HIPAA Compliant Programmatic Advertising: A Decision Guide

This page is a reference, not legal advice. Laws and enforcement positions change; the dates next to each statement show when it was checked. Confirm with counsel before relying on it.

HIPAA allows a covered entity to advertise with data that is not protected health information, with de-identified data, or with PHI under a patient authorization and a business associate agreement. It forbids sending identifiable health-related activity to an ad platform without one of those three. Four architectures pass audit: contextual, aggregate cohorts, consented first-party under a BAA, and clean-room matching.

The guide covers the three rules behind that answer, the 2024 court ruling, the architectures that survive, and what to ask a vendor.

HIPAA's Privacy Rule binds covered entities (health plans, clearinghouses and providers that transmit health information electronically for standard transactions) and their business associates (vendors that create, receive, maintain or transmit PHI on their behalf). A hospital system, a health plan and a pharmacy chain are covered entities. An agency that builds patient-level audiences for them is a business associate. An ad platform that refuses a BAA is neither: any PHI that reaches it is an impermissible disclosure.

HIPAA does not bind a pharmaceutical manufacturer, a direct-to-consumer telehealth company that is not a provider under the rule, a wellness app, or a health publisher. They fall under the FTC Act, the FTC Health Breach Notification Rule and state law. The FTC's actions against GoodRx, BetterHelp, Premom, Monument, Cerebral and Hims & Hers were all against companies outside HIPAA, on one theory: health information went to ad platforms through pixels, SDKs or list uploads while the company promised privacy (IAPP, 31 July 2026). Outside HIPAA, use this guide for the architecture and the state health privacy law tracker for the rules that bind you.

45 CFR 164.501 defines marketing as "a communication about a product or service that encourages recipients of the communication to purchase or use the product or service", with exceptions for refill reminders and for treatment and health care operations communications, except where the covered entity receives financial remuneration from a third party whose product is being described (45 CFR 164.501, LII). 45 CFR 164.508(a)(3) then requires an authorization for any use or disclosure of PHI for marketing, with two narrow exceptions: a face-to-face communication and a promotional gift of nominal value. If a third party pays for the communication, the authorization must say so (45 CFR 164.508, LII).

For programmatic this means a hospital can use its own patient data to promote its own services only inside the "health care operations" carve-out, and only if no third party is paying. The moment a device manufacturer or a pharma brand funds the campaign, the communication is marketing and the patient-level data behind it needs a signed authorization.

164.508(a)(4) requires an authorization for any disclosure that is a sale of PHI, and the authorization must state that the disclosure will bring remuneration (45 CFR 164.508, LII). Licensing patient segments to a data company, selling a "pharmacy shopper" audience built on prescription data, or giving an ad platform PHI in exchange for free attribution are all disclosures for remuneration. A retail media network run by a pharmacy chain is the clearest example: the front-store loyalty data can fund the network, the pharmacy data cannot, and the two must never share a key. For how a regulated owner draws that line in practice, see Case: finance ad tech compliance and Ad tech compliance: PCI, HIPAA, SOC 2.

Data that is de-identified under 164.514 is not PHI. The safe-harbor method requires removal of 18 identifiers of the individual and of relatives, employers and household members. Three of them are the core of every ad tech record: "(M) Device identifiers and serial numbers", "(N) Web Universal Resource Locators (URLs)" and "(O) Internet Protocol (IP) address numbers". The entity must also have no actual knowledge that the remaining information could identify the person (45 CFR 164.514, LII). The second method, expert determination, allows an expert to certify that the re-identification risk is very small; it is the route that clean rooms and cohort products rely on.

In practice, a record with a device ID or IP address that relates to a person's health cannot be de-identified by removing the name. Either the identifier goes, or the health context goes, or you are handling PHI.

HHS's Office for Civil Rights issued its bulletin on the use of online tracking technologies on 1 December 2022 and revised it on 18 March 2024 (HHS OCR bulletin; Norton Rose Fulbright, 21 March 2024). The 2024 revision kept the core position: tracking code on authenticated pages (portals, appointment scheduling) and in apps generally discloses PHI to the vendor, and the entity needs either a BAA with the vendor or a HIPAA-compliant authorization from the user before the data flows. It added the example that made the headlines: a student researching oncology services on a hospital page is not seeking care, so the IP address and page visit are not PHI, but a person visiting the same page for a second opinion on a brain tumor is, and the same tracking code cannot tell the two apart (Norton Rose Fulbright, 21 March 2024). It also said OCR would prioritise Security Rule compliance (risk analysis and safeguards) in tracking investigations (Shook Hardy & Bacon, 22 March 2024).

The American Hospital Association, the Texas Hospital Association, Texas Health Resources and United Regional Health Care System sued. On 20 June 2024 Judge Mark Pittman of the Northern District of Texas granted declaratory relief: the "Proscribed Combination", meaning an individual's IP address connected with a visit to an unauthenticated public webpage addressing specific health conditions or providers, "is UNLAWFUL, as it was promulgated in clear excess of HHS's authority under HIPAA", and the court vacated the March 2024 bulletin to that extent (AHA, 20 June 2024). The opinion is reported at 738 F. Supp. 3d 780 (Sweat v. Houston Methodist, 22 September 2025, citing the case). HHS filed a notice of appeal and then withdrew it on 29 August 2024 (The Record, 30 August 2024).

Two cautions. First, the ruling addressed unauthenticated public pages only. It said nothing about portals, scheduling flows, apps or any page where the visitor has told you who they are. Second, the vacatur binds HHS; it does not protect you from a plaintiff. The same tracking data that a court said HHS could not call PHI has supported class actions under the federal Wiretap Act, state wiretap statutes and the California Confidentiality of Medical Information Act, and those cases settle for seven and eight figures (see the pixel problem reference for the list).

The plaintiffs' bar does not need HHS. In Sweat v. Houston Methodist Hospital, the Southern District of Texas granted summary judgment to the hospital on 22 September 2025, but only after discovery, and only because the record showed its purpose in using the Meta Pixel was to improve advertising, not to violate HIPAA, so the Wiretap Act's crime-tort exception did not apply (Sweat v. Houston Methodist, S.D. Tex., 22 September 2025). The opinion notes that courts are split on the crime-tort test. A win after two years of discovery is not a compliance strategy.

Classify each data flow with this table before choosing an architecture. "Identifier" means any item in the 164.514(b) list: IP address, device ID, cookie ID tied to a person, email hash, or a URL containing a record number.

The table below is the heart of the guide. "Allowed" means the architecture can be made to comply with the HIPAA Privacy Rule when the stated conditions hold. State law may add conditions; the state tracker lists them.

Two patterns explain the table. Anything that moves a patient-level key to a party without a BAA fails. Anything that keeps the key inside the perimeter and exports only aggregates, cohorts or authorized records can pass. See Clean rooms vs CDP and Clean room architectures compared for the clean-room options.

The architecture below is deliberately conservative. It assumes the covered entity wants to run paid media on third-party inventory, measure it, and never let PHI leave its control. It works for a hospital system, a health plan or a pharmacy chain, and with one change (replace "BAA" with "data processing agreement" and "authorization" with state-law consent) for a telehealth company or a pharma brand.

Zone A: PHI zone (inside the covered entity's perimeter, Security Rule controls).

1. The EHR, CRM, scheduling and portal systems hold PHI. Nothing in this zone talks to an ad platform.
2. A consent and authorization register records each patient's 164.508 authorizations: what use, which recipients, whether remuneration is involved, expiry, revocation. State-law consents (collect, share, sell) sit in the same register with their own flags.
3. A de-identification service applies safe harbor or an expert-determined method to produce cohorts. It enforces a minimum cohort size and logs each release.

Zone B: controlled activation zone (operated by the entity or by a business associate under a BAA). 4. A first-party tag server receives browser and app events. A filter removes 164.514(b) identifiers and any health-context field before anything leaves. Authenticated page classes are blocked from forwarding by default. 5. An owned or BA-operated bidder (DSP) receives only cohort IDs and contextual signals. It never receives a patient key. Bid requests from exchanges are evaluated against cohort membership held inside this zone. 6. A clean room inside this zone performs any matching with publishers or platforms and returns aggregate outputs only. Query logs are retained. 7. Measurement is aggregate: lift studies, geo experiments, cohort-level conversion rates computed inside Zone B against first-party outcomes.

Zone C: external platforms (no BAA). 8. Exchanges, SSPs and publishers see bid requests with contextual data and cohort IDs. Walled gardens receive contextual campaigns and aggregate conversion counts, never events tied to identifiers.

Controls across zones. Every forwarded payload is checked against a schema of allowed fields. New page classes and app screens are classified before tags are allowed. A quarterly replay of sample sessions verifies nothing prohibited reaches Zone C. Revoked authorizations propagate from the register to the bidder and clean room within a defined SLA.

The architecture is vendor-neutral: a cloud DSP under a BAA, a self-hosted bidder, or a mix. It cannot be built on a platform that will not sign a BAA and still receives patient-level events.

45 CFR 164.504(e)(2) lists what a business associate contract must contain (45 CFR 164.504, LII). The list below maps those elements to ad tech and adds the clauses that audits ask for.

1. Permitted uses and disclosures stated per data flow: events, cohorts, match keys, measurement outputs. A vendor may not use PHI for its own product improvement, benchmarking or look-alike modeling unless the contract says so and a 164.508 authorization covers it.
2. No use beyond the contract or the law. Ban on combining the entity's data with the vendor's other clients' data.
3. Safeguards under the Security Rule for electronic PHI: encryption in transit and at rest, access control, logging, and a named control framework (SOC 2 Type II or HITRUST). See Ad tech compliance: PCI, HIPAA, SOC 2 for what each report covers.
4. Reporting of any use or disclosure not provided for, including breaches of unsecured PHI, with a notification clock short enough for the entity to meet its 60-day Breach Notification Rule deadline (45 CFR 164.404, LII).
5. Subcontractors bound to the same restrictions: SSPs, data centres, measurement partners, identity providers. Ask for the list.
6. Access, amendment and accounting of disclosures (164.524, 164.526, 164.528): the vendor must be able to find and return a person's data and to list where it went.
7. Books and records available to the HHS Secretary.
8. Return or destruction at termination, including derived data such as models trained on PHI; if infeasible, protections continue.
9. Termination for material breach.
10. Ad-tech specific: no bidstream enrichment with PHI; no persistence of PHI in bid logs beyond a stated retention; cohort size floors; a prohibition on reverse engineering cohorts; sub-processor change notice; data residency and the right to audit.

1. Inventory every tag, pixel, SDK and server-side connector on every web property and app, with the page classes each fires on. The Markup found the Meta Pixel on 33 of Newsweek's top 100 hospitals and inside 7 patient portals in 2022 (The Markup, 16 June 2022).
2. Classify every page and screen: public, authenticated, health-context, transactional. Block non-BA tags on anything but public.
3. Capture a sample of outbound payloads from each tag and check them against the 164.514(b) list. Look for IP, device IDs, URLs with record numbers, button text, form field names, doctor names, condition terms.
4. Confirm a signed BAA exists for every vendor that receives anything from an authenticated or health-context page.
5. Confirm that every patient-level targeting use has a 164.508 authorization that names the use and the remuneration, and that the register can prove it per person.
6. Confirm that cohort exports contain no identifier and that an expert determination or safe-harbor record exists for the method.
7. Test the server-side filter with synthetic sessions on each page class; verify the forwarded payload against the allowed-field schema.
8. Check the ad platform's own data terms: platforms restrict health-related events and audiences, and a violation of their terms is evidence in litigation.
9. Check the state-law layer: separate consent to collect and to share in Washington and Nevada; a standalone consumer health data privacy policy; a 2,000-foot or 1,750-foot geofence audit; Maryland's "strictly necessary" standard that consent cannot override (Koley Jessen, 1 October 2025).
10. Reconcile the public privacy policy and marketing claims with actual flows. The FTC's Hims & Hers complaint rests on "private" and "discreet" marketing claims as much as on the pixels (IAPP, 31 July 2026).
11. Run a Security Rule risk analysis that names tracking technologies as a risk and documents the mitigation; OCR said in March 2024 that this is what it will look at first (Shook Hardy & Bacon, 22 March 2024).
12. Set a retention schedule for tag logs, bid logs and measurement data, and verify deletion.

1. Will you sign our BAA, including the ad-tech clauses above, or only your own template?
2. Which of your sub-processors receive our data, and will each sign a subcontractor BAA?
3. Where does the data sit, who administers the environment, and can we deploy inside our own perimeter?
4. Do you ever receive a patient-level identifier (IP, device ID, cookie, hashed email) tied to a health event? If yes, in which flow, and why?
5. How do you prove that an exported cohort meets a minimum size and cannot be differenced across refreshes?
6. Who signed your expert determination, for which dataset, and when does it expire?
7. Can your clean room return row-level matches? If yes, how is that disabled for our account?
8. What does your server-side connector forward by default? Show us a payload.
9. How do you handle a revoked authorization or a state-law deletion request end to end, and in what SLA?
10. Do you train models on our data? On data pooled across clients?
11. Which SOC 2 Type II or HITRUST report covers the exact service we buy, and what was the last exception?
12. How do you enforce Washington's and Nevada's geofence bans and the separate consents for collect and share?

A covered entity that passes HIPAA still faces two more layers. The FTC's amended Health Breach Notification Rule, effective 29 July 2024, treats an unauthorised disclosure of health data by a non-HIPAA app or service as a reportable breach (MoFo, 14 May 2024; Jones Day, July 2024). State consumer-health-data laws in Washington, Nevada, Connecticut and Maryland define health data more broadly than HIPAA, reach non-covered entities, and in Washington carry a private right of action (RCW 19.373.090). The identifiers that carry health context are the ones the market still uses after the Privacy Sandbox; see Identity after Privacy Sandbox. For a European entity, see EU sovereign ad tech.

Is an IP address PHI? Not by itself. An IP address becomes PHI when it is held by a covered entity or business associate together with information about the person's health, care or payment. 45 CFR 164.514(b) lists IP addresses among the identifiers that must be removed to de-identify a health record (45 CFR 164.514, LII). On 20 June 2024 a federal court held that HHS cannot treat an IP address plus a visit to an unauthenticated public health page as PHI (AHA, 20 June 2024). On an authenticated page, or for a visitor the entity can identify, it remains PHI.

Can a hospital use Google Analytics or the Meta Pixel? On purely public pages, after AHA v. Becerra, HHS cannot enforce HIPAA against it, but wiretap and state-law suits over that use settle for millions: Advocate Aurora paid $12.225 million with final approval on 10 July 2024 (Robinson+Cole, 25 July 2024). On portals, scheduling, refill or symptom pages, no, unless the vendor signs a BAA, which the major platforms do not do for advertising products.

Does a cookie banner count as a HIPAA authorization? No. A 164.508 authorization must be a specific, written, signed document that states the use, the recipients, the expiry and, where a third party pays, the remuneration (45 CFR 164.508, LII). A banner does none of that. Under Washington's law, consent to collect and consent to share are also separate opt-ins and a sale needs a further written authorization that expires after one year (RCW 19.373.030; RCW 19.373.070).

Can a DSP sign a business associate agreement? Yes, if it is willing to be bound by 45 CFR 164.504(e): permitted uses, safeguards, breach reporting, subcontractor flow-down, access and accounting, return or destruction (45 CFR 164.504, LII). The limit is that the exchanges and walled gardens it buys from will not sign, so the BAA protects only the part of the chain the DSP controls. That is why the reference architecture keeps patient keys inside the bidder.

Does HIPAA apply to pharma brands and telehealth apps? Usually not directly. A manufacturer is not a covered entity, and many telehealth and wellness companies are outside the rule. They fall under FTC Act Section 5, the Health Breach Notification Rule as amended on 29 July 2024, and state consumer-health-data laws (Jones Day, July 2024). The FTC's six health-data cases from GoodRx (1 February 2023) to Hims & Hers (29 July 2026) were all against such companies (Hims & Hers 10-Q, Q2 2026).

1. 45 CFR 164.501, Definitions (Marketing; Financial remuneration). Legal Information Institute, Cornell Law School. https://www.law.cornell.edu/cfr/text/45/164.501
2. 45 CFR 164.508, Uses and disclosures for which an authorization is required. LII. https://www.law.cornell.edu/cfr/text/45/164.508
3. 45 CFR 164.514, Other requirements relating to uses and disclosures of PHI (de-identification). LII. https://www.law.cornell.edu/cfr/text/45/164.514
4. 45 CFR 164.504, Uses and disclosures: organizational requirements (business associate contracts). LII. https://www.law.cornell.edu/cfr/text/45/164.504
5. HHS Office for Civil Rights, "Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates" (1 December 2022; revised 18 March 2024). https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/hipaa-online-tracking/index.html
6. Shook Hardy & Bacon, "HIPAA Update: OCR Updates Bulletin on Website Tracking Tools" (22 March 2024). https://www.shb.com/intelligence/client-alerts/pds/march-2024-revised-ocr-bulletin-saikali
7. Norton Rose Fulbright, Data Protection Report, "HHS updates online tracker guidance" (21 March 2024). https://www.dataprotectionreport.com/2024/03/hhs-updates-online-tracker-guidance/
8. American Hospital Association, "Judge rules in favor of AHA, vacating HHS online tracking bulletin as unlawful and beyond agency authority" (20 June 2024). https://www.aha.org/news/news/2024-06-20-judge-rules-favor-aha-vacating-hhs-online-tracking-bulletin-unlawful-and-beyond-agency-authority
9. The Record, "HHS drops appeal of hospital web tracking decision" (30 August 2024). https://therecord.media/hhs-drops-appeal-web-tracking-hospitals
10. Sweat v. Houston Methodist Hospital, No. 4:24-cv-00775, Memorandum and Opinion (S.D. Tex. 22 September 2025), hosted by Duane Morris. https://blogs.duanemorris.com/classactiondefense/wp-content/uploads/sites/56/2025/09/Sweat-v.-Houston-Methodist-Hospital-Opinion.pdf
11. FTC, "FTC Enforcement Action to Bar GoodRx from Sharing Consumers' Sensitive Health Info for Advertising" (1 February 2023). https://www.ftc.gov/news-events/news/press-releases/2023/02/ftc-enforcement-action-bar-goodrx-sharing-consumers-sensitive-health-info-advertising
12. FTC, "FTC to Ban BetterHelp from Revealing Consumers' Data, Including Sensitive Mental Health Information, to Facebook and Others for Targeted Advertising" (2 March 2023). https://www.ftc.gov/news-events/news/press-releases/2023/03/ftc-ban-betterhelp-revealing-consumers-data-including-sensitive-mental-health-information-facebook
13. FTC, "Ovulation Tracking App Premom Will be Barred from Sharing Health Data for Advertising, Under Proposed FTC Order" (17 May 2023). https://www.ftc.gov/news-events/news/press-releases/2023/05/ovulation-tracking-app-premom-will-be-barred-sharing-health-data-advertising-under-proposed-ftc
14. Choate Hall & Stewart, "FTC Seeks Significant Penalties from Two Health Companies Alleging Misuse of Consumer Personal Information" (16 April 2024). https://www.choate.com/insights/ftc-seeks-significant-penalties-from-two-health-companies-alleging-misuse-of-consumer-personal-information/
15. Hims & Hers Health, Inc., Form 10-Q for the quarter ended 30 June 2026 (Legal proceedings: FTC complaint of 29 July 2026; $60 million accrual). https://www.sec.gov/Archives/edgar/data/0001773751/000177375126000163/hims-20260630.htm
16. IAPP, Cobun Zweifel-Keegan, "A view from DC: The FTC sues Hims over pixel tracking" (31 July 2026). https://iapp.org/news/a/a-view-from-dc-the-ftc-sues-hims-over-pixel-tracking
17. Baker Donelson, "FTC Targets Hims & Hers Over Health Data Sharing: The Tracking Tools Are Now Part of the Case" (25 August 2026). https://www.bakerdonelson.com/ftc-targets-hims-hers-over-health-data-sharing-the-tracking-tools-are-now-part-of-the-case
18. Morrison Foerster, "FTC Issues Final Rule to Expand the Health Breach Notification Rule" (14 May 2024). https://www.mofo.com/resources/insights/240514-ftc-issues-final-rule-to-expand
19. Jones Day, "FTC Issues Final Health Breach Notification Rule" (July 2024). https://jonesday.com/en/insights/2024/07/ftc-issues-final-health-breach-notification-rule
20. Hunton Andrews Kurth, "FTC Finalizes Orders Against Data Brokers Over Sensitive Location Data" (4 February 2025). https://www.hunton.com/privacy-and-information-security-law/ftc-finalizes-orders-against-data-brokers-over-sensitive-location-data
21. Robinson+Cole, Data Privacy + Security Insider, "Advocate Aurora Health $12.2M Pixel Litigation Settlement Approved by Court" (25 July 2024). https://www.dataprivacyandsecurityinsider.com/2024/07/advocate-aurora-health-12-2m-pixel-litigation-settlement-approved-by-court/
22. HIPAA Journal, "CVS Health; Criteo Agree to Pay Combined $20.5 Million to Resolve Website Tracking Litigation" (24 September 2026). https://www.hipaajournal.com/cvs-health-criteo-american-wellness-corp-data-breach-settlements/
23. The Markup, "Facebook Is Receiving Sensitive Medical Information from Hospital Websites" (16 June 2022). https://themarkup.org/pixel-hunt/2022/06/16/facebook-is-receiving-sensitive-medical-information-from-hospital-websites
24. Mayer Brown, State Privacy Law Tracker (current as of 3 September 2026). https://www.mayerbrown.com/en/insights/resource-centers/cybersecurity-and-data-privacy-resource-center/state-privacy-law-tracker
25. RCW 19.373.010 (definitions, including "geofence" at 2,000 feet). https://app.leg.wa.gov/RCW/default.aspx?cite=19.373.010
26. RCW 19.373.030 (collection or sharing of consumer health data). https://app.leg.wa.gov/RCW/default.aspx?cite=19.373.030
27. RCW 19.373.070 (sale of consumer health data; valid authorization). https://app.leg.wa.gov/RCW/default.aspx?cite=19.373.070
28. RCW 19.373.080 (geofence restrictions). https://app.leg.wa.gov/RCW/default.aspx?cite=19.373.080
29. RCW 19.373.090 (application of consumer protection act). https://app.leg.wa.gov/RCW/default.aspx?cite=19.373.090
30. Nevada Revised Statutes, Chapter 603A (consumer health data at NRS 603A.400 to 603A.550). https://www.leg.state.nv.us/nrs/NRS-603A.html
31. Koley Jessen, "Maryland Online Data Privacy Act" (1 October 2025). https://www.koleyjessen.com/insights/publications/maryland-online-data-privacy-act
32. 45 CFR 164.404, Notification to individuals (60-day breach notification deadline). LII. https://www.law.cornell.edu/cfr/text/45/164.404