Resources · AI Citations and Sources

Why Is ChatGPT Citing a Page My Medical Practice Never Published?

When ChatGPT cites a page your medical practice never published, there are six usual explanations. ChatGPT may have invented a plausible URL on your domain. The page may exist but have been forgotten, such as an old CMS page, a PDF or an automatically generated archive. A vendor or platform may have created it on your domain. Your site may have been hacked and spam pages injected. An internal search results page may have been indexed. Or the page may sit on a lookalike or copycat site that uses your practice's name. Open the URL, check its status code, and look at your server logs, content management system and Search Console. Each case needs a different response, and in healthcare the stakes are higher.

How do you tell the cases apart?

What you find Likely case What it means
The URL returns a 404 and has never existed in your logs or CMS Invented URL ChatGPT constructed a plausible address; there is nothing to remove
The URL loads an old page, PDF or archive in your CMS Forgotten page Your site published it at some point, perhaps automatically
The URL loads a page built by a booking, marketing or directory platform Vendor-created page Someone with access to your domain published it
The URL loads unfamiliar content, often about drugs, gambling or foreign-language products Hacked content Spam was injected into your site
The URL contains a search query, such as /search?q=... Indexed search results Your site search generated a page that was crawled
The domain is similar to yours but not yours Lookalike or copycat site Someone else is using your name

Invented URLs are more common than many people expect. An Ahrefs study of 16 million URLs, published in September 2025, found that 2.38% of URLs cited by ChatGPT returned a 404, against 0.84% for a baseline. The causes were a mix of once-valid pages that had been removed and invented URLs that follow a site's real URL pattern.

What should you check?

  1. Open the URL in a private browser window and note the status code, using a header checker if needed.
  2. Search your server logs for the path. Look at when it was first requested, by whom, and what your server returned.
  3. Search your CMS for the page, including drafts, attachments, archives, tag pages and media files.
  4. Ask your vendors: website provider, booking system, marketing agency and any directory integrations.
  5. Check Search Console: the Pages report for unfamiliar indexed URLs, the Security Issues report for hacking, and Manual Actions.
  6. Search Google for your domain with the site: operator and unfamiliar words from the cited page.
  7. Check a web archive for past versions of the URL.
  8. Look up the domain's registration if the page is on a different domain.

What should you do in each case?

Invented URL. There is nothing to take down. Make sure a real page covers the topic the answer was about, so future answers can cite it. If the answer made medical claims attributed to your practice, record it and report it through ChatGPT's feedback options. How to handle fabricated statements is covered in how to document a false statement generated by an AI assistant.

Forgotten page. Decide whether it should exist. If not, remove it and return a 404 or 410, or redirect it to the current equivalent. If it should, bring it up to date and through your normal review. Old service pages, outdated prices and former clinicians are common finds.

Vendor-created page. Review it as if you had written it, because patients will assume you did. Many healthcare marketing platforms generate location pages, condition pages or blog posts automatically. Check every medical claim, and remove or rewrite anything you would not approve. Agree in writing that nothing is published on your domain without your sign-off.

Hacked content. Treat it as a security incident. Google's spam policies list hacked content as a violation. Its Security Issues report in Search Console shows whether Google has detected hacking. Clean the site, close the vulnerability, change credentials and request a review in Search Console. Check whether any patient data was exposed, since that may trigger breach obligations under health privacy law.

Indexed search results. Add noindex to internal search results pages, and stop linking to them. Spammers sometimes create links to site searches containing spam phrases, so that indexed search pages show their text on your domain.

Lookalike or copycat site. Record it, report it to the hosting provider and to Google, and take advice on trademark and domain dispute options. Tell patients where your real site is. How impersonators appear in AI answers is covered in how to find every buyer question where ChatGPT recommends an impersonator.

What if the page is a directory profile that looks like your site?

Sometimes patients, and assistants, treat a directory or booking-platform profile as your own page. It may carry your logo, photos and a description you never wrote, and sometimes a phone number that routes through the platform. If ChatGPT cites such a profile, check what it says about your services, clinicians, insurance and hours. Claim the profile if the platform allows it, correct the details, and link it to your own website. Where the profile was created without your involvement and contains wrong information, ask the platform to correct or remove it. Your own site should always carry the fuller, more current version of the same facts.

Why does this matter more for medical practices?

  • Medical claims carry risk. An unreviewed condition page on your domain can state treatments, outcomes or guarantees you would never publish, and patients will attribute them to you.
  • Health sites are targets. Spam campaigns selling medicines often target sites with health-related authority.
  • Privacy obligations. Exposed forms, test data or patient information can create legal duties.
  • Trust. Patients checking a practice before booking are put off by strange or wrong pages.

How do you prevent it?

  • Keep an inventory of every public URL on your domain, and compare it with a monthly crawl.
  • Limit who can publish. Require approval for vendor-created pages.
  • Keep your CMS and plugins updated, use strong authentication, and remove unused accounts.
  • Noindex internal search results, tag archives and attachment pages you do not need.
  • Monitor Search Console for new indexed pages and security alerts.
  • Check AI answers about your practice every month, and open every cited URL.

What might an illustrative case look like?

Consider an illustrative dermatology practice that found ChatGPT citing "/treatments/laser-hair-removal-guaranteed-results" on its domain. The practice offered laser hair removal but had never promised guaranteed results. The URL returned a live page. Server logs showed it had been created eight months earlier through an integration with a marketing platform that generated service pages automatically. The practice removed the page, audited the platform's other 40 pages and rewrote 12 that made claims it could not support. It also changed the contract so nothing was published without approval. Later answers cited the practice's own reviewed treatment page instead.

What do people ask about unexpected pages in ChatGPT citations?

Does a 404 mean ChatGPT made the page up?

Often, but not always. Check your logs and archives. The page may have existed briefly or been removed.

Can ChatGPT invent pages on my domain on purpose?

Not on purpose. Models generate plausible text, including plausible URLs, and sometimes cite addresses that do not exist.

Should I tell patients?

If wrong medical information attributed to you was widely seen, or patient data was exposed, yes. Take advice on the right wording and channel.

Published by The Kovmere Team · updated Sep 29, 2026 · More resources