What ChatGPT can read on a medical practice's site, and what it cannot

Where does ChatGPT's picture of a practice come from?

From two sources that age differently. The first is training: text collected before the model's knowledge cutoff, which for a practice can mean the address before the move, the physician who retired, the hours from two winters ago. A model answering from memory has no way to notice that any of it has changed.

The second is retrieval. When ChatGPT searches the web, it answers from pages its search finds for the question. OpenAI's crawler documentation names the tokens that do the fetching: OAI-SearchBot indexes pages for ChatGPT search, the feature that began as SearchGPT, and ChatGPT-User fetches a page when a user asks about it. This is the route a practice can influence quickly, because it reads your pages as they were when last fetched rather than as they were when a model was trained.

The two routes meet on your own pages. Whatever you correct there is what the next fetch finds and, if you allow training crawlers, text a later model may learn from. Fixing the page is the one step that helps on both.

OpenAI's crawlers, and the decision each one asks of a practice

Each token has one job, and robots.txt is read token by token: under RFC 9309, a group of rules addressed to one crawler does not bind another. So each AI crawler token is its own decision, and the table sets out what each one means for a practice.

The mistake to look for can run either way. A rule for GPTBot may have been added in the belief that it kept the practice out of ChatGPT, which it does not do. Or a blanket rule for every bot, written to settle a privacy worry, may shut out OAI-SearchBot along with everything else. Read the file, or run the crawler access check, which reads it for all nineteen tokens and reports OAI-SearchBot, GPTBot and ChatGPT-User among them.

robots.txt is not a privacy control. It is a public file asking crawlers to stay out of certain paths, and anyone can read it. Nothing about a patient belongs on a page that a robots rule is protecting; patient information belongs behind the portal's login, which no crawler gets past in the first place.

What a crawler can reach on a practice's site, and what it cannot

A crawler receives what the server sends a visitor who has no account, no saved session and, usually, no scripts running. On a practice site that sorts the pages into three kinds: public pages in HTML, which it reads; everything behind the portal's login, which it never sees; and anything that appears only after a script runs or a file opens, which it may never see. The table goes part by part.

The audit measured the general version of three of those rows, and of the robots.txt decision above. Of the 9,483 sites in our audit (40 trades, 90 metros, late August to early September 2026), 7.2% sat behind bot protection that served our crawler a challenge page instead of the site, and 3.2% disallowed AI crawlers in robots.txt on purpose. 3.0% rendered their content only in JavaScript, and 2.1% kept real content such as a price list in a PDF. Each is a figure for every trade together, with no medical-practice breakdown.

On a practice site the challenge page is the row to test for, because it can arrive without anyone choosing it: security settings meant to protect the portal's login, or a host's default bot protection, can end up covering the public pages too. Scripts are the other quiet loss. Google renders JavaScript as a separate, deferred step, as its JavaScript documentation explains, and OpenAI's crawler documentation describes no such step for its crawlers. Text a patient needs goes in the HTML.

What a practice page has to carry for ChatGPT search

The facts a patient asks about, in text, on a public page, each where a patient would look for it. Which facts those are is set out in what patients ask before choosing a practice. This section is about the form they have to take for a crawler.

• In the HTML. Open the page with scripts turned off; the words you still see are the words a fetcher receives.
• On a public URL of its own. A page reachable only from inside the portal, or only through a search box on your site, is a page a crawler has no link to.
• Linked from pages that are themselves linked: the new patients page one click from the homepage, each office page from the footer, each clinician's page from the office where they practice. Internal linking is how a crawler that starts at your homepage finds the rest.
• Named and placed. The page title and first paragraph say which practice, which office and which town, so that any passage quoted from the page carries the practice's name with it.
• Dated where the fact changes. "Accepting new patients as of [month]" gives a reader a date to judge the sentence by; an undated line gives none.
• Repeated in markup: Physician or MedicalClinic JSON-LD with the same name, address, telephone and hours as the text, and isAcceptingNewPatients where it is true. The markup restates the page and says nothing the page does not.

None of this is a ChatGPT-only format. It is what any fetcher needs, which is why the same pages serve Claude, Gemini and Perplexity as well. We know of no file, form or markup that submits a medical practice to ChatGPT's answers, and OpenAI's crawler documentation describes none; be wary of anyone who sells one.

How to check what ChatGPT gets from your site

1. Open /robots.txt on your domain and look for groups naming OAI-SearchBot, ChatGPT-User or GPTBot. If none of them is named, OAI-SearchBot and GPTBot follow the * group.
2. Fetch a page the way the search crawler would and read the HTTP status code: curl -sL -A "OAI-SearchBot" -o page.html -w "%{http_code}" https://www.example.com/new-patients. A 403, a 429 or a 503 means the fetch was stopped before it reached your content. A 200 is not proof on its own, because some challenge pages return one, so open the saved page.html and check that it is your page. A security service that checks whether a visitor is the crawler it claims to be may treat your test differently from the real one; its settings or logs settle it.
3. View the source of the new patients page, the insurance page and one office page with scripts disabled. If the words patients ask about are not in what you see, they are not in what a fetcher receives.
4. Sign out of everything and open your public pages in a private window. If any of them redirects to the portal's login or shows a challenge, a crawler meets the same thing.
5. Ask ChatGPT, with search on, three of your patients' questions, three times each, and open the sources linked in the answers. If your pages never appear among them and other practices' pages do, the comparison to make is between their pages and yours.
6. Paste the address of your new patients page into ChatGPT and ask what it says about accepting new patients. That fetch is ChatGPT-User's; if the reply cannot see the page, or gets it wrong, the page is where to look.

These checks settle access and form. Whether ChatGPT then names your practice for a patient's question is something only a measurement across runs can show, and the panel that does it is in measuring a practice's AI visibility. For the facts themselves, page by page, start from the overview for medical practices.