The landscape of internet privacy is ever-evolving, especially within the last 3-4 years. As we saw with the GDPR regulations and CCPA, privacy is important for users of websites and law-makers. As marketers, it is our responsibility to adhere to compliance and keep the best interest of the user at the forefront of our implementations.
How to Use Healthcare Marketing Analytics Responsibly
When GDPR and CCPA passed, most industries had to make some major changes to tracking—but HIPAA has always protected healthcare data. However, with the ever-changing landscape of telehealth, online healthcare marketing has become a murky subject. Not every “healthcare” website is a HIPAA entity (think medspa, aesthetics, etc.), which makes PHI (protected health information) and PII that much more important to understand and protect when tracking customers.
Understanding and Protecting PHI and PII
PHI is covered by HIPAA entities. According to the HIPAA Journal, PHI in 2024 is “any information relating a patient´s condition, the past, present, or future provision of healthcare, or payment thereof. It becomes individually identifiable health information when identifiers are included in the same designated record set, and it becomes protected when it is transmitted or maintained in any form (by a covered entity).” PHI is protected by HIPAA and not allowed to be collected by Google Analytics. The linked article goes into detail about key considerations for companies when looking into how their analytics is integrated and what they are collecting. The identifiable part of the definition is key here. Marketers have to ensure they are not collecting PHI and not using it to remarket to their customers.
Ethical and Accurate User Tracking in Healthcare
Now that we know that we cannot collect PHI in Google Analytics, let’s look forward to how we can ethically and accurately track users in the healthcare space. The first step is understanding what can and cannot be tracked. We always stress that while we are very knowledgeable about the global privacy landscape, we always recommend to loop in your legal team when discussing how to move forward with tracking and what the legal implications are for your company.
Conducting Audits and Risk Assessments for Compliance
An audit and risk assessment of your current set-up would be the first place to start. Are you collecting any custom information that could be considered PHI? InfoTrust is able to provide a risk assessment and audit your property to ensure you are not collecting PII or PHI and provide clean-up measures.
After your audit, take time to strategize a measurement plan of what is strictly necessary for business and what is nice to have. Responsible use of analytics takes strategy and guidance from trusted partners like InfoTrust and your legal team. Along with clean-up of your tracking, it is always important to be aware of user consent and look into a consent management platform. Here, you can ensure transparent tracking and allow users to opt in or out of tracking.
Strategizing for Responsible Use of Analytics
For healthcare companies, it is extremely important to stay up-to-date on privacy changes and to work with partners that have you and your users best interests in mind. Moving into a more advanced set up, some companies have opted for a server-side set up where they can have full transparency and ownership of their data as it lives in their own server. This is a durable solution for first-party data collection.
To responsibly use analytics in healthcare marketing, marketers must first understand the landscape and just how important it is to thoroughly vet any strategy and custom dimensions before setting up tracking. Understanding what PHI and PII is and being able to strategize without using this information is vital for marketers to create compliant campaigns.
