Google's own acceptable example is "Massachusetts General Hospital Department of Dermatology". A radiology unit with its own entrance, phone line and hours qualifies. A ward does not.

Clinicians may have their own profiles. Google counts doctors as individual practitioners. A clinician qualifies if they work in a public-facing role and "can be contacted directly at the verified location during stated hours". Where several practitioners work at one site, "the organization should create a Business Profile for this location, separate from that of the practitioner."

Chains keep names and categories consistent. "All business locations within the same country must have the same name for all locations," and locations offering the same service share a category. Organisations with 10 or more locations of the same business can request bulk verification through Business Profile Manager.

Point each profile's website link at that location's page, not the homepage. Our local SEO playbook covers categories, photos and reviews; the healthcare-specific rule is never to reply to a review with details that confirm someone was a patient.

#Step 4: Use structured data Google can actually read

Schema.org has a rich vocabulary for healthcare. MedicalOrganization is "a medical organization (physical or not), such as hospital, institution or clinic", and it has more specific types: Hospital, MedicalClinic, DiagnosticLab, Pharmacy, Physician and Dentist, among others. Properties include medicalSpecialty, isAcceptingNewPatients and, on Physician, hospitalAffiliation and usNPI.

Google does not use most of it for anything you can see. Its structured data search gallery lists the features it supports, and none of them is medical: no doctor rich result, no hospital card, no specialty snippet. The types that do apply to a health organisation are Organization, Local business, Article, Breadcrumb, Profile page and Video.

That does not make medical types useless. Google's Organization documentation says "we recommend using the most specific schema.org subtype of Organization that matches your organization", and its local business documentation asks you to "use the most specific LocalBusiness sub-type possible". Hospital and MedicalClinic satisfy both. The documentation also supports a department property for units with their own hours or phone numbers, which mirrors the Business Profile setup above.

A minimal block for one site of a clinic group looks like this:

{
  "@context": "https://schema.org",
  "@type": "MedicalClinic",
  "name": "Riverside Health Kothrud",
  "url": "https://riversidehealth.example/locations/kothrud",
  "telephone": "+91-20-0000-0000",
  "address": {
    "@type": "PostalAddress",
    "streetAddress": "12 Example Road, Kothrud",
    "addressLocality": "Pune",
    "postalCode": "411038",
    "addressCountry": "IN"
  },
  "medicalSpecialty": ["Cardiovascular", "Dermatology"],
  "isAcceptingNewPatients": true,
  "parentOrganization": { "@type": "MedicalOrganization", "name": "Riverside Health" }
}

One more change affects health sites directly. In August 2023 Google restricted FAQ rich results to "well-known, authoritative government and health websites". Google's documentation changelog then recorded that the feature would "no longer appear in Google Search starting May 7, 2026", and the documentation was removed in June. Keep FAQ sections where patients find them useful, but expect nothing extra in search from the markup.

#Step 5: Analytics and pixels: what US, UK and India allow

Healthcare SEO is unusual in one way: the measurement setup can create legal exposure on its own. An advertising pixel on an appointment form can send a patient's identity and reason for booking to a third party.

United States: the HHS bulletin, as it stands

The Office for Civil Rights at HHS published a bulletin on online tracking technologies for HIPAA covered entities and their business associates. Part of it no longer stands. The page now opens with a notice that on June 20, 2024, a federal court in Texas issued "an order declaring unlawful and vacating a portion of this guidance document." The vacated part is where the bulletin said HIPAA was triggered when tracking connects "an individual's IP address with... a visit to a[n] [unauthenticated public webpage] addressing specific health conditions or healthcare providers." The notice ends: "HHS is evaluating its next steps in light of that order."

What remains is still demanding:

• Logged-in pages: "Tracking technologies on a regulated entity's user-authenticated webpages generally have access to PHI." That covers patient portals and telehealth platforms.
• Booking and symptom tools: public pages that let someone "schedule appointments or use a symptom-checker tool without entering credentials may have access to PHI in certain circumstances."
• Vendors: a vendor receiving PHI without patient authorisation needs "a signed BAA in place" plus a Privacy Rule permission, and a line in your privacy policy is not enough.
• Marketing: sharing PHI with tracking vendors for marketing without HIPAA-compliant authorisation is named as an impermissible disclosure.

In practice: keep ad pixels off portals, booking flows and symptom checkers. Use analytics there only from a vendor that will sign a business associate agreement, configured to collect the minimum. Public pages such as a hospital's parking page are lower risk, but the court ruling does not make every public page safe for every tool.

United Kingdom: ICO cookie rules and health data

The ICO published its final guidance on storage and access technologies in April 2026, covering cookies, tracking pixels and fingerprinting, and reflecting the Data (Use and Access) Act. It adds a "statistical purposes" exception: you can use analytics without consent when "the sole purpose" is statistics about how your service is used, provided you give clear information and "a simple means of objecting, free of charge". Advertising gets no such route: "If your service uses storage or access technologies for the purposes of online advertising, you must get consent." The ICO's exceptions guidance has worked examples.

Health data adds a second layer. Under UK GDPR, data concerning health is special category data, and the ICO says you need "both a lawful basis under Article 6 of the UK GDPR and a separate condition for processing under Article 9." A remarketing tag on a fertility clinic's enquiry form would need consent under the cookie rules, because it is advertising, and an Article 9 condition such as explicit consent, because it reveals health data.

India: the DPDP Act and Rules

India's Digital Personal Data Protection Act, 2023 has no separate health category, but its consent standard is strict: consent must be "free, specific, informed, unconditional and unambiguous with a clear affirmative action" and "limited to such personal data as is necessary". The government notified the DPDP Rules in November 2025 with, in its own words, "an eighteen-month period for phased compliance", and each organisation must give a separate, plain consent notice. Failing to take reasonable security safeguards carries a penalty that "may extend to two hundred and fifty crore rupees". Check MeitY for the current commencement dates before you plan around them.

#Advertising rules that reach your web pages

Service pages are marketing, and health marketing has its own rules.

UK. Since 2011 the CAP Code has applied to advertising on a company's own website, so treatment and price pages are in scope. Section 12 requires objective claims to be "backed by evidence, if relevant consisting of trials conducted on people," bars marketers from discouraging "essential treatment for conditions for which medical supervision should be sought," and states that "prescription-only medicines or prescription-only medical treatments may not be advertised to the public." A private clinic's weight-loss page that promotes a named prescription-only injection to the public runs straight into rule 12.12.

India. Section 3 of the Drugs and Magic Remedies (Objectionable Advertisements) Act, 1954 bars any advertisement suggesting a drug for the "diagnosis, cure, mitigation, treatment or prevention" of conditions in its Schedule, which includes cancer, diabetes and heart diseases. A pharmacy chain's page promising that a product "reverses diabetes" is the kind of copy it catches. Rules for individual doctors' advertising are a separate matter, covered in our upcoming guide on SEO for doctors.

#Step 6: Keep the medical library current

Healthcare content decays in a particular way: a guideline changes and a page goes clinically out of date while it still ranks. The review date from step 2 is half the fix. The other half is a regular audit.

Once or twice a year, list every medical page with its clicks from Search Console, its last review date and its owner. Then sort pages into four groups: update, merge, redirect or keep. Our step-by-step method for a content audit works well for this, and Project Rankup's Content Audit Studio can score individual pages and list plain-English fixes if you want a second pair of eyes on a large library.

Merging matters more in health than elsewhere. Large organisations often end up with three pages on knee replacement: one from orthopaedics, one from a location page and one from a patient leaflet uploaded as HTML. Pick the best one, merge the others into it, and redirect. Where you syndicate the same leaflet across sister sites, point every copy's canonical tag at the original, and make sure the original carries a self-referencing canonical so Google knows which version to show.

Measure what matters to the whole organisation, not only to the SEO team. For each location, track Search Console clicks to that location's page, Business Profile calls and direction requests, and completed bookings, counted in a privacy-safe way as described in step 5.

#Hiring a healthcare SEO agency: questions to ask

Most agencies can run keyword research. Fewer can explain the HHS bulletin or the ICO's analytics exception. Before signing, ask:

1. Who reviews the medical content you write? You want a named clinician on your side, and a process where the agency drafts and your clinicians approve.
2. Which tracking tags will you add, and on which pages? A good answer names the tools and keeps them away from portals and booking flows.
3. How do you build location pages? Listen for "only where the site has its own services and clinicians".
4. What will you report each month? Clicks and bookings per location beat rankings for a list of vanity terms.
5. Do you build links? If they do, ask how. Paid links on unrelated sites are a risk a hospital brand should not take.

An agency that promises page-one rankings for "best hospital" by a date has not worked with health organisations before.

常见问题

What does SEO stand for in healthcare?

SEO stands for search engine optimisation: making your website and listings easier for search engines to understand and for patients to find. In healthcare it is not a clinical term. It means the same thing as anywhere else, but with stricter expectations on medical accuracy, named expertise and patient privacy, because Google treats health as a "Your Money or Your Life" topic.

Is Google Analytics allowed on a hospital website?

It depends on the page, the country and how the tool is set up. In the US, HHS says tracking on logged-in pages generally has access to protected health information, which needs a signed business associate agreement. In the UK, analytics without consent must be used solely for statistics with a free way to object. Keep advertising tags off portals and booking pages everywhere.

Does medical schema help with rankings?

Not directly. Schema.org types such as Hospital, MedicalClinic and Physician help Google understand what an organisation is, and Google recommends the most specific type. But no medical rich result exists in Google's search gallery, and FAQ rich results stopped appearing on May 7, 2026. Use the markup for accuracy, not for an expected change in how results look.

Can we use AI to write medical content?

You can use AI to draft, provided a qualified clinician reviews every page for accuracy and the page shows who reviewed it and when. What gets health sites into trouble is publishing large volumes of unreviewed pages, or putting a doctor's name on text they never read. Google treats false authorship as deception, however good the text sounds.

How long does healthcare SEO take to show results?

There is no fixed timeline, and anyone who promises one is guessing. Fixing existing Business Profiles and location pages tends to show first, because those listings and URLs already have history. New service and condition pages take longer, depending on how established your domain is and how competitive the searches are. Track clicks and bookings per location monthly and judge the programme over several quarters.