The Three Pillars of Privacy in Healthcare Marketing

Healthcare marketers used to treat privacy like a single compliance checkbox: Are we HIPAA-compliant? If so, check.

But today’s healthcare marketers have to contend with a growing patchwork of state privacy laws, HIPAA, FTC enforcement, programmatic demand letters, and hundreds of technologies that can touch a modern marketing stack.

In 2026, privacy is no longer a one-and-done problem. The easiest way to think about it is as an issue with three separate pillars:

• Consent management

• Data sharing

• Privacy policies

The pillars are closely related, but distinct. Solving for one does not necessarily solve the other two. And a truly strong privacy posture requires addressing all three at the same time.

I’ll break it down even further below. But before I do, I should add: I’m not a lawyer. I’m a healthcare marketer who has helped hundreds of other healthcare marketers navigate the ever-changing privacy landscape.

I know what this process can feel like. Outside counsel can be expensive. Internal legal teams are balancing a lot of risk and nuance. And even when you get sound legal guidance, it doesn’t always translate neatly into an answer to the question you’re asking: What does all of this mean for the way I’m marketing today?

So here’s the framework I’ve found most useful for tackling that question.

Pillar 1: Consent Management

AKA: Can patients control how their online behavior is tracked and shared?

Broadly, consent management boils down to a pretty simple idea: give people the appropriate level of control over how their data is collected, used, and shared.

Simple in theory, much more complicated in execution.

Each state has different requirements based on where the visitor is located, what kind of data is being collected, and what you are doing with it. That means depending on your specific situation, you could be dealing with opt-in consent, opt-out rights, honoring Global Privacy Control signals, or any number of additional restrictions around sensitive data.

Many people hear consent management and think: “Okay, so I just need a cookie banner.” But the banner itself isn’t really the point.

When someone makes a choice on a cookie banner, that choice has to actually work.

If someone opts out of tracking, does that choice make it to all the relevant tools: analytics, ad platforms, session replay? If you’re in a state that requires consent to be given before certain tracking begins, does your setup prevent those trackers from firing until consent is given?

If your banner asks a visitor’s preference and then proceeds to ignore that preference in practice, you’re not accomplishing much.

Healthline Media found this out the hard way in 2025, when California’s Attorney General accused the company of failing to honor consumers’ opt-out rights. Healthline agreed to pay $1.55 million to settle the case and implement additional privacy controls.

Consent management is arguably the most top-of-mind issue for healthcare marketers today. Plaintiff’s firms and pro-se litigators can and do scrape the internet to find companies with consent management issues, then programmatically send demand letters at scale.

The Infrastructure: A Consent Management Platform (CMP)

A properly configured CMP collects and records a visitor’s privacy choices, then passes those preferences through to the rest of the marketing stack. A modern CMP can identify a visitor’s location and dynamically apply the appropriate rules.

Pillar 2: Data Sharing

AKA: Can you keep protected health information (PHI) from reaching destinations where it shouldn’t go?

This is where HIPAA comes into play.

Even if a visitor to your website gives you permission to track and share their data, HIPAA legally prohibits you from sharing PHI with third-party tools with which you do not have a signed business associate agreement (BAA). And ad and analytics platforms like Google and Meta, plus many other vendor platforms across attribution tooling, AB testing, personalization, forms, etc., often will not sign BAAs.

Basically if you collect information that constitutes PHI, you need to be able to control whether and how that information reaches third parties.

What makes this even more complicated is that PHI doesn’t require a full name or email address. If you transmit identifying information about a visitor (like cookie IDs or IP address) alongside health context (like what conditions they searched for or procedure pages they visited), that can often be a violation.

One way healthcare companies address this issue is by moving their data flows through controlled server-side infrastructure, where they can decide exactly what gets sent downstream. But it’s not enough to move to server-side and call it a day.

Switching to server-side tracking gives you greater control over your data. But to be HIPAA compliant, you have to actually leverage that control. That means doing things like stripping sensitive health context and identifiers from the data on your server before sending it to third parties.

Think of your data as living on an island. Server-side tracking is the boat that carries data to third-party platforms. But you still have to decide what goes on the boat and, just as importantly, what should never leave the island.

In 2026, Kaiser Permanente was flagged for transmitting what constituted PHI to third parties. A federal court approved a $47.5 million settlement resolving class-action claims that Kaiser was transmitting IP addresses, search terms, and portal activity from authenticated patient pages to third parties without user consent. This was a case of private litigation, not enforcement directly from the Office for Civil Rights (OCR), but it illustrates the exposures that can happen when healthcare data and third-party tracking technologies intersect.

The Infrastructure: A HIPAA-Compliant Customer Data Platform (CDP)

A CDP creates a controlled server-side layer between your websites or apps and third-party platforms. Instead of allowing every third-party technology to independently collect whatever it can from the browser, a CDP stores data centrally where it can be evaluated, anonymized, and selectively sent to approved destinations.

Because raw data from your website hits the CDP before it gets filtered, the CDP will temporarily touch PHI, which means the CDP must be HIPAA-compliant and sign a BAA. And compliance comes not just from having the CDP, but from properly configuring it to filter out the right information.

Pillar 3: Privacy Policies

AKA: Does what you say match what you actually do?

This might be the easiest of the three pillars to understand: When it comes to privacy, you have to say what you do and then do what you say.

Basically, you need a written privacy policy that explains how you handle patient data, and then you need to make sure you’re acting in accordance with that policy. If you say you’re not sharing patient data with third parties, then you cannot share patient data with third parties.

That sounds almost too simple until you think about how modern websites work. Without proper guardrails set up, it’s shockingly easy to violate your own privacy policy without anyone acting in bad faith.

Let’s say a marketing team member adds a new tool to the website for a single campaign, then leaves the company. The campaign ends, but the script keeps running. Or maybe someone embeds a standard YouTube video on a specialty care page without realizing it will inject third-party tracking cookies. Over time, your actual website could look meaningfully different from what your legal and compliance teams think is running.

Which means you could say you’re not sharing third-party data when you actually are, even though the policy was 100% true when you wrote it.

This is the discrepancy at the center of the FTC’s case against Hims & Hers. In July 2026, the FTC (joined by Utah and California) sued Hims & Hers, alleging that the company shared consumers’ sensitive health information with advertising platforms while marketing itself as private and discreet.

They were sued for allegedly not doing what they said they would do. The case is ongoing, and the company disputes the allegations.

The Infrastructure: A Web Scanner

A web scanner can continuously inventory scripts, pixels, cookies, and other technologies running on your website, identifying changes and surfacing potential risks for privacy and legal teams to review against your organization’s policies. This allows you to quickly identify and handle third-party scripts that go against your privacy policy, rather than assuming the website you audited six months ago is the same one you have today.

Why All Three Pillars Matter

This is where I think people get tripped up. You can’t just pick and choose which pillars you tackle.

Properly recording and enforcing consent is important … but it won’t guarantee you’re complying with state privacy laws.

Configuring your CDP to strip sensitive information before sending it to third-parties is important … but it can’t tell you about third-party scripts you didn’t know were there.

Frequently scanning your website to identify rogue scripts is important … but for any you’d like to keep, you still need a way for visitors to consent to them and for you to control what they receive.

For a strong privacy posture, you need all three pillars to be operating in harmony.

That’s not the single-checkbox problem it used to be. But the tough thing is, it’s not even really a three-checkbox problem. Today’s privacy landscape requires you to solve for consent management, data sharing, and privacy policies cohesively and continuously. Each pillar relies on the other two, and the entire system should be continuously audited and updated.

The easiest solution, of course, is to turn tracking technology off altogether. Many healthcare orgs did exactly that after the OCR guidance around what constitutes PHI got more strict in 2022. But cutting out tracking removes your visibility and torpedoes performance.

The good news is that you don’t have to choose between protecting privacy and executing effective marketing. Even in a fragmented ecosystem, it’s entirely possible to build a unified system that satisfies all three pillars, keeping you compliant and giving your team the insights it needs to grow. That’s exactly what we built Ours Privacy to do: serve as a single, cohesive platform for healthcare marketers that protects patient privacy on all three pillars. You can read more about our CDP, CMP, and Web Scanner on our website if you’re interested.