The terms, without the jargon.

Plain explanations of the terms you will hear when discussing AI, business systems and online visibility, with attention to what each one means for your organization. Use it to understand a proposal and ask better questions before you commit. No technical background required. You do not need to learn them all; start with the word in front of you.

What these systems are

Model and large language model LLM: A model is the trained system inside an AI product. It has learned patterns from training data and uses them to produce outputs. A large language model is a model trained to process and generate language; a core part of how it writes is predicting the next token from the material in front of it. A product such as a chat assistant adds search, file access, memory and other tools around the model, so the model and the product are not the same.
Prompt: The question, instruction or other input given to a model. What you type is part of the prompt; the system may also supply its own instructions and supporting material.
Context and context window: Context is the material supplied to the model for the task in hand: instructions, pasted text, uploaded files or retrieved passages. The context window is the limit on how much of that it can work with at one time, measured in tokens. Supplying context does not retrain the model, and how long a service keeps that material depends on the product, its settings and your agreement. In a long conversation, a product may set aside, summarize or look up earlier material rather than keep every word in view.Like a working desk rather than a filing room. What is off the desk is not in front of the model at that moment, which is different from being deleted.
Memory: A feature that carries selected information from earlier interactions into later conversations. Depending on the product, it may use saved preferences, details you ask it to remember or information from past chats. Memory is not a complete record of what you have said. Check what is saved, how you can review or correct it, and how it is deleted. Deleting a conversation may not delete a separately saved memory.
Training: The process of adjusting a model's internal settings using data. A model can go through several stages of training, including later fine-tuning. An ordinary conversation generally uses the trained model rather than changing it as you type; whether a provider stores that conversation or later uses it for training is a separate question.
Hallucination: An output that presents invented or unsupported information as established fact. It can sound confident and can include made-up quotations, references or details.Why it matters to a practice: review should include anything said about credentials, services and patient-facing information.
Token: A unit used to process text. A token may be a word, part of a word, punctuation or another small piece of the input. Tokens measure context limits and, in many services, usage charges.

What they can do

Automation: A process that runs by predefined rules. It can include conditions and branches without letting an AI decide its own approach. For a well-defined task, a fixed workflow can be easier to test and supervise than an agent; the right design depends on the work and its risks.
Agent: An AI system that can choose and carry out steps toward a goal, using the tools and permissions it has been given. A fixed workflow follows a set path; an agent has some discretion over which step comes next. That discretion is why its limits, testing and oversight matter.
Tools: Functions an AI system can call, such as searching the web, reading a file or sending an email. The tools and their permissions set what the system can do. They are part of the safety design, not a guarantee of safety on their own.
Guardrails: Controls that limit what a system can access or do, and mark the actions that need approval. They can include access restrictions, validation checks, spending limits and required review. A written instruction alone is different from a restriction the system enforces.
Human in the loop: A design that requires a person to review, approve or correct the system's work at set points.How we work: in our builds, anything headed for a patient, a chart or outside the organization is approved by a person first. That is our standard for those workflows, and narrower than the general definition.
Evaluation often shortened to evals: A structured way to test whether a system does the task you intend. You give it representative cases, judge the results against agreed criteria, and repeat the checks whenever the system changes. A convincing demonstration is not the same as a completed evaluation.

Working with your own knowledge

Context and memory, above, are two ways in. These are the others.

Second brain: An external digital repository for your notes, ideas, research and daily learnings, so your biological brain can focus on thinking and creating rather than remembering.With AI: your notes are the memory, and the assistant is the librarian. Instead of searching folders, you ask a question in plain language and it answers from your own archive.
RAG retrieval augmented generation: A method that retrieves relevant material from a document collection or database and supplies it to the model as it answers. A well-built system can link each answer to the material it retrieved, but retrieval does not guarantee a correct answer. For a practice, the questions that matter are permissions, source quality, retention, hosting and review.Like a filing cabinet the system consults, rather than a collection it has memorized.
Fine-tuning: Further training a model on selected examples to change how it performs a task or responds. It can improve consistency, format or performance in a specialty. It can also build some knowledge into the model, but that is not the same as looking up a current record when answering. RAG and fine-tuning can be used together.

Where your information goes

Before connecting a system to your work, ask where information is stored, who can access it, how long it is kept and what happens when you leave. These terms help you understand the answers.

Cloud-hosted: Running on infrastructure provided by another organization rather than on hardware at your premises. Cloud hosting is not automatically unsuitable for patient information; under HIPAA, the arrangement has to meet the applicable requirements, including a BAA where one is required and an assessment of the risks.
On-premises: A system running on hardware at your organization's own premises. Where it sits does not, by itself, settle where all information goes: outside connections, backups, logs and support access still need checking.
Self-hosted: A system your organization deploys and manages itself, rather than a fully managed service. It may run on your own premises or on rented servers elsewhere, so self-hosted does not always mean the records stay in the building.
Data retention: How long a service keeps your information, including conversations, uploaded files and logs. Different parts of a service may keep things for different lengths of time. "Not used for training" does not mean "not stored."
Permissions and access controls: Permissions define what a person or system is allowed to read, change or do. Access controls enforce those limits. For example, an assistant may be allowed to read approved files and draft a message, but not edit a patient record or send the message. Give it only the access needed for its task, and review that access when its responsibilities change.Worth knowing: this is the principle of least privilege.
Encryption: Protecting information by encoding it so it cannot be read without the right key. "In transit" means while it moves between systems; "at rest" means while it is stored. Encryption is an important protection, but it does not replace access controls, required agreements or other safeguards.
Audit trail: A record, in order, of events such as access, changes, approvals and system actions. Its value depends on what is recorded, how reliably it is kept and whether someone reviews it. It supports routine oversight as well as review after a problem.

Being found in search and AI

Three overlapping terms describe work that helps people and search systems find, understand and use your information.

Why this is coming up now

Two phrases from the trade press describe related changes. The agentic web is a developing way of using the internet in which AI systems do more than return links: they search, compare and take steps toward a goal, such as checking availability or preparing a booking, within the access they have been given. The Great Decoupling is a phrase for the widening gap between appearing in search and receiving visits from it, often because an AI-generated answer gave the reader enough without a visit. Falling traffic does not, by itself, say what went wrong, so visibility, clicks and useful enquiries are worth reading separately.

SEO search engine optimization: Helping search engines discover, understand and present your website to people looking for what you offer. The work covers access to your pages, clear content, site structure and the other signals that help search systems read them, and it is not limited to ranking among blue links. Google says the best practices for SEO remain relevant to its AI search features.
AEO and GEO answer engine and generative engine optimization: Two overlapping terms for making your information clear and accessible to systems that answer questions directly or write their own responses, rather than only returning links. The aim is to make your information useful as an answer, or as a source for one; it does not mean a single answer, no ranking, or a guaranteed place for your business. The labels vary between providers, so ask what work is actually included. Google says no special optimization is needed to appear in its AI search features.
AI Overview: An AI-generated summary Google shows for some searches, alongside links to supporting material. It can help someone understand a topic before opening several websites. It does not appear for every search, and its format varies.
Zero-click search: A search that ends without the person clicking through to an outside website. They may have found an answer on the results page, changed their search or stopped looking. It describes the absence of a click, not what the person learned or whether an agent acted.
Citation: A source reference attached to an answer, often with a link. A mention names your practice; a citation points to a source. An answer can mention you while citing someone else, so the two are worth tracking separately. A citation gives the reader something to check; it does not, by itself, make the answer correct.
Crawl and index: Crawling is a search system fetching a page. Indexing is processing and storing information about that page so it can be considered for results. They are separate steps: a page that can be crawled is not guaranteed to be indexed or shown. For Google's AI search features, a supporting page must be indexed and eligible to appear with a snippet.
Structured data also called schema: Standardized labels in your website's code that describe information on the page, such as an organization, a person, a service or an address. They help machines read the content. They should agree with what a visitor can see, and they do not guarantee a search feature, a citation or a recommendation.
Entity: A specific person, organization or place, rather than only the words used to name it. For a practice, that means telling this clinic, at this location, with these practitioners and services, apart from another organization with a similar name.

Words around patient records

These explanations use U.S. HIPAA terminology. What your practice requires should be confirmed with your legal, privacy and security advisors.

Covered entity: Under HIPAA, a health plan, a health care clearinghouse, or a health care provider that conducts certain transactions electronically. It names the organizations the HIPAA rules apply to directly. Not every business that handles health-related information is a covered entity.
PHI protected health information: Individually identifiable health information held or sent by a HIPAA covered entity or its business associate, under the rule's definitions and exceptions. It can be electronic, on paper or spoken, and is not limited to the chart.
De-identified: Health information that meets the standard for no longer identifying a person. HIPAA recognizes two methods, Safe Harbor and Expert Determination. Removing names alone does not make records de-identified.
BAA business associate agreement: A written agreement required when an organization acts as a business associate under HIPAA. It sets out the permitted uses and disclosures of PHI and the associate's responsibilities. It is not needed for every outside party; where it is needed, it is signed before the covered work begins. A signed BAA is not, by itself, proof that a service is compliant.
EMR or EHR: An electronic system for patient health records. EMR, electronic medical record, usually means the records within one practice. EHR, electronic health record, carries a broader emphasis on information shared across care settings. People often use the two interchangeably, so it is worth asking which system and functions they mean.

Two fair questions to ask anyone selling this

"Where does our information go, who can access it, and how do we export or delete it?" There should be a specific answer covering the system and its providers, not only the model.
"What happens when it gets something wrong?" A good answer names what is checked before use, who is responsible, how an error is corrected, and when the system stops for approval.

What can be improved is the accuracy and structure of the information these systems draw on. Whether a system recommends, cites or names a particular practice rests with the system, so that is the part no one can promise.

ServicesWhat each line of work includes

Who it is for, what it covers, and where an engagement begins.

Next stepBook a call

A first conversation about what your organization needs.