HCA Healthcare: 33 of 100 on Ora's agent-readiness scan
In short
HCA Healthcare scores 33 of 100 on Ora's agent-readiness scan, grade D, read on 9 November 2026. 25 percent of the 132,085 domains Ora ranks score under 30, and the average score is 44. Two agents blocked, two let in, and a robots.txt that says none may enter.
The score
HCA Healthcare is a hospital operator based in Nashville.
- 33of 100, grade DOra's agent-readiness scan of hcahealthcare.com, read 9 November 2026.
- 7Discovery, of 13Whether assistants find the company: search presence, Wikipedia and Wikidata, catalogues.
- 14Access, of 46Whether they can read it: the door, text without JavaScript, llms.txt, structured data.
- 15Usability, of 61Whether they can act through it: an MCP server, an API with a specification, sign-in for agents.
- 0Payments, of 0No check in this layer applied to the site.
25 percent of the 132,085 domains Ora ranks score under 30, and the average score is 44.
Ora's one-line summary: Turns agents away at the door: robots.txt blocks AI search and user-triggered agents, and no OpenAPI spec or MCP server exists.
What an assistant meets at the door
Before an assistant can read, compare or buy, it has to get in. These rows are the door: whether the bot shield lets the main agents through, what robots.txt tells the search, training and user-triggered agents, and whether the home page has text without running JavaScript.
| Check | Result | What Ora saw |
|---|---|---|
| Not blocked by bot detection | Partial, 1 of 2 | Some agents blocked: ChatGPT-User, OAI-SearchBot. A normal browser visit from us got in. |
| Agent crawler reachability | Partial, 0 of 2 | Some agents are blocked - ChatGPT-User: blocked, OAI-SearchBot: blocked, Claude-User: reachable, PerplexityBot: reachable. A normal browser visit from us got in. |
| robots.txt AI crawler policy | Fail, 0 of 2 | AI search crawlers: allowed in 0 of 3 checks (3 crawlers on 1 page). AI training crawlers: allowed in 0 of 2 checks (2 crawlers on 1 page), not scored. robots.txt restricts 3/3 evaluated search page/crawler pairs. |
| robots.txt agent-user policy | Fail, 0 of 2 | robots.txt restricts 3/3 evaluated page/crawler pairs. Checked 3 user-triggered agents (chatgpt-user, claude-user, perplexity-user) on 1 public page. |
| Content without JavaScript | Partial, 1 of 3 | Homepage: 1142 chars of readable text, but no H1 tag. No inner pages checked: the scan found none to sample. |
| Homepage not hidden from search | Did not apply, 0 of 1 | robots.txt blocks the AI search crawlers (oai-searchbot, claude-searchbot, and perplexitybot) from the homepage, so they never read its indexing tags. The robots.txt checks score that block. |
What it can read, and what it can do
The reading layer is what an assistant takes away from the pages: a text file written for it, markdown on request, structured data about the company, a sitemap. The act layer is whether it can do anything through a published interface rather than by clicking through the site.
| Check | Result | What Ora saw |
|---|---|---|
| llms.txt exists | Fail, 0 of 1 | No llms.txt found at /llms.txt or /.well-known/llms.txt. |
| llms.txt formatting | Fail, 0 of 2 | No llms.txt found to evaluate quality |
| Markdown agent docs | Fail, 0 of 1 | Missing markdown content negotiation. Homepage returned text/html when probed with Accept: text/markdown (expected text/markdown), and none of the well-known root paths (/llms.md, /auth.md, /agents.md, /developers.md). |
| Bot-UA markdown serving | Fail, 0 of 1 | No probed bot User-Agent (ChatGPT-User, Claude-User, Perplexity-User) receives markdown when requesting HTML. Optional: detect AI-bot UAs server-side and serve them a markdown representation directly. |
| JSON-LD structured data | Partial, 2 of 4 | JSON-LD Organization found - missing name, description, and url on this entity |
| Organization schema completeness | Pass, 2 of 2 | Organization schema complete with contactPoint and address |
| Sitemap exists | Pass, 2 of 2 | Valid sitemap found at /sitemap.xml with 1 entries |
| Metadata completeness | Partial, 1 of 2 | 3/4 metadata signals present - missing: og:image |
| Page token budget | Pass, 1 of 1 | All 1 measured page fit an agent context budget (largest ~1K tokens) |
| Check | Result | What Ora saw |
|---|---|---|
| MCP server / manifest | Fail, 0 of 6 | No MCP server or manifest found |
| MCP well-known discovery | Fail, 0 of 2 | No MCP server URL discovered |
| Public API with reachable endpoints | Pass, 7 of 7 | GraphQL endpoint at https://hcahealthcare.com/api/graphql is reachable; introspection requires authentication (API key / OAuth), which is expected for agent access. Best-of-protocols score: 7/7. |
| Public API/docs linked from homepage | Fail, 0 of 3 | No public API or documentation page linked from homepage |
| OpenAPI spec published | Fail, 0 of 7 | No OpenAPI/Swagger specification found |
| Developer portal | Did not apply, 0 of 6 | No developer portal found |
| OAuth 2.0 support | Fail, 0 of 5 | No OAuth 2.0 or OpenID Connect support detected |
| Scoped permissions | Fail, 0 of 5 | No declared OAuth scopes, security schemes, or scoped-permission documentation found |
| Multi-language SDK packages | Did not apply, 0 of 3 | No SDK packages found across language ecosystems |
| CLI tool available | Did not apply, 0 of 3 | No CLI tool found |
| WebMCP support | Fail, 0 of 5 | No WebMCP support detected - no document.modelContext / navigator.modelContext usage found (scanned 11 of 11 same-origin script bundle(s) for modelContext registrations) |
| Check | Result | What Ora saw |
|---|---|---|
| Wikipedia / Wikidata entity presence | Pass, 4 of 4 | Wikipedia "HCA Healthcare" and Wikidata Q1630431 both verified - domain confirmed on both sources |
| Brand name discoverability | Pass, 3 of 3 | hcahealthcare.com ranks #4 for "HCA Healthcare" (searched your brand name alone: no main product term from your homepage qualified) |
| Category share of voice | Did not apply, 0 of 6 | Category share of voice is in beta. It measures whether agents surface you for capability and use-case searches (not just your name). |
| Developer resource discoverability | Fail, 0 of 3 | In a search for your API docs, none of the 10 results is your official docs |
The six payment checks did not apply on this read: Ora did not read the site as a shop.
Three fixes to hand to the web team
Ora estimates how many points each open check would return. These are the largest on this read, in Ora's words where it gave them, so a leader can hand the list over without translating it.
- Developer resource discoverability, worth about 5.1 points by Ora's estimate: In a search for your API docs, none of the 10 results is your official docs.
- OpenAPI spec published, worth about 5.1 points by Ora's estimate: No OpenAPI/Swagger specification found.
- MCP server / manifest, worth about 4.4 points by Ora's estimate: No MCP server or manifest found.
Our read
HCA Healthcare turns two agents away and lets two in, a policy halfway written. ChatGPT-User and OAI-SearchBot were blocked while Claude-User and PerplexityBot reached the home page, and robots.txt disallows all three AI search crawlers and restricts all three user-triggered agents, so the two that got in did so against the stated rule. The home page gives 1,142 characters without an H1, the scan found no inner page to sample, the sitemap lists one entry, the Organization block has contact and address but no name, description or URL, and there is no llms.txt, so the Access layer reads 14 of 46. The act layer is a GraphQL endpoint at hcahealthcare.com/api/graphql with introspection gated, and no portal, specification, MCP server or OAuth discovery around it, so the Usability layer reads 15 of 61. Wikipedia and Wikidata confirm the company, and the domain ranks fourth for its own name. A hospital operator should decide which agents may read it and say so once; robots.txt is where that sentence goes.
Test your own site
Run the same scan on your own domain at ora.ai. The score, the layers and the fixes on this page come from its public result for hcahealthcare.com; a scan of a public site takes a few minutes and needs no account.
- Scan your domain on OraThe same checks, the same scoring, on your own site.
- The self-check, 18 questionsWhat to ask for, in business terms, before the scan.
- All the 360 checksThe other companies in this series, newest first.
Sources
- Ora report for hcahealthcare.com (ora.ai/score/hcahealthcare.com), read 9 Nov 2026. Vendor claim.
Last reviewed