{"page":"/blog/hipaa-compliant-programmatic-advertising","modified":"2026-10-18","license":"https://creativecommons.org/licenses/by/4.0/","columns":["Architecture","What it does","Allowed under HIPAA?","Conditions","Typical failure"],"rows":[["Contextual targeting","Buys impressions on pages or apps by topic, with no user-level data from the covered entity","Yes","No patient data leaves the entity; measurement is impression- and aggregate-based","The \"contextual\" DSP also drops a pixel on the advertiser's site that fires on authenticated pages"],["Aggregate cohorts","Builds audience segments from first-party data, de-identified by safe harbor or expert determination, and ships segment membership without device-level keys","Yes","Expert determination documented; minimum segment size enforced; no identifier in the export; refresh cadence that does not allow differencing attacks","A device ID or hashed email is sent as the \"join key\", which puts the record back inside 164.514(b)"],["Consented first-party under a BAA","Uses PHI to target or message patients who signed a HIPAA authorization; the DSP, CDP and measurement vendors sign BAAs and process the data on the entity's behalf","Yes","Valid 164.508 authorization naming the use, the recipients and any remuneration; BAA with every vendor that touches the data; data minimized to what the campaign needs; revocation honored","The ad platform in the chain (walled garden) refuses a BAA, so the authorization covers the DSP but the platform is still an impermissible disclosure"],["Clean-room matching","Matches entity data to a publisher or platform inside a clean room that returns only aggregate or k-anonymous outputs","Yes, with limits","Clean room operator signs a BAA (or receives only de-identified inputs); output thresholds and query controls documented; no row-level export","The \"clean room\" returns matched user lists for activation, which is a disclosure of PHI to the publisher"],["Server-side tagging with PHI filtering","Routes tag traffic through a server the entity controls, strips identifiers and health context before forwarding events to platforms","Yes, as a control, not a basis","The filter is tested against every page class; forwarded payload contains no 164.514(b) identifier tied to a health event; logs retained for audit","The server forwards client IP and URL path to the platform by default; \"server-side\" became a relay"],["Pixel or SDK on authenticated pages","Platform code on portal, scheduling, refill, symptom or bill-pay pages sends events to a non-BA vendor","No","None available: the vendor will not sign a BAA and a cookie banner is not a 164.508 authorization","This is the fact pattern in Advocate Aurora ($12.225M) and most of the class actions (Robinson+Cole, 25 July 2024)"],["Pixel-based retargeting from condition pages","Platform cookie set on condition or service pages, used to retarget visitors with ads for that service","Not HIPAA-enforceable for anonymous visitors after AHA v. Becerra; disallowed for known patients; restricted or consent-gated under state law","For anonymous visitors: wiretap and state-law exposure remains; for known patients: PHI","Washington and Nevada require separate opt-in consent to collect and to share consumer health data (RCW 19.373.030; NRS 603A.500)"],["Custom audience or look-alike from a patient list","Upload hashed patient emails to a platform; platform builds a look-alike","No, without authorization and a BAA the platform will not sign","None in practice","The mechanism alleged in FTC v. Hims & Hers (29 July 2026) and in BetterHelp (Baker Donelson, 25 August 2026; FTC, 2 March 2023)"],["Sale or licensing of patient-derived segments","Monetize segments built from PHI with third parties","No, without a sale authorization under 164.508(a)(4)","Authorization must state remuneration; state laws (Washington, Nevada) require a separate written authorization that expires after one year (RCW 19.373.070)","Pharmacy retail media networks must build on front-store loyalty data, not prescription data"],["Location-based targeting around facilities","Geofence around clinics to target visitors","Outside HIPAA for most actors; banned by state law","Washington bans geofences of 2,000 feet or less around health care facilities for tracking, collection or ads; Nevada, Connecticut and Maryland use 1,750 feet (RCW 19.373.080; Koley Jessen, 1 October 2025)","FTC orders against Gravy Analytics and Mobilewalla, finalized 14 January 2025, bar sale of sensitive location data including medical facilities (Hunton, 4 February 2025)"]],"sourceUrls":[[],[],[],[],[],["https://www.dataprivacyandsecurityinsider.com/2024/07/advocate-aurora-health-12-2m-pixel-litigation-settlement-approved-by-court/"],["https://app.leg.wa.gov/RCW/default.aspx?cite=19.373.030","https://www.leg.state.nv.us/nrs/NRS-603A.html"],["https://www.bakerdonelson.com/ftc-targets-hims-hers-over-health-data-sharing-the-tracking-tools-are-now-part-of-the-case","https://www.ftc.gov/news-events/news/press-releases/2023/03/ftc-ban-betterhelp-revealing-consumers-data-including-sensitive-mental-health-information-facebook"],["https://app.leg.wa.gov/RCW/default.aspx?cite=19.373.070"],["https://app.leg.wa.gov/RCW/default.aspx?cite=19.373.080","https://www.koleyjessen.com/insights/publications/maryland-online-data-privacy-act","https://www.hunton.com/privacy-and-information-security-law/ftc-finalizes-orders-against-data-brokers-over-sensitive-location-data"]]}