Digital marketing has become an essential tool for healthcare companies to reach and engage potential patients. At the heart of many digital marketing strategies lies pixel tracking, a technology that has revolutionized how marketers measure and optimize their campaigns.

Pixel tracking involves placing a small piece of code on a website that collects data about user behavior. This data helps marketers understand user interactions, measure conversions, and refine their targeting strategies. However, the healthcare industry faces unique challenges when implementing such technologies due to stringent privacy regulations.

In recent years, server-side data connections, such as Meta’s Conversions API, have emerged as an alternative to traditional pixel tracking. These technologies offer similar functionality but process data server-side, potentially providing greater control over data sharing and privacy. For digital health companies, effective marketing is crucial for patient acquisition and growth. These companies often operate in competitive markets and rely on digital channels to reach potential patients. Accurate tracking and measurement of marketing efforts are vital for optimizing spend and improving patient outcomes.

However, recent legal challenges and guidance from the U.S. Department of Health and Human Services (HHS) have raised questions about healthcare marketers using tracking technology in marketing. The HHS issued guidance suggesting that the use of tracking pixels and similar technologies could potentially violate HIPAA rules under certain circumstances.

This situation has created a tension between marketing effectiveness and privacy concerns. Digital health companies must now navigate a complex landscape where the drive for marketing performance must be balanced against the imperative to protect patient privacy and comply with regulations.

As we delve deeper into this topic, we’ll explore the current regulatory environment, examine recent legal developments, and discuss strategies for digital health companies to maintain effective marketing practices while ensuring compliance with privacy regulations.

HHS Guidance on Online Tracking Technologies

History of HHS guidance on pixels and overview of the recent bulletin

The Department of Health and Human Services (HHS) has been providing guidance on the use of technology in healthcare settings for years, adapting its recommendations as digital tools evolve. In December 2022, the HHS Office for Civil Rights (OCR) issued a bulletin addressing the use of online tracking technologies by HIPAA-covered entities and business associates.

Interestingly, despite recent legal challenges that seem to limit the circumstances under which marketing pixels can lead to HIPAA violations, HHS has chosen to reaffirm its previous stance. In June 2024, HHS released an updated bulletin titled “Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates” (https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/hipaa-online-tracking/index.html). This new guidance appears to be a response to ongoing developments in the digital health landscape and recent legal challenges, which we’ll explore in the next section.

Key points for HIPAA-covered entities

While the HHS bulletins outline several points, their stance can be distilled down to a simple “follow the law” approach. The crux of their position is boldly stated in the bulletin:

HSS Bulletin

Regulated entities are not permitted to use tracking technologies in a manner that would result in impermissible disclosures of PHI to tracking technology vendors or any other violations of the HIPAA Rules.

This straightforward statement, while seemingly obvious, carries implications in suggesting that HHS is maintaining its cautious approach to tracking technologies, despite potential legal shifts that might allow for more flexible interpretations.

The HHS guidance goes on to state that for HIPAA regulated entities, the previous guidance and rules around PHI, privacy, security and breach notifications continues to apply to marketing pixels across your digital properties.

By reaffirming these points, HHS seems to be signaling its intent to maintain strict oversight of tracking technologies in healthcare, regardless of evolving legal interpretations.

As we’ll see in the following sections, recent legal developments have introduced new considerations, potentially creating a disconnect between status quo regulatory guidance and legal precedent.

Understanding the American Hospital Association vs. Becerra Case

American Hospital Association v. Becerra, decided on June 20, 2024 by the U.S. District Court for the Northern District of Texas, marks a significant moment in the ongoing debate about the use of tracking technology in healthcare settings.

The case arose when the American Hospital Association (AHA) and other healthcare organizations challenged the Department of Health and Human Services’ (HHS) December 2022 guidance on the use of online tracking technologies. The plaintiffs argued that HHS had overstepped its authority in issuing this guidance, which they claimed effectively created new regulations without following proper rulemaking procedures.

Central to the case was the question of whether the use of tracking pixels and IP addresses in healthcare-related websites constituted a disclosure of Protected Health Information (PHI) under HIPAA.

As highlighted by Hall Booth Smith, P.C. (https://hallboothsmith.com/texas-hhs-web-tracking-guidance/), it centers on HHS’s attempt to clarify when tracking technology creates individually identifiable health information. The HHS had revised its Bulletin to state that when tracking technology links an IP address to a website visit, it becomes individually identifiable health information if the visitor intended to address their own specific health concerns. However, the Court found this “intent” element insufficient. As the post notes, the Court pointed out a fundamental flaw in this reasoning: when an individual visits a healthcare provider’s website, it’s impossible for the provider to discern whether the visitor is seeking information about their own health, researching on behalf of someone else, or simply browsing for general information. This ruling significantly narrows the circumstances under which routine website tracking could be considered a HIPAA violation, potentially allowing healthcare marketers more flexibility in using tracking technologies. It underscores the court’s view that the mere act of visiting a health-related website, without more concrete indicators of an individual’s health status or concerns, does not automatically create protected health information under HIPAA.

The court’s decision in this case has several important implications for digital health marketers:

  1. 1

    Narrower definition of PHI: The court ruled that the mere use of tracking pixels and collection of IP addresses does not necessarily constitute a disclosure of PHI under HIPAA. This interpretation is narrower than what HHS had previously suggested in its guidance.

  2. 2

    Limits on HHS authority: The court’s decision effectively curtailed HHS’s ability to broadly interpret HIPAA regulations to cover all uses of tracking technologies. This aligns with the broader trend of limiting federal agencies’ power to interpret regulations, as seen in the Supreme Court’s reconsideration of the “Chevron” doctrine.

  3. 3

    Potential for more flexible use of tracking technologies: By ruling that not all uses of tracking pixels constitute HIPAA violations, the court has potentially opened the door for more nuanced and flexible approaches to using these technologies in healthcare marketing.

  4. 4

    Emphasis on context and implementation: The court’s decision suggests that the permissibility of using tracking technologies may depend more on how they are implemented and the specific context of their use, rather than being categorically prohibited.

  5. 5

    Ongoing legal uncertainty: While the court’s decision provides some clarity, it also highlights the complex and evolving nature of this issue. The ruling may be subject to appeal or further legal challenges, maintaining a degree of uncertainty in the regulatory landscape.

  6. 6

    Tension with HHS guidance: As noted in the previous section, HHS has reaffirmed its cautious stance on tracking technologies, creating a potential disconnect between regulatory guidance and this legal precedent.

This ruling represents a significant development in the legal landscape surrounding digital health marketing. It suggests a potential shift towards a more nuanced approach to regulating tracking technologies in healthcare settings. However, it’s crucial to note that this decision does not give carte blanche for the unrestricted use of tracking pixels. Instead, it underscores the need for careful consideration of how these technologies are implemented and used in relation to patient privacy and HIPAA compliance.

(The American Hospital Assn v. Becerra case, as analyzed by the Harvard Law Review (https://harvardlawreview.org/print/vol-136/american-hospital-assn-v-becerra/), represents a significant shift in the legal landscape governing administrative agencies. This case, along with others, signals a potential erosion of the Chevron doctrine, which has long granted federal agencies broad discretion in interpreting ambiguous statutes. By rejecting HHS’s interpretation of Medicare’s reimbursement formula without invoking Chevron deference, the Supreme Court may be paving the way for more stringent judicial oversight of agency actions. This trend could have far-reaching implications for agencies like HHS, potentially limiting their ability to issue binding guidance or regulations without explicit statutory authorization. For digital health marketers, this shift might mean that future HHS guidance on matters like online tracking technologies could be subject to greater scrutiny and challenge, potentially creating a more flexible, albeit potentially more uncertain, regulatory environment.)

As the legal and regulatory landscape continues to evolve, digital health marketers will need to stay informed and adaptable, balancing the opportunities presented by this ruling with ongoing privacy concerns and potential future regulatory actions.

What Does It Mean for Customer Acquisition for Digital Health?

Digital health marketers face significant challenges in the current landscape. The ambiguity created by conflicting court rulings and HHS guidance leads to uncertainty about permissible practices. Stricter interpretations of HIPAA may limit data collection and use, while some advertising platforms are not HIPAA-restricted. Balancing effective marketing with HIPAA compliance adds complexity to campaign management.

To address these challenges, digital health companies can adopt several alternative strategies to leverage digital ad platforms to book new patient appointments. Emphasizing first-party data collection through consent-based methods remains crucial.

  • On-platform signals can be leveraged, such as using lead forms with dynamic logic and filtering on Meta ads, as Matchnode did for Bicycle Health. For Google, marketers might return to “old school” Cost-Per-Click (CPC) tactics. Implementing pixel or server tracking that doesn’t extend to the bottom of the funnel can provide valuable insights while limiting potential privacy risks.

  • Server-to-server tracking, like Meta’s Conversions API, can be used to send hashed click information (such as gclid and FBID) without transmitting patient info or IP addresses. Some agencies, including Matchnode, offer custom implementations to pass only specific, permissible data.

  • Tools like Fresh Paint are designed specifically for privacy-compliant tracking in healthcare. Smaller, more affordable options are also emerging in this space.

  • Best practices for digital health marketers include obtaining clear consent for data collection and use, maintaining transparency about data practices, and minimizing data collection to only what’s necessary. Regular audits of marketing technologies and practices, along with close collaboration between marketing, legal, and compliance teams, are essential. Staying informed about legal developments allows for timely strategy adjustments.

  • Risk assessment and mitigation are critical in this environment. Regular privacy impact assessments help evaluate potential risks in marketing initiatives. Implementing robust data governance frameworks establishes clear protocols for data handling. Privacy-enhancing technologies, such as data encryption and anonymization, add an extra layer of protection.

  • Developing incident response plans prepares organizations for potential data breaches or compliance issues. Ongoing training ensures marketing teams understand privacy regulations and best practices. Many organizations are also considering cyber insurance to mitigate financial risks associated with data breaches or compliance violations.

  • It’s worth noting that SOC2 compliance has become a standard in the industry, providing a framework for managing customer data securely. Achieving and maintaining SOC2 compliance can be a valuable step in risk mitigation and demonstrating commitment to data protection.

By adopting these strategies and best practices, digital health companies can navigate the complex regulatory landscape while still effectively acquiring customers. The key is to prioritize user privacy and regulatory compliance while innovating within these constraints.

Future Outlook

The future of digital health marketing is set to be shaped by technological advancements, legal developments, and evolving privacy expectations. Emerging technologies offer potential solutions to balance effective marketing with privacy protection. Privacy-preserving machine learning techniques, such as federated learning, could enable data analysis without centralizing sensitive information. Blockchain technology, coupled with zero-knowledge proofs (zk proofs), might provide more transparent and secure ways of managing consent and data sharing while maintaining privacy. As artificial intelligence progresses, we may see more sophisticated contextual advertising solutions that don’t rely on personal data.

The legal landscape governing digital health marketing is likely to remain dynamic. Further court cases may challenge or clarify the scope of HIPAA in the digital age, and new legislation specifically addressing tracking technologies in healthcare settings could emerge. This evolving framework will require marketers to stay agile and informed.

Balancing innovation and privacy will be crucial. The future may see a shift towards more transparent marketing practices, with companies competing on the strength of their privacy protections as well as their services. Personalized medicine and tailored health interventions offer significant potential benefits but raise new privacy considerations that marketers must navigate carefully.

New regulations or guidelines are likely to emerge, potentially addressing the use of AI and machine learning in health marketing, the use of aggregated or anonymized health data, and the intersection of wearable devices, health apps, and marketing. Industry self-regulation may also play a role in developing best practices and ethical guidelines.

As these changes unfold, digital health marketers will need to continuously adapt their strategies to align with evolving technologies, regulations, and consumer expectations. Success will hinge on effectively communicating the value of services while demonstrating a strong commitment to protecting patient privacy. The future of digital health marketing, while challenging, presents opportunities for those who can responsibly innovate and prioritize patient privacy.

The Role of Legal Counsel and Compliance Teams

In digital health marketing, close collaboration between legal, compliance, and marketing teams is essential. Legal experts help interpret regulations and court decisions, guiding marketers in developing compliant strategies. This partnership isn’t just about risk management; it’s about finding innovative, legal ways to market effectively.

Proactive involvement of legal and compliance teams in campaign planning, technology selection, and data handling is crucial. They help establish protocols for data management and incident response. This collaborative approach enables organizations to adapt quickly to regulatory changes while maintaining strong patient privacy protections. Regular cross-functional meetings foster a culture where legal experts understand marketing goals and marketers appreciate legal constraints, leading to more effective and HIPAA compliant marketing strategies.

Digital health marketing is navigating a complex landscape shaped by evolving legal interpretations, technological advancements, and heightened focus on patient privacy. Recent court decisions, like Am. Hosp. Ass’n v. Becerra, have introduced new nuances to the regulatory environment, potentially offering more flexibility in using tracking technologies while reinforcing the importance of HIPAA compliance. This shifting terrain requires marketers to reconsider their approaches, exploring alternative strategies such as contextual advertising, on-platform signals, and privacy-preserving tracking methods.

In this dynamic field, staying informed and adaptable is crucial. The digital health marketing landscape will continue to evolve, driven by emerging technologies, new regulations, and ongoing legal interpretations. Success hinges on balancing effective data use with unwavering respect for patient privacy – a challenge that aligns with both legal requirements and healthcare’s core values. We urge digital health marketers to regularly review their practices, invest in privacy-preserving technologies, and foster strong collaborations with legal and compliance teams. By viewing these challenges as opportunities for innovation, marketers can play a pivotal role in advancing healthcare while building trust and delivering value. The future of digital health marketing lies not just in compliance, but in ethically improving health outcomes through responsible and transparent practices.