{"page":"/blog/pharmacy-retail-media-networks","modified":"2026-11-10","license":"https://creativecommons.org/licenses/by/4.0/","columns":["Data","What the rule says","Citation","Common practice (not a legal requirement)"],"rows":[["Prescription and dispensing records","\"Health care\" includes the \"sale or dispensing of a drug\" under a prescription, so these records are health information held by a covered provider","45 CFR 160.103","Kept out of ad targeting and measurement"],["Use of that data for marketing","A covered entity \"must obtain an authorization\" before using or disclosing protected health information for marketing; exceptions are face-to-face talks and promotional gifts of nominal value","45 CFR 164.508(a)(3)","Networks do not build audiences from it"],["Refill reminders","Not \"marketing\" if any payment the pharmacy receives is \"reasonably related\" to its cost of sending the message","45 CFR 164.501","Run by the pharmacy, not sold as media"],["Selling patient data","A sale of protected health information needs an authorization that states the pharmacy will be paid","45 CFR 164.508(a)(4)","Not done"],["Purchase of prescribed medication, in Washington","Listed as \"consumer health data\", whoever holds it","RCW 19.373.010(8)(b)(iv)","Excluded"],["Health inferences from ordinary purchases, in Washington","Data \"derived or extrapolated from nonhealth information\", including by algorithms, is consumer health data when used to identify a health condition","RCW 19.373.010(8)(b)(xiii)","Sensitive segments reviewed or dropped"],["Selling consumer health data, in Washington","Requires a separate signed authorization that expires after one year","RCW 19.373.070","Data is not sold; segments stay inside the network"],["Health data in the UK","Processing of \"data concerning health\" is prohibited unless an Article 9(2) condition applies; the term covers data that reveals health status","UK GDPR Art. 9(1); Art. 4(15)","Networks build on loyalty data and treat health inferences with care"]],"sourceUrls":[["https://www.law.cornell.edu/cfr/text/45/160.103"],["https://www.law.cornell.edu/cfr/text/45/164.508"],["https://www.law.cornell.edu/cfr/text/45/164.501"],["https://www.law.cornell.edu/cfr/text/45/164.508"],["https://app.leg.wa.gov/RCW/default.aspx?cite=19.373.010"],["https://app.leg.wa.gov/RCW/default.aspx?cite=19.373.010"],["https://app.leg.wa.gov/RCW/default.aspx?cite=19.373.070"],["https://www.legislation.gov.uk/eur/2016/679/article/9","https://www.legislation.gov.uk/eur/2016/679/article/4"]]}