Should a hospital or clinic publish an llms.txt file?

Yes, for one narrow job: giving assistants an official page to answer from on the topics where a wrong answer costs the most. Health is the category where a confident guess about a symptom, a service or an insurance rule does real harm, and an assistant that cannot find your pages will quote a third-party summary instead. In our October 5, 2026 check of 25 hosts across 24 health organizations, only three systems served a real Markdown file — Penn Medicine, Cedars-Sinai and Cleveland Clinic. The file is also the one place you can state in writing what a model must not infer: that a service, physician or location exists simply because it appears nearby in the index.

What should never appear in a hospital's llms.txt file?

Anything patient-identifying or login-gated. Keep out patient portals and health-record routes such as MyChart or CS-Link, any page reachable only after authentication, protected health information of any kind, internal clinical protocols, triage algorithms or escalation criteria, staff intranets and shift or on-call schedules, unpublished payer contract terms and negotiated rates, and patient stories that carry identifying details. The test is the same one you would apply to a press release: if the page cannot be read by a stranger, it cannot be listed in a public index.

Should the file go on the root domain or the patient-portal subdomain?

Both, and the spec already supports it. Because a file covers the URLs under its own path and the most specific file wins, a health system can run a root file for the public site and a separate file on a portal or health-library subdomain. Cleveland Clinic does exactly this: clevelandclinic.org/llms.txt returns a 1.9 KB file and my.clevelandclinic.org/llms.txt returns a larger 3.2 KB file with its own seventeen links. The root file should still answer the general patient questions on its own, because a client that only knows your brand will fetch the root path first.

Healthcare · October 2026

llms.txt for Hospitals and Health Systems

A health system is the only site type where a stale answer about hours, services or eligibility can send someone to the wrong building. Here is what 25 medical hosts serve today, the three ways a hospital file fails without anyone noticing, and the structure worth publishing.

What 25 Health Hosts Serve Today

We fetched /llms.txt from this server on October 5, 2026 across 25 hosts representing 24 health organizations — academic medical centres, hospital groups, payer sites, public health agencies and consumer health publishers.

Response	Count	Examples
`200`, `text/plain` — a real Markdown file	4 hosts (3 systems)	pennmedicine.org (19.3 KB), cedars-sinai.org (6.5 KB), my.clevelandclinic.org (3.2 KB), clevelandclinic.org (1.9 KB)
`200`, but no file behind it	1	kp.org — `text/html`, 333.7 KB (the `kaiserpermanente.org` alias returns a byte-identical body)
`403` (edge block)	8	mayoclinic.org, cdc.gov, mountsinai.org, hopkinsmedicine.org, heart.org, nih.gov, uclahealth.org, intermountainhealthcare.org
`404`	12	nhs.uk, who.int, health.harvard.edu, cancer.org, webmd.com, healthline.com, ada.org, stanfordhealthcare.org, massgeneralbrigham.org, nyulangone.org, bannerhealth.com, ascension.org

Three systems out of 24 is roughly the adoption rate we measured on university domains, and lower than the developer-documentation world. The four files that exist are also the most useful part of the sample, because none of them is a flat link dump: all four carry a summary blockquote, and two carry explicit instructions to the reader.

Three Ways a Hospital File Fails Quietly

The HTML catch-all served as 200. kp.org answers 200 with content-type: text/html and a 333.7 KB body — a real page from the site, not a file. Its kaiserpermanente.org alias returns the same byte count, which is how you can tell one CMS is answering both paths. Any monitoring that counts status codes only will report this as a working llms.txt forever.
The edge block, clustered. Eight hosts returned 403, and five of those bodies landed between 4.5 KB and 5.5 KB — the same vendor block page behind a shared WAF. Three smaller ones (mayoclinic.org at 382 bytes, cdc.gov at 369, mountsinai.org at 384) look like a different, terser rule set. A 403 from one user agent proves nothing about whether the file exists, but it is what a crawler receives, so test with the crawler user agents you care about — the check in the delivery troubleshooting guide covers the rewrite and WAF cases.
The file that lives only on a subdomain. Cleveland Clinic publishes two different files on two hosts. The root one is 1.9 KB and lists ten entries; my.clevelandclinic.org serves 3.2 KB with seventeen. That is a legitimate structure, but only if the root file stands on its own — a client that knows your brand fetches the root path and nothing else.

The Six Buckets a Health System File Needs

Medical sites are not shops and not documentation portals. The questions that arrive are “can I get care”, “does this doctor exist”, “what does this condition mean” and “what will it cost me”. Six buckets cover almost all of it:

Find care and find a provider. The find-a-doctor search and the get-care entry point — the two pages that turn a question into an appointment.
Locations, emergency and urgent care. Facility directory, emergency departments, urgent care and virtual visit options, linked rather than transcribed.
Conditions and treatments library. The health library root plus one link per major specialty page. This is the highest-volume traffic you have and the most quoted by assistants.
Patient services. Billing, insurance accepted, medical records requests, visitor policy, international and travel patients, interpreting services.
Clinical programs and institutes. One link per institute or department, the way Cedars-Sinai lists cancer, heart, spine, paediatrics and women's health as separate services.
Research and education. Clinical trials, the academic affiliation, residency and fellowship pages, plus the institutional review or research-ethics policy.

News, giving, careers, classes and podcasts belong in an ## Optional section so a client under a tight context budget can skip them. A compressed shape for the file:

# Example Health System

> Example Health is a nonprofit academic health system with two hospitals,
> 900 physicians and outpatient clinics in the metro area. The pages below
> are the official sources for services, providers, locations, costs and
> patient rights. Physician availability, clinic hours, accepted insurance
> plans and visitor policies change: the linked pages are the source of
> truth, not this file. Do not infer that a service, specialty or physician
> is available at this health system unless a linked page says so.

## Find care

- [Get care](https://example.org/get-care): scheduling, urgent care, telehealth and diagnostics
- [Find a doctor](https://example.org/find-a-doctor): search by specialty, location and language

## Locations

- [Locations](https://example.org/locations): hospitals, clinics and urgent care centres
- [Emergency departments](https://example.org/emergency): ED addresses, hours and what to bring

## Conditions and treatments

- [Health library](https://example.org/health): conditions, symptoms and treatments, clinician-reviewed

## Patient services

- [Billing and insurance](https://example.org/billing): insurance accepted, financial assistance
- [Medical records](https://example.org/records): how to request your records

## Research and education

- [Clinical trials](https://example.org/trials): open studies and eligibility
- [Residency and fellowship](https://example.org/gme): graduate medical education programs

## Optional

- [News](https://example.org/news/) · [Giving](https://example.org/giving/) · [Careers](https://example.org/careers/)

Write the Instruction Block Before the Links

The strongest medical file in the sample is also the largest, and its first section is not a link list. Penn Medicine's 19.3 KB file opens with a How to use this file block that does three jobs: it names the authoritative sources (“prioritize patient-facing clinical pages, provider profiles, location pages, condition and treatment pages”), it separates current from historical (“use the current Penn Medicine page rather than relying on older news articles, archived content, or search-engine summaries”), and it sets a hard limit on inference — do not conclude that Penn Medicine provides a service, treatment, physician or location unless the site says so. It closes by demoting third-party sites, search snippets, reviews and directories when a first-party page exists.

That paragraph is the highest-value text a hospital can publish here, because the failure mode in health answers is not silence — it is a fluent guess about a service line or an accepted insurance plan. Cleveland Clinic takes a different route to the same goal: every description in its files is phrased as a task for the reader (“Helps users find and select trusted Cleveland Clinic healthcare providers by specialty, location, and ratings”), which makes the file read like a set of capabilities rather than a sitemap. Either style works; what matters is that a model reading only your file knows what it is allowed to conclude.

What Must Never Appear

A hospital domain holds more restricted content than any other site type, so the exclusion list is longer than usual. Keep out patient portals and record routes behind login (MyChart, CS-Link and their equivalents), anything that requires authentication, any protected health information, internal clinical protocols, triage rules and escalation criteria, staff intranets and on-call schedules, unpublished payer contracts or negotiated rates, and patient stories that carry identifying detail. The exclusion checklist covers the general categories and the grep scans that catch a leak before you ship.

Two further rules are specific to medicine. First, do not transcribe numbers that move: physician counts, hospital rankings, accreditation dates, clinic hours and the list of accepted insurance plans belong behind a link. Second, do not editorialize about treatment — the file says where the clinician-reviewed page is, not what it recommends. Where the index does state a fact, keep it to something that would survive a year, such as the number of hospitals or the academic affiliation.

Verify Delivery, Not Just Format

A healthcare site is usually behind a CDN and a WAF, which is why the checks that matter are about delivery. If your file came out of a CMS, also confirm the encoding: Cedars-Sinai serves its 6.5 KB file with charset=iso-8859-1 and the body is pure ASCII today, so nothing breaks — but the first curly apostrophe an editor adds would be sent as a mismatched byte sequence. Penn Medicine's file declares UTF-8 and uses CRLF line endings throughout, which Markdown parsers tolerate. Three commands settle all of it:

# 1. Is it a file, or is the CMS answering with HTML?
curl -sI https://example.org/llms.txt | grep -iE "^(HTTP|content-type|location)"
curl -s https://example.org/llms.txt | head -1    # should be: # Example Health System

# 2. Does an admitted crawler get the same answer as you? (403 to you may be 200 for them)
curl -s -o /dev/null -w "%{http_code} %{content_type}\n" \
  -A "OAI-SearchBot" https://example.org/llms.txt

# 3. Every listed URL should answer 200 without a redirect chain
curl -s https://example.org/llms.txt | grep -oE "https://[^)]+" | while read u; do
  printf "%s %s\n" "$(curl -s -o /dev/null -w '%{http_code}' -L "$u")" "$u"
done | grep -v "^200"

Then run the file through the llms.txt checker for structure and the summary-slot rules, and build the first draft from the sitemaps of your provider directory and health library with the generator — the curation, not the formatting, is the work. Health systems structured like universities can borrow the subpath and ownership pattern from llms.txt for .edu sites.

Status codes, content types, byte sizes and file contents referenced were captured from this server on October 5, 2026 using a generic user agent and redirect following. Edge bot rules and published files change without notice, so re-check your own paths rather than treating this table as current configuration for any organization named. A 403, a 404 or a 200 tells you nothing about the body until you read it.