Healthcare Data & Privacy: Balancing Regulation and Marketing

Speakers: Katie Flynn, Bob Burch

I certainly needed it. I was just telling Craig and John though, they’re like, you do pay for it when you come back, like I’m feeling slightly frantic, moderately too extremely frantic. Yeah. Yeah. Cause I’m like, Oh, I missed two days and it feels like an eternity,

and even just getting back into the, getting your brain back into it.

Oh, and don’t forget daylight savings is this weekend.

It’s fantastic.

Yeah.

Although my kids are now past that age where it’s a Mine is not.

I’m sure my nine month old is going to wake me up at the crack of dawn. Well, if we’re moving forward, actually,

Oh crap. Okay.

You lose an hour, but it shifts, but it could also shift their time. Yeah.

We tried last night to keep him up till nine o’clock. He was a nightmare.

well, don’t you need to put him to bed an hour early?

Cause if we’re springing forward, then what is seven will be eight.

Yeah. Nick’s an idiot. It’s Nick’s fault. And I’m going home and I’m going to say, Bob told me,

you should be doing it. You should be putting him down early.

We’re going the opposite way.

We’re going the opposite way.

Oh my God. I can’t. Okay. Well, I’m going to fix that problem tonight. Yep. But anyways, I guess we’ll, we’ll just die right in. So you’re back second episode, second week in a row. So you’re a pro now.

Yep.

But one thing that producer Craig over there has told me I need to do is better intros.

So

do think that we can, we can start with just a little bit more of your history. So, um, I like to tell people this, but you are a two time Flinner. So would you like to share, you started your career with us and then now you are again.

So I started my career here, uh, in 2005 as a media coordinator. So yeah, it’s a, it’s a great growth story that we can tell. It makes it really easy when we’re hiring people and can tell the story of, well, are there opportunities for advancement? Well, I was a coordinator and I’m now on the leadership team. So, um, yeah.

I need to do a better job of introing people because not everybody is familiar with us. Hopefully we’re gonna be reaching some new people, you know, with the people who are tuning in. But I love the story of sort of how you got to where you are now because you are a two time flinner. So if you could just share a little bit about that journey, I’m sure you’ll be interested.

Yeah, so Flynn was my first, or what was Martino Flynn? Was my first job out of school. I was hired as a media coordinator

at a very, very interesting time.

Joined Facebook the last week before I left college, but really everything in the digital space was starting to explode. And we were really a team that was primarily doing more traditional type tactics. And so had an opportunity to really embrace learning the digital marketing space, starting with search and just expanding from there as the industry continued to evolve. So had a lot of people kind of pushed me in that direction. Kevin, Chris, and then Colleen Bogart, who was my first boss and mentor.

And did that for a number of years.

Left and bounced around to a few places, grew up a little bit, and then was really excited to get called back, I think roughly about six years ago now.

Yeah.

As Colleen was starting to think about succession planning and also just as we look to continue to expand and grow our capabilities. And so it’s been a quick six years, but yeah, it’s a fun little story and very much started from the bottom and now we’re here.

Now we’re here. And I love that too, because you talk about opportunities for advancement, like there absolutely are those.

But we also say with people, people’s lives and careers take different turns. I’m never a person who will take it personally if somebody is needing to go expand their horizons or fill their cup in a different way. But I do love to say often, well, I hope you

boomerang back. Look at Bob. Yeah. Bob the boomerang.

Exactly.

For me, I left from a media role and went to an account role and I didn’t enjoy it,

and mostly because I like being more in the weeds on things. And so I missed that part of the job. But in terms of advancing my career,

I was much better in a presentation setting, much better talking to C-level type executives with our different client base.

It was also interesting because I went from a full service agency to a digital agency. So I went from really having to focus on selling why digital because that was still very much a question at that time, to going to a place where they’re already hiring a digital agency. So now it’s how do we do it and how do we do it well?

And then from there, kind of shifted back into the media side and had another agency here in town and then came back.

Well, I love it. We’re happy to have you. And yeah, now you lead all of our media efforts. And I know last week when we had you on, we were talking about just the changing media landscape,

which I think every year we say that it’s changing more than ever, but that does seem to

be how it’s going. But I know today we wanted to talk a little bit more specifically around privacy. And we have a lot of healthcare clients. It’s between 70 and 80% of our business presently in terms of our client makeup. And so it’s a question that we get a lot and it’s something that we have to grapple with a lot.

How do you see that evolving right now, particularly with there’s a lot going on in the news around privacy with some changes happening in the government and people being curious about what’s happening with their data. What do you see as

the key things to keep your eye on right now as a brand or as a person?

Yeah, well, you make a good point. It’s certainly always changing. It’s not a new topic by any means. I mean, when I was here the first time, I remember writing blog posts about online privacy.

We had things like a do not track button that was talking about getting there. And obviously cookies and everything going on with that has been a major discussion point over the years.

I think really where we’ve seen the bigger shift, particularly on the healthcare side,

goes back to 2022. So Department of Health and Human Services put out guidance at the end of that year that was really talking about collection of PHI, so that health information as it relates to things like analytics tools and any sort of advertising platforms that we’re running. And that was really the tipping point for us, particularly for any clients that we’re trying to target patients or people with specific conditions for the most part, Google, Meta,

policies in place really for the last decade in terms of you shouldn’t be using any of that data to go out and target somebody. But this now created a lot more complexity for how we’re going to measure the performance, how we’re going to target for these campaigns. And what it really did is compliance teams with a lot of our clients started to get much more involved. And so we started to have a lot more direct conversations really explain, well, what type of tracking do we have on a website? What are these pixels? What are they collecting? What specific variables are coming in there? And a lot of organizations really went in different directions from that point. Some of them immediately said, we need to pull all of this tracking off the site. And we’re just going to do it and figure it out from there. Others did more of a transition, but really, I mean, that really set the tone for whether or not the government was going to start punishing organizations that were following the rules and were maybe collecting some of that more private information. So, other clients we saw say, we don’t want to play in the patient direct game. We’d rather focus on more B2B type targeting. It’s more privacy forward. So we’re going to put all of our attention towards that and not deal with all of the complexities that come with targeting a consumer or patient audience.

Sure, yeah, I mean, that makes sense. And I think it’s interesting too, because from a web perspective, you said we had some clients that just pulled it all off. But I think also the clients who did continue to collect that type of information

had to make their web experience a lot, I guess more robust in terms of the permissions around those types of things. So now we have those banners that come up on every single website where you can customize what’s tracked and what’s not. There’s check boxes. There’s a million different ways that people can do it. Some just say yes or say no. But it changes the customer experience a little bit.

One thing I wanted to mention is, I think sometimes we see that those types of things where you’re having to give permissions change performance from a media perspective. And not necessarily just in terms of cookies or whatever, it might just be the more things people need to agree to, the less likely they are to share that information. So how do you give guidance on balancing that?

Sometimes when we’re working with compliance teams, and I know we do this on the creative standpoint, is this a requirement or is this a request? And so talking through some of those aspects of it,

you’re right, any time you add anything new to a site that is a performance-focused site, whether it’s a new field within a form, a new box they need to check, a pop-up when they come to the site, all of those things are gonna impact just what the activity and what that user flow looks like. So you have to consider all of those things. And sometimes we can recommend for or against things. Sometimes we have the ability to test things in more of an A-B type setting. In other times, this is direction, you need to take it, and we’ll deal with the implications of that. And our job there is to at least help our marketing team clients, help them understand, here could be the potential impact. Or when we do see the impact to raise that flag very, very quickly and say, hey, you made this change, we’ve seen an impact on our performance, so let’s be mindful of that going forward. And then they can decide what to do.

Document it so that when your boss asks you that question, you say, yes, we made this change on February 2nd.

We’re willing to, right, we will make this change. Here are the potential upsides and downsides to doing that.

Even things about the ability to go out and contact somebody, you might get a lower conversion rate, but how valuable is it for you to be able to reach out to somebody through a different form of communication or get them to opt into something? So you have to balance what those objectives are of that too.

Right, and from, so I guess that’s a little bit on the collecting of that information, right, or how those regulations came about. But in terms of what we use it for, for our clients, can you just talk a little bit about that? Because I think there are a lot of misconceptions around what that data is actually used for. Obviously from a brand perspective, that might be a little bit different than on the marketing side, but we could at least speak for us.

Sure, yeah, I mean, as marketers, we are usually looking at data in a much larger sample size. So we’re looking at things in the aggregate. We wanna make sure we have statistical significance on things, so we’re not looking at it on a one-to-one level or that. The problem is, in order to get to that aggregate, you have to collect things on a one-to-one level. And the definitions of around what is PII or PHI has changed, and there’s even some ambiguity in terms of what that is. A perfect example of that is something like an IP address or a device ID. Google, in their terms and conditions, doesn’t see that as PII. But in the case of PHI, when you combine an IP address, which is gonna be to a specific person or household, and then you combine it with some activity that they’re doing on the website in terms of conditions that they’re looking into or products that they’re looking into, now there’s enough information there where things can be stitched together by somebody who’s trying to do that. That’s usually not the case of what we’re doing, but just the fact that that can happen is what puts an organization at risk.

You’ve seen a lot of changing in terms of types of tools that we can use. Google Analytics, if you need an analytics platform that’s going to sign a business associate agreement, they’re not gonna do it. Meta’s not going to do it. So you have to look at other tools, like Mixpanel, which are really focusing on the healthcare space.

We had a client who was making a transition away from Google Tag Manager, and they were working with Telium, which allows you to have a little bit more control on terms of what user information is being collected.

So there are solutions that have come up from this to help you still do some level of data collection so we can get that feedback loop that we want on the performance of our marketing without necessarily crossing the line into collecting too much information.

Right, yeah, I think that that’s a great option for those that are very, very sensitive to it.

completely understand the sensitivity too, right? Like, who hasn’t gotten a letter

from a credit card company, for example, that’s like, oh, sorry, all your stuff was leaked. Now I have no idea where that’s going or how it’s being used or how to prevent those things. But I can understand why it scares people.

I also think there’s a little bit of a degenerational difference where if,

with millennials and with Gen Z, with that being so commonplace, there’s a little less fear around that, but there’s more sensitivity to things like people knowing conditions or identity fraud. Like, I feel like people always used to talk about identity fraud. Nobody really brings it up anymore. I guess it’s like credit card fraud is a lot more common. Like over the summer,

my husband was like, did you just

spend $1,800 on Amazon? I’m like, what could I possibly have spent $1,800 on Amazon? It was a pool.

Somebody just bought a pool,

canceled it and got the money back. But I understand the nervousness, especially when it’s around sensitive medical diet and diagnoses, which we already have HIPAA compliance around. So I

guess could we also speak a little bit about that from a HIPAA perspective, like how we approach that here at the agency?

Yeah, so one of the things we do, every employee does go through annual HIPAA training where we understand specifically the rules around HIPAA. Usually there are updates around the different changes in the privacy laws. So there’s nothing really at the national level that is really dictating a lot of these online privacy things, but you’re seeing many of the states. I think it’s about half of the states have some sort of specific privacy law and they’re getting more and more comprehensive.

Washington just put one in place at the start of this year, the My Health, My Data Act, that is very, very focused on healthcare data and it expands beyond simply healthcare organizations. It’s basically, any organization should not be collecting any of this data. So

I’m not sure that we’ll see anything on the national level. I think it will be state by state. So it’s gonna depend on how much of a priority it is for each of the governments running it at that level.

Yeah, I was just gonna say, so would you imagine that’ll get rolled out slowly and over time and it’s gonna be where we’re checking down the different boxes to make sure that we’re compliant in different areas?

Yeah, exactly. And it’s usually, it’s a handful of states each year are rolling out some new legislation. So you have California who really was on the early stage of it and got ahead of it and they’ve continued to evolve CCPA and their types of laws that they have in place, but you’ve seen all of the other states really start to follow suit.

So we need to stay trained on that and we need to understand it. The other piece is

we really ensure that we can avoid getting access to any of it. So we need to have firewalls in place to make sure that there is never any passover of data from our clients. So we work in first party data with many of our clients outside of the healthcare space, but in the healthcare states, it’s gotta stay behind those firewalls. So we’ll even work with clients, even from a reporting standpoint, oftentimes we’ll be asked to work in their environment and get more of that remote access into their, work on their side.

And by the time we’re seeing the data, it’s completely de-identified in Anonymous. And we do that by design because we don’t wanna put our own individual organization at risk, let alone the client’s data. So making sure that nothing is ever transmitting to us. We would never have a client send us even an email list

because that would be something that would be

just more of a risk for us to have within our own computers and devices.

Right, we don’t want that liability either. Yeah, and

know for some of our clients, we will upload first party lists to places like Meta, for example. And that might not get passed to us. It might just get uploaded by the client right into the platform and then we’re able to then execute on it. Is it the same with our healthcare clients? Are we able to do that? Or are there even more restrictions on that side?

Yeah, there are even more restrictions. There are some tools that are HIPAA compliant that can act as that intermediary between the client side data and the actual advertising platforms. But even that becomes a discussion of

not just can we, but should we?

Should we, yeah.

Whether you want to use that type of information. And this goes beyond healthcare, but we had a tendency to over target things over the last dozen years. All of these different options came available to us in terms of third party data signals that we could use. And I think where that has shifted is

there’s always some concern around the accuracy of that data as that is. But also as we start seeing people move more from that really bottom funnel performance focus to more of that full funnel focus,

broadening that reach is actually a good thing. And so there are tools where you can understand, look at someone with a specific condition and dig into the attributes of that, understand their age ranges, gender, and other types of attributes, even household income. And those are all completely safe ways for us to go out and target because we’re not using the specific condition. It’s when we’re trying to explicitly target. And even if you know those things, it’s like, should you? The example I see all the time, I get ads on Instagram for not choking, lotion for my bald head. When have I ever told anybody on the internet, I’m sure they have a signal, they probably can just see it in the images that get posted. But that’s a little too on the nose or on the head.

But it’s like anti-shine, bald cream.

Oh man. All right, thanks.

But I don’t need you to know that and suggest those types of things.

I agree. And it’s interesting too. Sometimes you get those with life stage. And I agree with you, there’s a time and a place. If you are looking to buy a house and we realize that some audience also has an affinity for a certain type of car or whatever, sometimes we use those types of signals to be like, oh, let’s create an ad that speaks to that person that’s gonna resonate whatever.

But I always get a kick out of life stage stuff because the second you get married, you start getting like diaper ads. And it’s like, whoa, whoa, whoa. I want my family to ask if I’m pregnant. I don’t need the internet asking me.

I mean, and it’s possible. I mean, that ad, I could be getting it just because I’m over 40.

Yeah, that’s true.

And so there may not be any sort of really specific signal. It’s just because it was very targeted and relevant to me, it caught my attention and made me question more from a marketer side of like, how are you doing this? How did you decide

that this was a product for me? You have to consider how that’s going to then be received by the end user as well, right? Because

to your point, if it feels a little too pointed,

then you’re not gonna get that conversion anyway. So you have to find the right balance.

Awesome, well, in terms of final question

here, for marketers who are working in healthcare companies who are in these highly compliant, confidential situations that are nervous

about working with data and working with marketing agencies,

I guess is there any advice you would give them on current landscape or how to go about things in order to bring some peace of mind to them and to the powers that be in their organizations?

Yeah, I mean, I think there are some more future-proof types of targeting that’s going to be out there. Certainly just simple demographic targeting and things like that just to get that broader reach is helpful, but also, this is not a new targeting approach, but contextual targeting can be really, really relevant. So maybe I don’t wanna see an ad for a specific condition in my social feed where it’s implying that they know some information about me, but if I’m doing research on a specific condition and reading about it and there is an ad on that page, that’s going to be very targeted and relevant to me and I’m gonna welcome that much more. So even just swinging back towards simple, basic, contextual marketing is a good thing to have as part of your mix. That’s something that is safe, it’s going to be more welcomed, it’s a little broader, but I think we need to, as marketers in general, just start to broaden our targeting. Often when we do get ultra targeted, the costs are really, really high. So we’re layering all these different data sources and the question becomes, would we be better off buying a broader audience, getting that mass reach at a much more efficient CPM and usually that will come out more efficient. So there’s always going to be a balance with that and the other thing I would say is,

I think as agencies, we need to be prepared to have conversations with people beyond the marketing team. We need to be able to talk about the nuances of the different platforms with their compliance and their legal teams and be able to share that information so they have a level of comfort that what we’re doing is not exposing the company to risk. So we like having partnerships where we have opportunities to speak with people beyond marketing. We wanna talk to sales, we wanna talk to IT, we wanna be talking to finance. They hold the budget so we wanna be talking to them and same thing with legal and compliance. So as an agency and working in an agency, we need to be prepared to speak to all of the technical details of that and so that’s where we have to continue to stay smart on it and understand what changes and get proactive about communicating any of those changes over to that team.

Yeah, awesome. Well, that’s great advice. Thank you so much, really appreciate it. I think people will find it really helpful. It’s just a cluttered landscape and I’m sure we’re gonna talk even more about it in the coming months with all that’s coming down.

Yeah, all right, thank you, Katie.

On the contextual side of things, would Reddit count in that? Because I feel like that’s such prime territory. You can get so specific.

Reddit, there is a community for everything.

Everything.

So Reddit would be a great example of that. And then of course, there are tons of medical websites out there where people are spending time. Everybody’s Googling their conditions and every symptom that they have. So there’s enough available impressions there for us to go out and reach. And you can get nuanced with really specific keyword targeting, keyword contextual targeting. So there’s a lot of opportunities for us to get out there where we’re not doing