Healthcare SEO Agency: What to Expect, What to Ask and Where HIPAA Comes In

Choosing a healthcare SEO agency is not only a marketing decision. The agency will touch your website, your analytics and your public profiles, and in healthcare each of those can carry patient information. The right partner improves how patients find you and knows where the privacy lines are before anyone installs a tag.

I have worked in SEO and digital marketing for more than 16 years, and I work with clients remotely from Bucharest. I am not a lawyer or a compliance officer, and this article is not legal advice. Your practice or health system should check anything involving patient data with its own counsel or HIPAA privacy officer.

This article is about choosing and working with an agency. For how health content rules work in one city market, see our guide to medical SEO in New York.

What a healthcare SEO agency should deliver

Patients search in two ways. Some know what they need (“pediatric dentist”, “knee MRI”) and add a place. Others search the symptom or condition first and choose a provider later. Healthcare SEO services have to cover both: pages that answer the clinical question, and pages that make it easy to book with the right person at the right location.

A healthcare SEO expert should also tell you what not to do. Thousands of thin condition pages, bought links and invented reviews are all things I would refuse, whatever the budget.

Provider and location pages first

For most practices and clinics, the pages that bring patients are not the blog posts. They are the pages for each provider and each location, because that is where a search turns into a booking.

Google’s guidelines for representing your business treat clinicians the same way: “Doctors, dentists, lawyers, financial planners, and insurance or real estate agents are all individual practitioners.” A provider qualifies for their own Business Profile only if “They operate in a public-facing role” and “They can be contacted directly at the verified location during stated hours.” The guidelines also say:

• “A practitioner shouldn’t have multiple Business Profiles to cover all of their specializations.”
• “Business Profiles for practitioners may include title or degree certification (for example Dr., MD, JD, Esq., CFA).”
• “Do not create more than one page for each location of your business”.

On the website, mirror that structure: a page for each location, a page for each provider, and links between them. A provider who works at two sites appears on both location pages, but has one profile page. In audits, the gap I find most often is provider pages that exist but are not linked from any location page, so neither patients nor search engines connect them.

YMYL content: who wrote it and who checked it

Google’s guide to creating helpful, reliable, people-first content says its systems give more weight to experience, expertise, authoritativeness and trust (E-E-A-T) for “topics that could significantly impact the health, financial stability, or safety of people”. It also says “E-E-A-T itself isn’t a specific ranking factor”. So there is no markup that adds trust. It has to be visible on the page.

The same guide asks whether content is “written or reviewed by an expert or enthusiast who demonstrably knows the topic well”, and says: “We strongly encourage adding accurate authorship information, such as bylines to content where readers might expect it.” For SEO for healthcare providers, that means:

1. A named clinician writes or reviews each condition and treatment page, with a link to their provider page.
2. A visible review date, and a schedule for re-reviewing pages when guidance changes.
3. Plain explanations of what happens at an appointment, who it is for and when to seek urgent care.
4. No promises of outcomes, and no claims the practice cannot support.

An agency can draft, structure and optimise. It should not be the last word on clinical accuracy. Ask who signs off each page before you sign a contract.

In healthcare SEO, the agency writes for search engines, but a clinician has to be able to put their name on every page.

Where HIPAA comes in: tracking and analytics

This is the part many marketing agencies get wrong. HHS has published guidance on the use of online tracking technologies by HIPAA covered entities and business associates. It separates two kinds of page:

• User-authenticated pages, such as patient portals, which “require a user to log in”. HHS says: “Tracking technologies on a regulated entity’s user-authenticated webpages generally have access to PHI.”
• Unauthenticated pages, the public website. HHS says: “Tracking technologies on many unauthenticated webpages do not have access to individuals’ PHI.”

Where tracking does receive PHI, the guidance says “Regulated entities must ensure that all tracking technology vendors have signed a BAA” (a business associate agreement). If a vendor will not sign one, the organisation “cannot disclose PHI to such a vendor without individuals’ authorizations”, though HHS notes it can choose another vendor that will.

There is an important update. The HHS page itself now notes that “On June 20, 2024, the U.S. District Court for the Northern District of Texas issued an order” “declaring unlawful and vacating a portion of this guidance document”. The vacated part concerns treating an IP address combined with a visit to a public page about health conditions or providers as triggering HIPAA. The rest of the guidance stands, and HHS says it “is evaluating its next steps”. How your organisation applies this is a question for counsel, not for your SEO.

Reviews: Google, the FTC and patient privacy

Reviews influence which provider a patient calls, and three sets of rules apply to them. The FTC’s Consumer Reviews and Testimonials Rule went into effect on 21 October 2024. Its Q&A explains that it covers fake reviews, buying reviews that must express a particular sentiment, insider reviews without a clear disclosure, and review suppression through intimidation or unfounded threats.

On asking only happy patients, the FTC says “The rule does not contain a specific prohibition against such conduct”, but notes it could still break the FTC Act. The safe pattern is to ask every patient the same way.

The third rule is HIPAA, and it applies to replies. In 2023 HHS announced that a New Jersey psychiatric provider paid $30,000 in a settlement resolving a complaint that it disclosed a patient’s protected health information when it posted a response to that patient’s negative online review. A reply that confirms someone was treated, or mentions their care, can be a disclosure. Agree a short, neutral reply template with your compliance lead, and make sure the agency never replies on your behalf without it.

Questions to ask a healthcare SEO agency before signing

Most healthcare SEO companies will show you rankings. These questions show whether they understand the rest, and I would expect to answer every one of them myself:

1. Which tags will you add, and on which pages? The answer should exclude logged-in pages.
2. Will any of your tools receive patient information? If yes, ask about a BAA, and ask counsel whether you need one with the agency itself.
3. Who reviews clinical content? It should be a named clinician at your organisation.
4. How many Business Profiles will you create? One per real location, plus eligible practitioners.
5. How will you get reviews? The same request to every patient, no conditions on sentiment.
6. Who replies to reviews, using what template? Your compliance lead should approve it.
7. What will you report? Bookings and enquiries by service and location, not only traffic.

For more general hiring questions, see our list of what to ask SEO consultants. If you want an independent look at the technical side first, a technical SEO review can show what tags and redirects are already in place.

FAQ

What do healthcare SEO services usually include?

Provider and location pages, clinically reviewed condition and treatment content, Business Profile clean-up, review processes and technical fixes. A good scope also includes an audit of tracking tags against HHS guidance before new analytics are added.

Do I need a BAA with my SEO agency?

It depends on whether the agency or its tools will create, receive or handle protected health information. HHS says tracking vendors that receive PHI must sign a BAA. Many SEO tasks never touch PHI, but ask your counsel or compliance lead to decide.

Is SEO for the healthcare industry different from other SEO?

The methods are the same, but health topics are “Your Money or Your Life” content, so clinical review, authorship and accuracy matter more. Privacy rules also limit how you track conversions and handle reviews.

Can a healthcare SEO expert guarantee first-page rankings?

No. Rankings depend on Google, competitors and how much needs fixing. An agency that guarantees page one is guessing, and that claim alone is a reason to keep looking.