HIPAA

HIPAA is the 1996 US federal law whose Privacy, Security and Breach Notification Rules govern how covered entities (health plans, health-care clearinghouses and most providers) and their business associates may use and disclose protected health information, including for marketing, which requires authorization in most cases.

The rules are at 45 CFR Parts 160 and 164; the Privacy Rule's marketing provisions require individual authorization before PHI is used for marketing communications, with narrow exceptions, and the Security Rule sets administrative, physical and technical safeguards (eCFR, 45 CFR Part 164). HIPAA does not apply to every company that touches health data: a pharmacy chain is a covered entity for its pharmacy records but not for its front-of-store loyalty data, and a health-information website is usually not covered at all, which is where state laws such as Washington's MHMDA apply instead.

For ad tech the live question since 2022 has been tracking technologies. HHS's Office for Civil Rights issued a bulletin in December 2022, updated in March 2024, stating that pixels and tags on a covered entity's pages may transmit PHI to vendors and require a business associate agreement; a federal court in Texas vacated part of that guidance in June 2024, and HHS's page now carries the revised position (HHS, Use of online tracking technologies by HIPAA covered entities and business associates). The practical effect is that a pharmacy or provider running a media network must separate covered and non-covered data flows, keep any ad-tech vendor that could receive PHI under a BAA, and avoid sending health-related page context into the bidstream. The design is set out in HIPAA-compliant programmatic advertising.

Example: a pharmacy chain's app shows a sponsored allergy-medicine ad on its front-of-store search results, targeted on loyalty purchases of tissues, with no prescription data in the model and no pixel on prescription pages; the ad server and its logs sit under the chain's security program and no BAA is needed for the ad vendor because it never receives PHI.

Related: PHI, BAA, MHMDA, GLBA.

Source: 45 CFR Parts 160 and 164; HHS OCR tracking technologies guidance (December 2022, updated March 2024).

1. eCFR, 45 CFR Part 164
2. HHS, Use of online tracking technologies by HIPAA covered entities and business associates