Healthcare SEO Audit: A 25-Point Technical Review for Medical and Healthcare Websites

Most technical SEO checklists are written for ordinary business websites. Medical sites have more moving parts: directories with hundreds of doctor profiles, find-a-doctor filters, patient portals, booking widgets, and health content that Google holds to a higher standard. This healthcare SEO audit guide gives you 25 technical checks, how to test each one, and a 30-day order for fixing what you find.

It is a workflow built from Google Search Central documentation, schema.org, HHS guidance and published pricing guides, not a report on a specific client site. The privacy and accessibility sections are general guidance, not legal advice.

What a Healthcare SEO Audit Covers, and How It Differs from a Standard Audit

Every audit starts with the same basics: crawlability, indexing, metadata, redirects, speed and internal links. For those generic checks, use our technical SEO audit checklist for business websites. Technical SEO for healthcare websites adds six areas a generic audit usually skips:

• Provider directories. Doctor profiles, department pages and filters that can hide pages from Google or create thousands of junk URLs.
• Medical schema. Types such as MedicalClinic, IndividualPhysician and MedicalWebPage that describe providers and reviewed content.
• YMYL trust signals. Author and medical reviewer bylines, review dates and sources on health content.
• Third-party scripts. Booking, telehealth and chat widgets that slow pages down.
• Tracking on sensitive pages. Analytics and ad tags that could send health information to vendors.
• Accessibility duties. WCAG 2.1 AA requirements for organizations that receive HHS funding.

Hospital websites vs. single-location practices

A technical SEO audit for a hospital website is mostly a scale problem: thousands of provider profiles, many departments and locations, several content owners and often a separate patient portal. Sampling templates and comparing the provider database against the crawl matters more than checking pages one by one. A single-location practice has fewer pages, so the checks that usually matter most are the booking widget, tracking tags, provider bios and the Google Business Profile.

The Healthcare SEO Audit Checklist: 25 Technical Checks

Use this healthcare SEO audit checklist as your working document. Priority reflects likely impact on patients, visibility and risk: High items go first in the 30-day roadmap further down.

Crawl and Indexing: Provider Profiles, Find-a-Doctor Filters and Patient Portals

Provider directories are a common source of healthcare crawl problems. When every filter for specialty, location, insurance and language creates a new URL, crawlers can waste their time on endless combinations. Google's faceted navigation guidance warns that this leads to overcrawling and slower discovery of useful pages. If you do not need filtered results indexed, block those parameters in robots.txt or use URL fragments. If you do, use the standard & parameter separator, keep the filter order consistent and return a 404 for filter combinations with no results.

Next, check how profiles are linked. Google says it can generally only crawl links that are <a> elements with an href attribute. A directory that loads doctors only after someone types a search or clicks a JavaScript button can leave every profile undiscoverable.

Patient portals, login screens, bill-pay pages and form confirmation pages should never appear in search. Do not rely on robots.txt for this: Google states that robots.txt "is not a mechanism for keeping a web page out of Google". Use a noindex tag or put the page behind a login.

Why are doctor profile pages not showing on Google?

Paste one missing profile into the URL Inspection tool in Search Console, then work through these causes in order:

1. No internal links point to the profile. Link every profile from its department, location and directory pages with normal links.
2. The profile is missing from the XML sitemap. Generate the sitemap from the same database that powers the directory, so new hires appear automatically.
3. The directory only renders profiles through JavaScript buttons or search forms. Give Google a crawlable path, such as paginated A to Z or specialty listing pages built with <a href> links.
4. A noindex tag or a canonical tag points away from the profile. Check the URL Inspection result for the user-declared and Google-selected canonical.
5. The profile is thin or near-identical to hundreds of others. Add real detail: specialties, conditions treated, education, board certification, languages, locations and whether the provider accepts new patients.
6. Google chose a different page for the provider's name, such as a third-party directory listing. Strengthen the profile with consistent details and IndividualPhysician markup, and link to it from the provider's Google Business Profile where one exists.

The Page indexing report shows the same problems at scale. Watch for "Discovered - currently not indexed" (found but not crawled yet), "Crawled - currently not indexed" and "Duplicate, Google chose different canonical than user" on your profile and location folders.

Multi-Location Clinic Pages and NAP

Each clinic location needs its own page with a unique name, address and phone number (NAP), hours, services and providers, and those details should match its Google Business Profile exactly. Avoid copying the same service text across every location page. Doctors can also have their own Business Profiles: Google's guidelines allow public-facing practitioners who can be contacted at the location, and a practitioner who is the only public-facing professional at a branded location should share one profile with the practice. For location page structure, reviews and Business Profile management, see our guide to local SEO for multi-location clinics.

Healthcare Schema Markup: What to Add and How to Validate

Healthcare schema markup tells search engines who your providers are, where they practice and who reviewed your medical content. These are the types most medical sites need:

• MedicalClinic, Hospital or MedicalOrganization on the home page and location pages. Google's local business documentation recommends the most specific subtype you can use, with name and address required.
• IndividualPhysician on doctor profiles. On schema.org, Physician covers both an individual and a physician's office, while IndividualPhysician describes one practitioner and supports practicesAt, medicalSpecialty and usNPI, the 10-digit National Provider Identifier.
• MedicalWebPage on condition and treatment pages, using the reviewedBy and lastReviewed properties only when a qualified person actually reviewed the page.
• BreadcrumbList sitewide, so department, location and profile hierarchies are clear.
• FAQPage is still valid schema.org markup, but Google stopped showing FAQ rich results on May 7, 2026. Keep it only where a real FAQ is on the page.

Illustrative example: placeholder names, phone number, address and URLs. Replace every value with details that are visible on the real page.

{
  "@context": "https://schema.org",
  "@type": "IndividualPhysician",
  "name": "Dr. Jane Example, MD",
  "url": "https://www.example-clinic.com/providers/jane-example",
  "medicalSpecialty": "https://schema.org/Cardiovascular",
  "usNPI": "YOUR-10-DIGIT-NPI",
  "isAcceptingNewPatients": true,
  "practicesAt": {
    "@type": "MedicalClinic",
    "name": "Example Heart Clinic",
    "telephone": "+1-555-555-0100",
    "address": {
      "@type": "PostalAddress",
      "streetAddress": "100 Main St",
      "addressLocality": "Austin",
      "addressRegion": "TX",
      "postalCode": "78701"
    }
  }
}

{
  "@context": "https://schema.org",
  "@type": "MedicalWebPage",
  "name": "High Blood Pressure: Causes and Treatment",
  "url": "https://www.example-clinic.com/conditions/high-blood-pressure",
  "lastReviewed": "2026-09-01",
  "reviewedBy": {
    "@type": "Person",
    "name": "Dr. Jane Example, MD",
    "url": "https://www.example-clinic.com/providers/jane-example"
  }
}

Validate every template with the Rich Results Test and the Schema Markup Validator. Google's structured data guidelines say not to mark up content that is not visible to readers, and that correct markup still does not guarantee a rich result.

YMYL and E-E-A-T Signals: Reviewer Bylines and Last-Reviewed Dates

Health is a "Your Money or Your Life" (YMYL) topic. Google says its systems give even more weight to strong E-E-A-T on topics that could significantly affect people's health, and it encourages accurate bylines that lead to more information about the author. In a healthcare SEO audit, check that:

• Every condition, treatment and procedure page names its author and, where relevant, a clinical reviewer with credentials.
• Bylines link to bio pages that list specialties, training and board certification, and those bios match the provider profiles.
• A visible "last reviewed" date matches the lastReviewed value in your markup, backed by a written review policy.
• Statistics and treatment claims link to primary sources such as government health agencies or peer-reviewed research.

Core Web Vitals and Third-Party Booking Widgets

Measure provider, location and booking templates against Google's Core Web Vitals thresholds: Largest Contentful Paint within 2.5 seconds, Interaction to Next Paint of 200 milliseconds or less, and Cumulative Layout Shift of 0.1 or less, measured at the 75th percentile of page loads. INP replaced First Input Delay on March 12, 2024, so older audits that only report FID are out of date.

Booking tools, telehealth embeds, chat widgets and review carousels are easy to overlook on medical sites. They load large scripts, compete with the page for the main thread and often push content down as they appear. Practical fixes:

• Show a lightweight "Book an appointment" button and load the full widget only when someone clicks it.
• Defer chat and review scripts until after the main content loads.
• Reserve fixed space for embeds so they cannot shift the layout.
• Test with and without each widget in PageSpeed Insights and the Chrome DevTools Performance panel.

Check mobile parity at the same time. Google uses the mobile version of a site for indexing and ranking, and it will not load content that needs a swipe, click or typing to appear. Provider bios or insurance lists fetched only after a tap may never be indexed.

HIPAA-Aware Analytics and Tracking Checks

This is where a healthcare SEO audit differs most from a normal one, and where you should involve your compliance officer or privacy counsel. The key sources:

• The HHS Office for Civil Rights bulletin on online tracking technologies was partly vacated by a federal court in June 2024. The vacated part covered IP addresses collected on public pages about health conditions or providers. Guidance that tracking on user-authenticated pages, such as patient portals, generally has access to protected health information remains in place, according to McDermott Will & Emery. HHS withdrew its appeal in August 2024.
• Google does not offer business associate agreements for Google Analytics. It tells HIPAA-regulated customers not to set its tags on authenticated pages, and warns that public pages related to providing health care services are more likely to be HIPAA-covered.
• Health apps and platforms outside HIPAA may fall under the FTC's Health Breach Notification Rule, which treats sharing health information without the person's authorization as a breach.

The technical checks that follow from this:

• Inventory every tag on portal, appointment, symptom checker and form pages using your tag manager's preview mode and the browser Network tab.
• Make sure form fields, appointment types and conditions never appear in URLs, page titles or analytics event parameters.
• Match every vendor that could receive health information to a signed business associate agreement, or remove its tag.
• Where you still need measurement on sensitive flows, review server-side tagging or an analytics vendor that will sign a business associate agreement, with your compliance team.

Accessibility Checks (WCAG 2.1 AA)

Accessibility is part of patient trust, and for many providers it is also a legal duty. The HHS Section 504 rule requires recipients of HHS federal financial assistance to meet WCAG 2.1 Level AA on their websites and mobile apps. In May 2026, HHS extended the deadlines by one year: May 11, 2027 for recipients with 15 or more employees and May 10, 2028 for smaller ones, according to Duane Morris. The standards also reach patient portals and telehealth platforms, whether built in-house or provided by a vendor, per Alston & Bird.

Run an automated scan with WAVE or Lighthouse on each key template for contrast, alt text, form labels and heading order. Then do a manual pass: find a doctor, open a profile and book an appointment using only the keyboard, and again with a screen reader. Vendor widgets can fail these tests, so include them in the test and in your contracts. Check your own obligations against the WCAG 2.1 standard with counsel.

Prioritization: A 30-Day Fix Roadmap

Score each issue from 1 to 3 on severity, patient impact and effort, then fix high-severity, high-impact, low-effort items first. Illustrative example: the plan below assumes a site with one developer; larger hospital sites may need to stretch it. Accessibility work in week 4 usually starts the remediation rather than finishing it.

After day 30, compare Search Console indexing and Core Web Vitals reports with your starting point, and keep a log of every change so later drops are easy to trace.

Tools for Auditing a Medical Website

• Google Search Console for the Page indexing, Sitemaps, Crawl stats and Core Web Vitals reports, plus URL Inspection.
• Screaming Frog SEO Spider for full crawls. The free version crawls up to 500 URLs, which is enough for many practices but not for hospital directories.
• PageSpeed Insights for field and lab Core Web Vitals data.
• Rich Results Test and Schema Markup Validator for structured data.
• WAVE and Lighthouse for automated accessibility scans.
• NPI Registry for checking provider names, credentials and identifiers.
• Browser DevTools and your tag manager's preview mode for seeing which tags fire on sensitive pages.

How Often to Run a Healthcare SEO Audit, and What It Costs

How often should a healthcare website do an SEO audit?

A practical rhythm is a monthly look at Search Console, a quarterly check of indexing, Core Web Vitals and tracking tags, and a full audit at least once a year. Run an extra audit after a CMS migration or redesign, a new location, a new booking, telehealth or chat vendor, or a bulk update to the provider directory. Those changes are when orphaned profiles, broken redirects and new tracking scripts tend to appear. Planning a relaunch? Work through a website redesign SEO checklist before it goes live.

How much does a healthcare SEO audit cost?

There is no standard price, and published ranges are wide. SeoProfy (updated May 2026) puts a typical SEO audit at $500 to $5,000, cites Clutch data of roughly $100 to $5,000 for a technical audit, and notes that regulated industries such as healthcare may need compliance checks that add cost. WebFX's healthcare SEO pricing guide lists $100 to $300 an hour for agencies or freelancers, $500 to $7,500 for a site content audit, and $5,000 to $30,000 for project-based work. Expect the upper end for hospital systems with large directories, many locations or a review of tracking on sensitive pages.

A do-it-yourself audit costs nothing in software if you use the free tools above, but it takes time and someone who can read crawl data. BizTech does not sell a standalone healthcare audit or a HIPAA compliance review. A basic technical SEO audit is included in the SEO Starter plan, which starts at $320 a month, and the SEO Growth plan includes a full technical SEO audit and fixes; see SEO packages and pricing. For a quick first look at one page, our free SEO audit tool checks a single URL for common SEO, speed, security and mobile issues. It does not check provider directories, medical schema or tracking tags.

AI Search Visibility for Healthcare Providers

Google says there are no additional requirements or special schema for appearing in AI Overviews or AI Mode. A page must be indexed and eligible to show with a snippet. For medical sites, that means the same work as above: indexable provider profiles, consistent provider details, clearly reviewed content and accurate markup. For the content side, read our AI SEO strategy guide.

Next Steps

A healthcare SEO audit is worth doing when it protects patients as well as rankings. Start with the High items in the checklist: indexing blockers, sensitive data in URLs and tags on patient pages. Then make every provider profile crawlable and useful, add accurate medical schema and reviewer details, and fix the widgets and accessibility gaps that slow patients down. If you want help with the SEO side, explore our technical SEO services or contact BizTech.