# How does a health tech or healthcare supplier get recommended by ChatGPT?

Canonical: https://fortitudemedia.ai/insights/ai-optimisation-healthcare-medical
Author: Ashley Kenerson
Published: 2026-03-31
Last reviewed: 2026-09-24
Reviewed by: Ashley Kenerson
Pillar: Sector guides
Summary: How UK health tech firms, occupational health providers and healthcare suppliers get named by ChatGPT, using DTAC, DSPT, SEQOHS and CQC evidence buyers check.
Keywords: health tech chatgpt recommendations, dtac compliance nhs, dsp toolkit supplier, occupational health provider ai search, how to sell digital health to the nhs, healthcare supplier marketing uk
Short answer: ChatGPT and the other assistants name healthcare suppliers they can match to a buyer's question and check against public records. For digital health, that means stating your DTAC position, Data Security and Protection Toolkit status, Cyber Essentials certificate, clinical safety officer and any MHRA registration in plain text on a dated page. For occupational health, it means stated coverage, SEQOHS accreditation and named clinicians. Then publish pages that answer the questions NHS, private sector and HR buyers type, and keep every listing consistent.
What changed: Retargeted to health tech and healthcare suppliers: added DTAC (2026 form), DSP Toolkit, Cyber Essentials, SEQOHS, the DMCC fake reviews ban, cosmetics licensing and a shorter clinic section.
Publisher: Fortitude Media Limited

When quoting, attribute to Fortitude Media and link to the canonical URL above.

---
A digital transformation lead at an NHS trust has six weeks to recommend a remote monitoring pilot. Before she emails a supplier, she asks Copilot on her work laptop which virtual ward platforms other trusts use and what she must check before a pilot. An HR director with forty depots asks ChatGPT which occupational health providers can cover every site. Each assistant replies with three or four names. If yours is not one of them, you are not on the list that goes to procurement, and nobody tells you the list existed.

This is now how business buyers work. Forrester found that 94% of business buyers use AI in their buying process, and that they are four times as likely as consumers to use Microsoft Copilot ([Forrester, January 2026](https://www.forrester.com/blogs/b2b_buyers_make_zero_click_buying_number_one/)). In G2's survey of software buyers, 51% said they now start their research in an AI chatbot, up from 29% a year earlier ([G2, April 2026](https://www.prnewswire.com/news-releases/new-g2-research-half-of-b2b-software-buyers-now-start-their-research-with-ai-chatbots-302742807.html)). Neither survey is specific to healthcare, but health tech is software, and its buyers are busy people with a shortlist to produce.

Health is also where the assistants are most careful, leaning on sources they can check: NHS England, NICE, the regulators and public registers. That helps a smaller supplier, because being easy to verify matters more than budget. This guide is for founders of health tech and medtech firms, occupational health providers and other suppliers selling to the NHS, private providers and employers. Patient-facing clinics get one section near the end.

## Key takeaways

- AI assistants name healthcare suppliers they can check against public records, so assurance evidence counts for more than any claim about transforming care.
- Digital health suppliers should state their DTAC position, DSP Toolkit status, Cyber Essentials certificate, clinical safety officer and any MHRA registration on one dated page, in plain text.
- NHS England introduced a shorter DTAC form on 24 February 2026, and the old form should not be used from 6 April 2026, so older assurance packs need updating.
- Occupational health providers get named for multi-site questions when their coverage, turnaround, SEQOHS accreditation and named clinicians are written down.
- Independent evidence carries the most weight: framework listings, trade press, independently judged awards and case studies that name the customer.
- Patient-facing clinics still need verifiable clinicians, a CQC rating shown with its date and details that match every directory.

## What do NHS, private provider and employer buyers ask ChatGPT?

They describe a problem, a care setting and a constraint, rarely in the words on your homepage. These are typical of the questions that decide who gets named.

| Buyer | Typical question | What the answer leans on |
|---|---|---|
| NHS digital or transformation lead | "Which virtual ward platforms do NHS trusts use, and what should I check before a pilot?" | Case studies naming trusts, assurance pages, trade press |
| NHS procurement | "Which suppliers are on NHS Supply Chain frameworks for patient monitoring?" | Framework listings, MHRA registration, contract notices |
| Private hospital group | "Which pre-assessment software works with our patient administration system?" | Integration pages, named customers, G2 and Capterra reviews |
| HR director, multi-site employer | "Which occupational health providers cover multi-site employers across the UK?" | Coverage details, SEQOHS listing, named clinicians |
| Anyone checking a name | "Is [supplier] any good? Does it meet the DSP Toolkit?" | Reviews, the public DSPT search, news, your assurance page |

Most health tech websites answer only "who can do this", with a product tour. The questions about what to check, and whether a named supplier is sound, are where a cautious buyer forms a view.

## Why are AI assistants so careful with health suppliers?

Because a wrong answer about health can hurt someone, the assistants are trained to be cautious on medical topics, and that caution carries into supplier questions. They prefer suppliers whose claims match a public record and avoid naming anyone when the evidence is thin. "Clinically proven" and "trusted by the NHS" carry little weight on their own; a named trust, a dated DSPT status and a named clinical safety officer do. We explain the thinking in [how AI assistants judge experience and expertise](/insights/eeat-why-ai-cares-more).

A common result is a supplier the assistants can describe but will not recommend. ID-Pal, which sells identity verification into another regulated market, was there: "AI could describe ID-Pal. It never recommended it." Its industry pages were rebuilt so each "opens with the question a compliance lead types, names the regulator, and answers inside the first ninety words". As the [ID-Pal case study](/work/id-pal) records: "UK buyer questions where AI names ID-Pal: none in May, two in August, four in September 2026." The approach transfers directly to NHS England or the MHRA.

## What do NHS trusts check before buying a digital health product?

They start with the Digital Technology Assessment Criteria (DTAC), NHS England's framework for assuring digital health technology, then look at data security, cyber security, device regulation and evidence of benefit. NHS England says manufacturers must "keep an up-to-date DTAC form and required supporting documents for each product version" ([NHS England, DTAC](https://transform.england.nhs.uk/key-tools-and-info/digital-technology-assessment-criteria-dtac/)).

DTAC covers clinical safety, data protection, technical security, interoperability, and usability and accessibility. NHS England introduced an updated form on 24 February 2026 with 25% fewer questions, and says the previous version should not be used from 6 April 2026.

| What buyers check | What it is | Where it can be checked | What to publish |
|---|---|---|---|
| DTAC | NHS England's assessment criteria, updated February 2026 | Completed by the buyer; no public register | That you hold a current form on the 2026 version, and its date |
| Data Security and Protection Toolkit | Self-assessment against ten data security standards, which [all organisations with access to NHS patient data and systems must use](https://digital.nhs.uk/data-and-information/looking-after-information/data-security-and-information-governance/data-security-and-protection-toolkit) | The public [DSPT organisation search](https://www.dsptoolkit.nhs.uk/OrganisationSearch), showing year and status, such as "Standards met" | Your status, the year and a link to the search |
| Clinical safety (DCB0129) | The clinical risk management standard for manufacturers of health IT | Your safety case, on request | Your clinical safety officer's name and registration |
| Cyber Essentials | The government-backed minimum cyber standard; the NCSC says "a growing number of organisations require suppliers to be certified to bid for work" ([NCSC, September 2026](https://www.ncsc.gov.uk/cyberessentials/overview)) | IASME's certificate search | Level and renewal date |
| MHRA registration | Required before a medical device is placed on the Great Britain market | The MHRA's [public registration database](https://www.gov.uk/guidance/register-medical-devices-to-place-on-the-market) | Device class and registration |
| Evidence of benefit | NICE's [evidence standards framework for digital health technologies](https://www.nice.org.uk/corporate/ecd7) | Your published evaluations | Setting, sample and period for each |

If you sell through a framework, such as one run by [NHS Supply Chain](https://www.supplychain.nhs.uk/) or a Crown Commercial Service framework such as G-Cloud, name the framework and lot and link to the listing, so an assistant can make the connection.

## How do we show buyers, and assistants, that we meet DTAC and the DSP Toolkit?

Put the evidence on one public assurance page, in plain text, dated and linked to the public record. Most suppliers keep it in a PDF sent after a call, where no assistant can see it.

### Step 1: List every standard on one page

Give your DTAC form version and date, DSPT status and year, Cyber Essentials level, clinical safety officer, any MHRA device class, where data is hosted and which interoperability standards you support, as text rather than badges or downloads.

### Step 2: Link each claim to its public record

Link your DSPT status to the organisation search, your certificate to IASME and your device to the MHRA database. A claim a buyer can check in one click gives an assistant a second source that agrees with you.

### Step 3: Date every line

The DSPT is assessed each year and certificates expire. Put the date each item was confirmed beside it; an out-of-date line does more harm than a missing one.

### Step 4: Say what you share on request, and link the page everywhere

Say that the DTAC form, a data protection impact assessment template and the clinical safety case exist and how to ask for them. Then link the page from every product page, case study and tender answer, using the same wording, so your website, framework listing and tenders never disagree.

## What should an occupational health provider publish to be named?

State your coverage, accreditation and clinicians in plain text, because an assistant needs all three to answer "which providers cover multi-site employers across the UK". A provider whose site says only "nationwide service" gives it nothing to repeat.

Accreditation sets a provider apart more than many assume. In a Department for Work and Pensions survey of 200 NHS, in-house and private providers, "only around half of the OH providers surveyed were SEQOHS accredited or working towards SEQOHS accreditation" ([DWP, August 2025](https://www.gov.uk/government/publications/understanding-occupational-health-provision-2023-24/summary-understanding-occupational-health-provision-2023-24)). SEQOHS is hosted by the Faculty of Occupational Medicine and has a [public search of accredited services](https://www.seqohs.org/). If you hold it, say so on every service page and keep your entry's name and locations identical to your website.

For a multi-site employer, publish:

- **Coverage.** Clinic addresses, mobile units, remote assessments and which regions your own clinicians serve.
- **Turnaround.** Typical time from referral to appointment and to report, and how you measure it.
- **Clinicians.** Named occupational physicians and nurses, with GMC or NMC registration and Faculty membership where held.
- **Services by need.** Management referrals, health surveillance, fitness for work medicals and drug and alcohol testing, with the sectors you serve.

Comment from your clinicians in Personnel Today, People Management or HR Magazine puts your name where assistants look for specialists.

## Which outside sources do assistants trust for healthcare suppliers?

Independent sources carry more weight than anything you say about yourself.

| Source | Examples | What to do |
|---|---|---|
| Registers | DSPT search, IASME, MHRA database, SEQOHS, CQC | Keep each entry current and in the same name as your website |
| Procurement | NHS Supply Chain and Crown Commercial Service frameworks, contract notices | Link to your listings and name the lot |
| Trade press | HSJ, Digital Health, Nursing Times, Pulse, Personnel Today | Comment on NHS policy and publish anonymised data |
| Awards | HSJ Awards, HSJ Partnership Awards, Digital Health Awards | Enter the independently judged ones |
| Customers | Case studies naming the trust or employer, joint conference talks | Get written permission and name the customer's lead |
| Reviews | G2 and Capterra for software, Google reviews for services | Ask customers for specific reviews |

Reviews matter more than most health tech firms assume: in G2's survey, 45% of software buyers said citations of review sites were the most confidence-inspiring signal in an AI answer ([G2, April 2026](https://www.prnewswire.com/news-releases/new-g2-research-half-of-b2b-software-buyers-now-start-their-research-with-ai-chatbots-302742807.html)). Our guide to [whether awards and accreditations help you get recommended](/insights/awards-accreditations-ai-trust) explains which kinds count, and firms that also sell outside healthcare should read our guide for [B2B technology companies](/insights/ai-optimisation-technology-companies).

## What about patient-facing clinics?

Clinics get named when an assistant can verify their clinicians, registration and details, and when their pages answer what patients ask before booking.

- **Clinicians.** Give each clinician a page with their registration number (GMC, GDC, NMC, HCPC or GPhC), qualifications and any NHS post, in plain text.
- **Rating and its date.** Show your CQC rating with its date and link to the report. Ratings can be old: the government's review of the CQC found "the average age of current ratings across all locations is 3.9 years" as of July 2024 ([DHSC, October 2024](https://www.gov.uk/government/publications/review-into-the-operational-effectiveness-of-the-care-quality-commission-full-report/review-into-the-operational-effectiveness-of-the-care-quality-commission-full-report)). When a patient asks which private clinics in Leeds have an Outstanding CQC rating, a live assistant leans on the CQC's own listings, so your location names must match your registration exactly.
- **Cosmetic services.** In August 2025 the government said the highest-risk cosmetic procedures will become CQC regulated activities, with local authority licensing for lower-risk ones ([DHSC, August 2025](https://www.gov.uk/government/consultations/licensing-of-non-surgical-cosmetic-procedures)). Say which register your practitioners are on now, and watch for the licensing dates.
- **Reviews.** Fake reviews and concealed incentivised reviews have been banned under the Digital Markets, Competition and Consumers Act 2024 since 6 April 2025 ([DMCC Act, Schedule 20](https://www.legislation.gov.uk/ukpga/2024/13/schedule/20)). The CMA's [fake reviews guidance](https://www.gov.uk/government/publications/fake-reviews-cma208) sets out what businesses must do, and the CMA can now decide for itself whether consumer law has been broken and sanction firms ([CMA, April 2025](https://www.gov.uk/government/publications/the-cmas-approach-to-direct-consumer-protection)).
- **Advertising.** The ASA's remit has covered "marketing claims on companies own websites" since 2011 ([ASA, September 2026](https://www.asa.org.uk/media_channel/Online_catch_up_TV_and_radio_in_app_and_in_game.html)), and prescription-only medicines [may not be advertised to the public](https://www.legislation.gov.uk/uksi/2012/1916/regulation/284).

Publish treatment pages reviewed by the treating clinician, with a dated reviewed-by line, and fees in plain text. None of this is legal advice.

## How do we tell whether it is working?

Keep a fixed list of 20 to 50 buyer questions, run each several times a month in a clean session in ChatGPT, Google AI Overviews and AI Mode, Copilot, Gemini, Perplexity and Claude, and count a win only when it repeats, because answers vary between runs. Add "an AI assistant such as ChatGPT or Copilot" to the "how did you hear about us" options on your forms. Our guide to [checking whether ChatGPT recommends your firm](/insights/track-ai-recommending-your-business) has the full method.

First, check the site can be read. The main AI crawlers fetch pages but do not run JavaScript ([Vercel and MERJ, December 2024](https://vercel.com/blog/the-rise-of-the-ai-crawler)), so product detail that appears only in a script, a PDF or behind a form is invisible to them. Cloudflare has also blocked AI crawlers by default on new domains since July 2025. Our [technical checklist for AI search](/insights/technical-checklist-ai-ready-website) lists what to ask your web team.

## What to do this month

1. Build a public assurance page listing your DTAC form version, DSPT status, Cyber Essentials level, clinical safety officer and any MHRA registration, each dated and linked to its public record.
2. Check that your DTAC evidence follows the form NHS England introduced on 24 February 2026.
3. Write down 20 to 50 questions your NHS, private sector and employer buyers ask, and run them in ChatGPT, Copilot and Google's AI Mode.
4. Rebuild your most important product or service page around one buyer question, naming the care setting and the standard in the first paragraph.
5. Make your name and status match across the DSPT search, IASME, SEQOHS or the MHRA database, framework listings and Google.
6. Ask two customers for written permission to name them in a case study.

## Frequently asked questions

### Is there such a thing as being "DTAC approved"?

No. DTAC is the framework NHS commissioners and providers use to assess a digital health product, and NHS England expects manufacturers to keep an up-to-date form and supporting documents for each product version. There is no central approval or public register. Say that you hold a current form on the February 2026 version, give its date and explain how buyers can request it.

### Can we name NHS trusts as customers?

Yes, with written permission, and it is one of the strongest signals you can publish. Many trusts have their own rules on supplier publicity, so agree the wording with the trust's communications team. A case study that names the trust, the problem, the result and the period it covers is far more useful than a logo wall.

### Which AI assistants matter most to healthcare buyers?

ChatGPT and Google's AI Overviews and AI Mode first, then Microsoft Copilot and Gemini, then Perplexity and Claude. Copilot deserves extra attention because it is what many business buyers have at work, and Forrester found business buyers four times as likely as consumers to use it.

### If we rank well on Google, will ChatGPT name us?

Ranking helps but does not guarantee a mention. Google's AI features, Copilot and ChatGPT search all start from a search index, but Ahrefs found only 38% of AI Overview citations came from top-ten pages in March 2026, down from 76% in July 2025, because Google now runs several related searches for one question ([Ahrefs, March 2026](https://ahrefs.com/blog/ai-overview-citations-top-10)). Covering the follow-up questions matters as much as ranking.

### How long does it take to be recommended?

Assistants that search the web live, such as ChatGPT search, Perplexity, Copilot and Google's AI features, can reflect a new page or trade press article within weeks. Answers drawn from a model's own memory change only when the model is retrained, which takes months. Being named for broad questions usually takes several months of steady publishing and coverage.

If your product is sound but the assistants cannot see the evidence, [Reputation That Wins](/reputation-that-wins) builds the outside record and [Website That Sells](/website-that-sells) puts the assurance on the page. A free [Growth Review](/growth-review) is 30 minutes with David Adams, with three fixes in writing afterwards.

## Sources

- [NHS England, Digital Technology Assessment Criteria (DTAC) (February 2026)](https://transform.england.nhs.uk/key-tools-and-info/digital-technology-assessment-criteria-dtac/)
- [Forrester, B2B buyers make zero-click buying number one (January 2026)](https://www.forrester.com/blogs/b2b_buyers_make_zero_click_buying_number_one/)
- [G2, The Answer Economy: half of B2B software buyers now start their research with AI chatbots (April 2026)](https://www.prnewswire.com/news-releases/new-g2-research-half-of-b2b-software-buyers-now-start-their-research-with-ai-chatbots-302742807.html)
- [Department for Work and Pensions, Understanding Occupational Health Provision 2023-24 (August 2025)](https://www.gov.uk/government/publications/understanding-occupational-health-provision-2023-24/summary-understanding-occupational-health-provision-2023-24)
- [Department of Health and Social Care, Review into the operational effectiveness of the Care Quality Commission (October 2024)](https://www.gov.uk/government/publications/review-into-the-operational-effectiveness-of-the-care-quality-commission-full-report/review-into-the-operational-effectiveness-of-the-care-quality-commission-full-report)
- [Department of Health and Social Care, Licensing of non-surgical cosmetic procedures: government response (August 2025)](https://www.gov.uk/government/consultations/licensing-of-non-surgical-cosmetic-procedures)
- [Competition and Markets Authority, Fake reviews guidance CMA208 (April 2025)](https://www.gov.uk/government/publications/fake-reviews-cma208)
- [Ahrefs, AI Overview citations from top-ten pages (March 2026)](https://ahrefs.com/blog/ai-overview-citations-top-10)