With the recent changes with CCPA, CPRA and HIPAA, as well as recent lawsuit settlements in headlines and new states updating their data privacy regulations, many marketers (and privacy champions) have been spinning their wheels trying to understand how to stay compliant. What does this mean for our website? What does it mean for how we evaluate marketing performance? What does it mean for our visitors and their experience?
Indeed, balancing what your customers need, what your C-Suite needs and what your state governance requires can be challenging. And no agency understands that better than Hedy & Hopp.
In this post, we share our successful approach to compliance that has helped our clients make a few necessary changes that builds trust with their customers – without losing the ability to derive actionable insights that grow their business in a privacy-forward world.
These changes may seem daunting (and even a bit terrifying) at first, but remember that dealing with change is what marketers are designed to do. We constantly need to adjust based on the information received and this challenge is no different. Marketers can either embrace this new world as an opportunity to improve trust with their audience, or keep doing the same thing until they’re forced to make a change (which is inevitable).
At Hedy & Hopp, we prefer the former, and want to share with you how we’ve helped our clients make sense of the changes and set themselves up for success in the long-term.
Want more details on these steps? Please keep reading!
Got a case of “TLDR”? Please get in touch – we’d love to help!
Like most evaluation efforts when a massive change happens, we start with an audit. Document all of the channels you use, plan to use, are investigating using or/and have used in the last 12 months (to account for changes with seasonality).
Supplement this list by using third party tools like Wappalyzer to identify any pixels, code, plugins, etc., that may be on your website.
PRO TIP:
It is important not to skip this part. We cannot tell you how many clients have told us that they removed a software but we still saw live tags in GTM or hard-coded on their website There are also many plugins that our clients didn’t even know existed that we were able to identify (and actually remove if needed) through using these tools.
At least in the initial stage, it’s important for marketers to know what applies to them. Covered entities are always beholden to HIPAA, but health-adjacent companies and non-covered entities also need to be aware of the FTC and state laws, where applicable. Most states require companies to reach a number of annual visitors or/and meet a specific revenue goal in that state before they are required to comply, but it does vary. IAPP is a great resource for keeping up with those details.
First, conduct a monthly traffic report for the last 12 months, and separate out by state.
Under the state(s) that are relevant to your company, review the following:
You will probably find a lot of softwares that can be excluded from further investigation, like Javascript libraries, fonts and some plugins. But there will be a host of others that, either by nature of the platform or based on your implementation, will cause some issue with privacy – specifically with the “selling” (or sharing) of personal information.
Below is a guide for the kinds of platforms we have seen make the priority list:
If this list freaks you out, we see you. It looks like EVERYTHING is a priority! So we broke it down even further to prioritize based on the intent of how the platform is using that data, which makes the list looks a bit more manageable:
Priority 1: Data shared with additional third parties or/and includes sensitive information
Priority 2: Data necessary to perform function
Ok, that probably still makes your heart race, but what’s important to keep in mind is that the biggest concern for these platforms is based on the information being shared and how. Tools like your Website CMS by nature need to collect IP addresses, so while your company is sharing that “personal” information with a third party, it might not be a big risk for your company since that access is required to work.
Why do we say that? Although an IP address is still considered PII, it’s not nearly as personal (i.e., 1-to-1) as a diagnosis, a name, or an email address. This is why it’s essential to work with your legal team to determine what platforms are riskier than others based on the agreements in place.
As a marketer, your first instinct may be to say that all of these softwares, tools and platforms are necessary. And that might be the case. In our experience, however, there are usually software or tactics that are duplicative or have a more compliant alternative. Think critically about what your marketing is doing for you and embrace the opportunity for refinement that you now have.
Here are some questions to ask yourself while evaluating the priority tools:
If you said “no” to either of these questions, definitely consider removing those tools and tactics and you’ll be on your way to a cleaner, more compliant marketing plan and website. If you responded yes to any of these questions, then the next step is an important one – so keep reading!
PRO TIP:
Consider if any of the tools are duplicative. If you can consolidate tools to limit the number of third party tags and tools on your website, we would always recommend doing so.
This is the big one – the future of your marketing activation and evaluation. This last part will take some time and collaboration from your organization and marketing partners. The main question here is how you can modify the implementation or replace the tool to improve compliance. Some tools may offer anonymization, for example, which would be worth exploring.
Each marketer will implement various tools in various ways (too many variables for this post!). Here are a few best practices that helped us get our clients up to par (without losing their minds).
PRO TIP:
If you’ve not done so already, this is the time to make absolutely sure your legal team is aware and involved in these discussions. With the number of nuances with HIPAA privacy, it’s critical that your company’s legal team has the opportunity to engage and provide input on updates, specifically on privacy policies and the company’s overall data privacy approach.
Once these changes are in place, consider the next 30-60 days as a trial period. Are you missing any data for evaluation? Any new questions arising with the data you can see? It’s a good reminder that any change that you make will take some adjusting, but that doesn’t mean insights can no longer be found.
PRO TIP:
Don’t forget to update your data visualization dashboards to account for any new placements, accounts or configurations!
We’d love to help. Contact us today to see how we can get you and your team data privacy compliant!
The original version of this page was published at: https://hedyandhopp.com/blog/auditing-your-marketing-for-hipaa-compliance/
We are, marketing happy. Hedy & Hopp is a full-service, fully healthcare marketing agency focused on holistically activating effective and emotional connections between brands and patients. At He... Read more
