In December 2022 the Office of Civil Rights (OCR) released new guidance shedding light on how to avoid sharing individually-identifiable personal health information with tracking platforms or technologies like Google Analytics, the Meta Pixel and more. Since that time, healthcare organizations large and small have been grappling with how to adjust their digital analytics strategy for these new guidelines.
Despite pushback and legal action taken by the American Hospital Association, the OCR updated their guidance in March 2024, giving healthcare organizations more clarity, but indicating no intention of backing down from the new guidance. They specifically recommended that healthcare providers consider moving to a HIPAA-compliant analytics platform or working with a HIPAA-compliant service provider that can de-identify the data collected on the website before it's passed along to third parties like Google or Meta.
For organizations who are exploring other options to make their analytics and advertising tracking secure, Full Media offers both guidance and services to help!
Use the form below to download our latest guide.
The good news is that there are options out there to keep using Google Analytics 4 and other advertising pixels, while adapting the data you pass on to those platforms. The OCR Guidance calls into question whether it’s acceptable for a healthcare organization ("covered entity") to pass potentially identifying information, like IP address, detailed location information and user ID, on to a third-party platform, but Google Analytics and other tracking pixels do this by default.
As a HIPAA-compliant digital marketing agency specializing in digital analytics, Full Media has the technical expertise to set up server-side Google Tag Manager, also called an "analytics proxy."
Using server-side Google Tag Manager, the data collected on your healthcare website will be sent to a HIPAA-compliant server. That server will pass the data along to platforms like Google Analytics 4, Google Ads and Meta, but any data those platforms shouldn’t have—such as IP address or user ID—will not be passed on.
Server-side Google Tag Manager tends to be among the most cost-effective approaches for organizations who are weighing switching to a new analytics platform or considering a Customer Data Platform. The cost depends on how much traffic your website gets. We will quote the implementation on a case-by-case basis.
Yes. Full Media will sign a BAA with your organization, and we will also ensure a BAA is in place with a HIPAA-compliant server to transmit your website data.
Some organizations just need someone to help them weigh all the options! For many healthcare marketers, the technology piece may be challenging to truly understand and discuss with their legal or compliance teams. In those cases, Full Media is here to help learn about your organization, provide expertise and way-find the right approach for your organization.
We are keeping a careful eye on the industry as it reacts to this guidance and our peers in the agency world, while collaborating actively with our own healthcare-specialized attorneys. If you need expertise in this area, please reach out!