On this page
HIPAA-compliant AI visibility tracking means asking AI assistants only the marketing questions your patients ask, never anything about a patient, and measuring the visits and bookings that follow under a business associate agreement (BAA), which is how Curve Compliance's AI Visibility works. Each question is screened for PHI before it goes out. AI Visibility is a feature in Curve Compliance, and Curve also offers it as a managed service.
Need to show your compliance team what an AI visibility tool sends out? AI Visibility shows how often AI assistants, including ChatGPT, Google AI Overviews, Google AI Mode, Perplexity, Claude and Gemini, name and cite your practice for the questions your patients ask. Curve signs a BAA on every plan. Book a call to see AI Visibility on your own questions, or to talk about the managed service.
The two halves of AI visibility tracking
Tracking AI visibility has two halves, and they raise different privacy questions. The outward half asks AI assistants questions and reads their answers. It needs no patient data at all. The inward half measures what happens after an answer: the visits from people who clicked a link in it, and the bookings those visits led to. That half touches the same visit and booking data as any healthcare tracking, which is where HIPAA questions come in.
What leaves your systems when you track AI answers
The two halves handle different data, so a compliance review should look at each one on its own:
| Asking AI assistants | Measuring visits and bookings | |
|---|---|---|
| What it uses | Marketing questions, such as “best telehealth therapy for anxiety” | Visits from people who clicked a link in an AI answer, and the bookings they led to |
| Patient data needed | None | The same visit and booking data as any healthcare tracking |
| What to check | That each question is screened for PHI before it goes out | That the vendor signs a BAA and keeps PHI away from ad platforms |
Curve's AI Visibility is built for healthcare: only the marketing question you track is sent to AI assistants, screened for PHI first, and never anything about a patient. Curve is SOC 2 Type II and signs a BAA on every plan.
What AI assistants' crawlers read
When the assistants search the web, they read public pages, and each company says what its crawlers do. OpenAI says “OAI-SearchBot is used to surface websites in search results in ChatGPT’s search features.” and that “Disallowing GPTBot indicates a site’s content should not be used in training generative AI foundation models.” (OpenAI). Perplexity says “PerplexityBot is designed to surface and link websites in search results on Perplexity. It is not used to crawl content for AI foundation models.” (Perplexity). Anthropic says “Disabling Claude-User on your site prevents our system from retrieving your content in response to a user query, which may reduce your site's visibility for user-directed web search.” (Anthropic). Google says a page must be “indexed and eligible to be shown in Google Search with a snippet” to appear as a supporting link in AI Overviews or AI Mode (Google Search Central).
The two kinds of crawler call for two decisions. Blocking a search crawler can keep your pages out of that assistant's answers. Blocking a training crawler is a separate choice about model training. See which AI crawlers to allow on a healthcare website.
Tying AI answers to bookings without a pixel leak
HHS defines a tracking technology as “a script or code on a website or mobile app used to gather information about users or their actions as they interact with a website or mobile app”. It says “tracking technology vendors are business associates if they create, receive, maintain, or transmit PHI on behalf of a regulated entity”. Its own example is a booking: when a clinic's website sends details of an appointment and the visitor's IP address to a tracking vendor, “the tracking technology vendor is a business associate, and a BAA is required.” (HHS). The same page notes that a federal court vacated part of that guidance on June 20, 2024: the part about connecting an IP address with a visit to an unauthenticated public page about specific health conditions or healthcare providers.
Curve's AI Visibility ties AI answers to the visits and bookings they bring you, under the BAA Curve signs on every plan. Curve also replaces browser ad pixels with one script and strips PHI before data reaches an ad platform. See how to track ChatGPT and Perplexity referrals without GA4.
Which rules apply to your site depends on your setup, so talk to your counsel.
Questions to ask any AI visibility vendor
- What exactly is sent to the assistants? Ask for the list of fields, not a summary.
- Is each question screened before it goes out? A typed question can carry a name or a phone number by mistake.
- Who chooses the questions? A person should review every tracked question, so nothing goes out that nobody checked.
- Where do visit and booking data live? If the tool connects answers to bookings, ask whether it signs a BAA.
Vendors state their own positions. AthenaHQ, for example, says on its healthcare page: “AthenaHQ's brand monitoring does not process or store protected health information (PHI). We monitor publicly available AI outputs and your public-facing content.” (AthenaHQ). Ask each vendor on your shortlist for its statement in writing. For a wider comparison, see the best AI visibility tools for healthcare.
What This Looks Like in Practice
In one AI Visibility program we've run, for a HIPAA-focused healthcare software brand, Curve's team tracked the questions buyers ask AI assistants, found where competitors were named and the brand wasn't, and published pages to close those gaps. About five weeks in:
- AI assistants named or cited the brand in 53% of their answers to its 40 core buyer questions (104 of 196), across ChatGPT, Google AI Overviews, Google AI Mode, Perplexity and Claude.
- Across 184 real buyer questions and 912 AI answers, its site was cited in 236 answers, more than any competitor's and more than 2.5 times as many as the nearest one (89).
- 47 of the new pages were already cited by AI assistants within six days of going live.
- One new page brought in more than half of the brand's unpaid ChatGPT visits in its first week.
How Curve Compliance helps
AI Visibility is a feature in Curve Compliance, and Curve also offers it as a managed service. With the managed service, Curve's team sets up your questions, competitors and topics, writes the pages on your roadmap, and makes the technical fixes that help AI assistants read your site. Your clinicians review and approve anything medical before it goes live.
AI Visibility also catches what AI gets wrong about your practice, so you can correct it on the pages AI reads. It checks whether AI search can read your site, and what to fix. If your developer manages your site, Curve's team hands them the exact fixes. Each month, Curve's team walks you through your results on a call and sends a one-page report.
Curve signs a BAA on every plan (Directory entry) and is SOC 2 Type II. AI Visibility is available on request: book a call to get started. See the AI Visibility product page and Curve's security page.
Sources, checked November 2, 2026: OpenAI, Overview of OpenAI crawlers; Perplexity, Perplexity crawlers; Anthropic, Does Anthropic crawl data from the web; Google Search Central, AI features and your website; HHS, Use of Online Tracking Technologies; AthenaHQ, healthcare.
Frequently Asked Questions
What is HIPAA-compliant AI visibility tracking?
It means tracking how AI assistants answer your patients' questions without sending anything about a patient, and measuring the visits and bookings that follow under a BAA. Curve Compliance's AI Visibility sends only the marketing question you track, screened for PHI first.
Is tracking what ChatGPT says about my practice a HIPAA issue?
Asking ChatGPT a general marketing question, such as “best telehealth therapy for anxiety”, involves no patient. The HIPAA questions come with measuring the visits and bookings that follow, because HHS treats a tracking vendor that receives PHI on your behalf as a business associate (HHS).
Does Curve's AI Visibility send PHI to ChatGPT?
No. AI Visibility asks AI assistants only the marketing questions you track, screened for PHI first, never anything about a patient.
Can I track AI referrals to bookings in a HIPAA-compliant way?
You can measure them with a tool that signs a BAA and keeps PHI away from ad platforms. Curve's AI Visibility ties AI answers to the visits and bookings they bring you, and Curve strips PHI before data reaches an ad platform and signs a BAA on every plan.
Who reviews medical content before it goes live?
Your clinicians do. Curve's AI Visibility turns what it finds into a weekly roadmap sized to what your clinicians can publish, with medical topics flagged for clinical review. With the managed service, your clinicians review and approve anything medical before it goes live.
Does Curve sign a BAA?
Yes. Curve signs a BAA on every plan and is SOC 2 Type II (Directory entry).
Should a healthcare website block AI crawlers?
Blocking a search crawler can keep your pages out of AI answers: OpenAI says sites opted out of OAI-SearchBot “will not be shown in ChatGPT search answers, though can still appear as navigational links.” (OpenAI). Blocking a training crawler such as GPTBot is a separate decision about model training.
Can Curve run AI Visibility for us?
Yes. Curve's team can run it for you as a managed service. AI Visibility is available on request: book a call to get started. See the AI Visibility managed service.
Talk to Curve Compliance
Want your compliance team to see exactly what is sent out before you start? Book a call to see AI Visibility on your own questions, or to talk about the managed service.