HIPAA Compliance and Digital Innovation: Insights from Aaron Burnett

[00:00:01] [SPEAKER_01]: Welcome to the Chalk Talk Jim podcast, where we explore insights into healthcare that help

[00:00:08] [SPEAKER_01]: uncover new opportunities for growth and success.

[00:00:11] [SPEAKER_01]: I'm your host, Jim Jordan.

[00:00:21] [SPEAKER_01]: Welcome back to the show.

[00:00:22] [SPEAKER_01]: And in today's episode, we have Aaron Burnett, and he's the CEO of Wheel Health's Digital

[00:00:28] [SPEAKER_01]: Marketing Group.

[00:00:29] [SPEAKER_01]: It's a leading agency specializing in solving complex digital challenges in healthcare

[00:00:34] [SPEAKER_01]: and the medical device sectors for over a decade.

[00:00:37] [SPEAKER_01]: Aaron brings invaluable expertise in navigating the evolving landscape of HIPAA, regulations

[00:00:42] [SPEAKER_01]: and data privacy.

[00:00:44] [SPEAKER_01]: In this episode, we'll delve into the intricacies of direct-to-consumer marketing in healthcare.

[00:00:49] [SPEAKER_01]: We'll explore how companies can adapt to these new privacy guidelines and leverage

[00:00:53] [SPEAKER_01]: first-party data for better targeting and campaign efficacy.

[00:00:58] [SPEAKER_01]: Now you're going to learn about the latest regulation changes and their impact on your

[00:01:03] [SPEAKER_01]: digital marketing strategies and how to innovate your data solutions to meet this changing

[00:01:08] [SPEAKER_01]: landscape.

[00:01:09] [SPEAKER_01]: So, Aaron, tell me in the audience a little bit more about yourself.

[00:01:12] [SPEAKER_00]: Sure.

[00:01:13] [SPEAKER_00]: I'm Aaron Burnett.

[00:01:14] [SPEAKER_00]: I'm CEO of Wheelhouse Digital Marketing Group.

[00:01:16] [SPEAKER_00]: We are a 14-year-old digital marketing agency that helps our clients thrive by

[00:01:20] [SPEAKER_00]: solving their toughest digital challenges.

[00:01:22] [SPEAKER_00]: We have a concentration in healthcare and medical device clients and have had for

[00:01:27] [SPEAKER_00]: the last 10 years.

[00:01:29] [SPEAKER_00]: And for us, over the last couple of years, really one of the thorniest problems that

[00:01:34] [SPEAKER_00]: we've been dealing with our clients is enabling them to succeed in an increasingly

[00:01:40] [SPEAKER_00]: regulated environment with increasingly strict and locked down privacy regulations.

[00:01:47] [SPEAKER_01]: So we spent a little bit of time talking before because we started out talking about

[00:01:51] [SPEAKER_01]: HIPAA and I thought I knew a lot about HIPAA but when you're done with me, I

[00:01:55] [SPEAKER_01]: said, I guess I do not.

[00:01:57] [SPEAKER_00]: So you said you have a good understanding of HIPAA and the way it has been conventionally

[00:02:02] [SPEAKER_00]: understood it's a body of regulation that's been around for a really long time.

[00:02:07] [SPEAKER_00]: But the definition of protected health information and the definition of HIPAA coverage for

[00:02:14] [SPEAKER_00]: that information expanded pretty dramatically in November of 2022 when the Office of

[00:02:19] [SPEAKER_00]: Civil Rights as a Department of Health and Human Services issued new guidance

[00:02:24] [SPEAKER_00]: which really had the effect of law and the guidance was an expansion of the definition

[00:02:29] [SPEAKER_00]: of HIPAA.

[00:02:30] [SPEAKER_00]: Historically, HIPAA has been understood to govern and protect patient information.

[00:02:35] [SPEAKER_00]: I know who you are as a patient.

[00:02:37] [SPEAKER_00]: We have a relationship.

[00:02:38] [SPEAKER_00]: You've come to my health care system website.

[00:02:41] [SPEAKER_00]: You've logged in and anything that you do from that moment of log in onward is

[00:02:46] [SPEAKER_00]: protected.

[00:02:47] [SPEAKER_00]: I'm not going to share that information with anyone else.

[00:02:50] [SPEAKER_00]: If I track it, it's going to be only for my own system.

[00:02:53] [SPEAKER_00]: That is understood to be to have been the sacrosanct data that cannot be shared and

[00:02:58] [SPEAKER_00]: is protected by HIPAA.

[00:02:59] [SPEAKER_00]: The expanded definition in this new guidance was to say any identifier, including

[00:03:06] [SPEAKER_00]: your IP address, plus what you do on a site, whether you're known or unknown.

[00:03:11] [SPEAKER_00]: So meaning if you look at any content related to a health condition, potential

[00:03:16] [SPEAKER_00]: treatment for health condition, look in an appointment, anything that pertains to

[00:03:21] [SPEAKER_00]: the past, current or future health state or potential treatment of an individual

[00:03:26] [SPEAKER_00]: combined with that identifier is now also considered to be PHI.

[00:03:31] [SPEAKER_00]: That was monumentally disruptive in digital marketing circles for agencies,

[00:03:37] [SPEAKER_00]: for HIPAA covered entities because virtually all analytics platforms and

[00:03:43] [SPEAKER_00]: nearly all tracking technologies used for digital advertising collect IP

[00:03:47] [SPEAKER_00]: address by default and collect user behavior by default.

[00:03:52] [SPEAKER_00]: And so overnight, the tracking technologies used for digital advertising,

[00:03:56] [SPEAKER_00]: the Google analytics script and data that's being collected became a violation

[00:04:01] [SPEAKER_00]: of HIPAA and healthcare systems, medical device clients and companies

[00:04:05] [SPEAKER_00]: needed to react.

[00:04:06] [SPEAKER_01]: So let's go a little deeper because we were kind of slicing the line of

[00:04:10] [SPEAKER_01]: how does that differ for a medical device company and a pharma company

[00:04:14] [SPEAKER_01]: that historically would be say advertising to physicians versus going out and

[00:04:20] [SPEAKER_01]: advertising directly to a patient, which may have a little more implication

[00:04:25] [SPEAKER_01]: in the pharma industry than the medical device industry.

[00:04:28] [SPEAKER_00]: Yeah.

[00:04:29] [SPEAKER_00]: So HIPAA and in this guidance HHS have really focused on patient

[00:04:34] [SPEAKER_00]: information.

[00:04:35] [SPEAKER_00]: So if I'm let's say a pharmaceutical company and I am marketing to only

[00:04:39] [SPEAKER_00]: physicians and that's my focus, it may be possible for me to continue to use

[00:04:45] [SPEAKER_00]: conventional tracking technologies and analytics and not have to radically

[00:04:49] [SPEAKER_00]: change my approach to marketing or change my infrastructure.

[00:04:53] [SPEAKER_00]: If I am marketing to patients, to consumers, then I absolutely am going

[00:04:59] [SPEAKER_00]: to be covered by that expanded definition of HIPAA and PHI.

[00:05:04] [SPEAKER_01]: So I imagine for a physician office and health systems, even maybe

[00:05:08] [SPEAKER_01]: insurance companies, they're trying to do preventative programs, right?

[00:05:11] [SPEAKER_01]: They're trying to put out programs for diabetics, for people that have

[00:05:15] [SPEAKER_01]: arthritis, you know, these different types of things.

[00:05:18] [SPEAKER_01]: What are the implications on those types of programs?

[00:05:20] [SPEAKER_01]: How would you handle it before November 2022 and how would you handle

[00:05:25] [SPEAKER_01]: it differently today?

[00:05:26] [SPEAKER_00]: Yeah, I mean before November 2022 in the main a health care system,

[00:05:31] [SPEAKER_00]: a medical device company could behave like most other companies with

[00:05:35] [SPEAKER_00]: regard to their marketing.

[00:05:36] [SPEAKER_00]: So pre-patient relationship, I can use all of the tracking technologies

[00:05:40] [SPEAKER_00]: anyone else uses.

[00:05:42] [SPEAKER_00]: I can post patient relationship.

[00:05:44] [SPEAKER_00]: I certainly can send email to folks.

[00:05:47] [SPEAKER_00]: I can track using third party technologies, the efficacy of my email

[00:05:51] [SPEAKER_00]: marketing, whether something was opened, not opened, opened by cool.

[00:05:56] [SPEAKER_00]: After someone opened and clicked through an email, what they looked

[00:05:59] [SPEAKER_00]: at on my website after November 2022, I could still do many of those

[00:06:05] [SPEAKER_00]: things, which regard to email marketing.

[00:06:07] [SPEAKER_00]: Let's start there.

[00:06:08] [SPEAKER_00]: I can still email a known patient, but I cannot use a third party

[00:06:13] [SPEAKER_00]: tracking technology to measure or monitor the efficacy or the

[00:06:18] [SPEAKER_00]: action in that email.

[00:06:20] [SPEAKER_00]: If that tracker technology means that that data flows to that third

[00:06:24] [SPEAKER_00]: party in addition to my own systems or simply goes to that third

[00:06:30] [SPEAKER_00]: party and that third party isn't under what's called a business

[00:06:33] [SPEAKER_00]: associate agreement.

[00:06:34] [SPEAKER_00]: The business associate agreement effectively obligates a third party to

[00:06:38] [SPEAKER_00]: the same privacy regulations and the same privacy obligations as that

[00:06:43] [SPEAKER_00]: HIPAA covered entity.

[00:06:44] [SPEAKER_00]: So post November of 2022, I need to change almost all of my tracking

[00:06:49] [SPEAKER_00]: technologies and I need to change the way that that data is handled.

[00:06:54] [SPEAKER_00]: It's important to understand one big distinction here, and that is for

[00:06:59] [SPEAKER_00]: HIPAA covered entity tracking the information and having the

[00:07:04] [SPEAKER_00]: information is not problematic.

[00:07:06] [SPEAKER_00]: If I have my own tracking technology or if I use a technology that

[00:07:10] [SPEAKER_00]: enables me to collect data and that data comes back to my own

[00:07:14] [SPEAKER_00]: data warehouse or my own analytics system, and it's all on my

[00:07:18] [SPEAKER_00]: infrastructure, that's fine.

[00:07:20] [SPEAKER_00]: It's the sharing of information that is a HIPAA violation, but the

[00:07:26] [SPEAKER_00]: entire digital marketing ecosystem and the digital analytics

[00:07:29] [SPEAKER_00]: ecosystem pre November of 2022, sort of by definition existed in a

[00:07:34] [SPEAKER_00]: context in which data was shared.

[00:07:36] [SPEAKER_00]: Google Analytics collects your analytics data and you view it

[00:07:40] [SPEAKER_00]: through their user interface on their platform.

[00:07:43] [SPEAKER_00]: Meta for Facebook and Instagram uses their own tracking

[00:07:46] [SPEAKER_00]: technology as does every other advertising provider.

[00:07:49] [SPEAKER_00]: And what's important to understand is that when you use those

[00:07:52] [SPEAKER_00]: tracking technologies and data is collected, the data goes

[00:07:55] [SPEAKER_00]: straight to that third party and then you view it in that third party.

[00:08:00] [SPEAKER_00]: And the data that is collected is controlled by that third party as well.

[00:08:04] [SPEAKER_00]: So even if you were as a HIPAA covered entity to find some way to begin to

[00:08:10] [SPEAKER_00]: constrain the data that's collected in a way that you felt was now in

[00:08:14] [SPEAKER_00]: compliance with that expanded definition of HIPAA, you could not be sure

[00:08:19] [SPEAKER_00]: that tomorrow the data collection method wouldn't be updated by that

[00:08:23] [SPEAKER_00]: third party in a manner that once again resulted in a violation.

[00:08:27] [SPEAKER_00]: Things became very complex very quickly.

[00:08:29] [SPEAKER_01]: Yeah, going back to your business associate agreement, having tried to

[00:08:33] [SPEAKER_01]: cut one with Apple at the university a long time ago, their

[00:08:37] [SPEAKER_01]: response is listen, that brings on legal risk to our organization.

[00:08:41] [SPEAKER_01]: It changes our core infrastructure and how we behave.

[00:08:44] [SPEAKER_01]: And you're not financially relevant enough to us to take on that risk

[00:08:49] [SPEAKER_01]: and change our business processes.

[00:08:51] [SPEAKER_01]: So for the audience members that are thinking, well, we're just going to

[00:08:54] [SPEAKER_01]: go get these business associate agreements, probably not going to happen.

[00:08:57] [SPEAKER_01]: So what that means is I can't go on Facebook and just post an ad for

[00:09:04] [SPEAKER_01]: diabetes training or something that was oriented in the past.

[00:09:08] [SPEAKER_01]: And so today, how do you help your clients solve this problem?

[00:09:13] [SPEAKER_00]: So a couple of responses there, one is you can go on Facebook

[00:09:17] [SPEAKER_00]: and just post an ad.

[00:09:19] [SPEAKER_00]: And if you were unaware, you might also place the metapixel on your

[00:09:23] [SPEAKER_00]: website to track a campaign just as you would.

[00:09:26] [SPEAKER_00]: It's just that you would be subject, you'd be very likely to be sued.

[00:09:30] [SPEAKER_00]: And there are hundreds and hundreds and hundreds of lawsuits out there

[00:09:33] [SPEAKER_00]: right now against the health care systems and medical device companies

[00:09:36] [SPEAKER_00]: for doing just that sort of thing.

[00:09:39] [SPEAKER_00]: What you need to do now, if you want not to be in violation, is to

[00:09:44] [SPEAKER_00]: create a means of collecting data and a means of structuring and managing

[00:09:50] [SPEAKER_00]: your digital advertising that does not require you to share that

[00:09:54] [SPEAKER_00]: information with third parties that are not under DAA.

[00:09:58] [SPEAKER_00]: And that's what we've spent a lot of time helping our clients

[00:10:01] [SPEAKER_00]: with over the last couple of years.

[00:10:03] [SPEAKER_01]: Well, and you're going to these digital clients because they

[00:10:06] [SPEAKER_01]: have the people, right?

[00:10:08] [SPEAKER_01]: They have the population, they have the captured audience.

[00:10:11] [SPEAKER_01]: So is there any way that I could place an ad with that captured

[00:10:16] [SPEAKER_01]: audience with using my people?

[00:10:21] [SPEAKER_01]: I mean, I guess, you know, usually having done an attitude to myself,

[00:10:25] [SPEAKER_01]: usually go in and you say I'm targeting diabetics.

[00:10:27] [SPEAKER_01]: I'm targeting this right.

[00:10:29] [SPEAKER_01]: This age group.

[00:10:30] [SPEAKER_01]: Is that a violation or is it when I feed the specific

[00:10:33] [SPEAKER_00]: people I'm looking for into?

[00:10:35] [SPEAKER_00]: That's such a great question because that gets right to the core of this.

[00:10:38] [SPEAKER_00]: Fundamentally, this is an issue of data strategy.

[00:10:41] [SPEAKER_00]: When you're working with a platform, free November, 2022, you're using

[00:10:45] [SPEAKER_00]: third party data, which is data somebody else owns.

[00:10:48] [SPEAKER_00]: Let's use Facebook as the example, because they have ended up being kind

[00:10:51] [SPEAKER_00]: of the poster child for privacy violations in this situation.

[00:10:55] [SPEAKER_00]: You're right.

[00:10:55] [SPEAKER_00]: Facebook has the massive audience and you've been able to go in to

[00:11:00] [SPEAKER_00]: log into their platform and say, I want to reach men in this age range

[00:11:06] [SPEAKER_00]: with these demographics and these psychographics in this particular

[00:11:10] [SPEAKER_00]: geography, and that was so easy.

[00:11:12] [SPEAKER_00]: They did all the work.

[00:11:13] [SPEAKER_00]: They have the audience and you just speaking to them.

[00:11:16] [SPEAKER_00]: You're using third party data, but third party data is problematic

[00:11:19] [SPEAKER_00]: in this situation because you can't send them the data that enables them

[00:11:23] [SPEAKER_00]: to facilitate your targeting or to optimize your campaign.

[00:11:28] [SPEAKER_00]: And so what we've been doing and working with our clients is enabling

[00:11:32] [SPEAKER_00]: to take control of their own destinies by using what's called first party

[00:11:36] [SPEAKER_00]: data to power their insights and power their targeting and to drive more

[00:11:41] [SPEAKER_00]: successful outcomes than they could have with third party data.

[00:11:45] [SPEAKER_00]: So let's talk about first party data.

[00:11:47] [SPEAKER_00]: First party data is data that you have that you own, you have

[00:11:51] [SPEAKER_00]: permission to have that data and use that data.

[00:11:53] [SPEAKER_00]: Remember it's not a violation to have collected data or to use that data.

[00:11:58] [SPEAKER_00]: It's a violation to share the data.

[00:12:00] [SPEAKER_00]: And so what healthcare systems and those who are HIPAA covered entities

[00:12:05] [SPEAKER_00]: need to do when what we've been doing with our clients is to help them

[00:12:09] [SPEAKER_00]: develop first party data strategies.

[00:12:11] [SPEAKER_00]: There are a lot of implications for that.

[00:12:13] [SPEAKER_00]: You need to be focused on collecting the data in a significant enough

[00:12:17] [SPEAKER_00]: manner that you can glean insights, understanding what's valuable

[00:12:21] [SPEAKER_00]: about that data, and then being able to combine that data with

[00:12:26] [SPEAKER_00]: performance information in a HIPAA compliant data warehouse or business

[00:12:32] [SPEAKER_00]: intelligence platform so that your analysts, the people who are running

[00:12:37] [SPEAKER_00]: your digital advertising can look at that and see, oh, I see the

[00:12:41] [SPEAKER_00]: patterns in this data.

[00:12:43] [SPEAKER_00]: I understand that we should be targeting again, you could do

[00:12:47] [SPEAKER_00]: the same sort of thing.

[00:12:48] [SPEAKER_00]: We should be targeting men in this age range and this geography

[00:12:50] [SPEAKER_00]: and with this demographic and this psychographic.

[00:12:53] [SPEAKER_00]: An analyst can take that information and action that information in an

[00:12:59] [SPEAKER_00]: advertising platform.

[00:13:00] [SPEAKER_00]: You cannot share data.

[00:13:01] [SPEAKER_00]: You can't share any protected health information, but having learned in

[00:13:05] [SPEAKER_00]: the context of a data warehouse or a business intelligence platform,

[00:13:09] [SPEAKER_00]: the types of audiences you should be targeting, you can then go to a

[00:13:13] [SPEAKER_00]: third party platform and you can use that information to target

[00:13:18] [SPEAKER_00]: those audiences there, but what's required is this notion of what's

[00:13:22] [SPEAKER_00]: called an air gap.

[00:13:23] [SPEAKER_00]: There can be no data connection between that protected health

[00:13:27] [SPEAKER_00]: information and a third party platform.

[00:13:30] [SPEAKER_00]: The implication then is you've now been able to manually target

[00:13:34] [SPEAKER_00]: audiences in this third party platform.

[00:13:36] [SPEAKER_00]: You have to have a different way to measure the performance of

[00:13:40] [SPEAKER_00]: those campaigns that does not result in your sharing PHI with

[00:13:45] [SPEAKER_00]: those platforms, and that requires a different approach to analytics,

[00:13:48] [SPEAKER_00]: a different approach to advertising tracking that again, protects the

[00:13:53] [SPEAKER_00]: HIPAA covered entity that allows you to drive successful outcomes.

[00:13:58] [SPEAKER_01]: So I'm a health system.

[00:13:59] [SPEAKER_01]: I know this patient's a diabetic because they're in my billing system, right?

[00:14:03] [SPEAKER_01]: Right.

[00:14:03] [SPEAKER_01]: I know that maybe they have an obesity over X and there may be even type

[00:14:07] [SPEAKER_01]: two diabetic and I have that and I may or may not know, but I may know

[00:14:12] [SPEAKER_01]: that they've attended some of our workshops that we've had for weight

[00:14:16] [SPEAKER_01]: control or education.

[00:14:19] [SPEAKER_01]: So that's a pretty good profile.

[00:14:22] [SPEAKER_01]: How would I, and I can direct mail them because I have their

[00:14:25] [SPEAKER_01]: information that's clean.

[00:14:26] [SPEAKER_01]: But how do I take that profile and legally use it on Facebook or

[00:14:31] [SPEAKER_01]: Instagram or one of the others?

[00:14:33] [SPEAKER_01]: Would it be saying this is the profile I'm looking for without any

[00:14:38] [SPEAKER_01]: connection to the back office that made me get that?

[00:14:40] [SPEAKER_01]: Is that what the line that is at the gap?

[00:14:42] [SPEAKER_01]: Yeah.

[00:14:43] [SPEAKER_00]: So without any one-to-one targeting, you can, if you have your email system

[00:14:47] [SPEAKER_00]: and you have permission to, you certainly could email them.

[00:14:51] [SPEAKER_00]: You could direct market to them that way.

[00:14:52] [SPEAKER_00]: But in terms of digital advertising, you're right.

[00:14:55] [SPEAKER_00]: You can target a profile and not an individual because you can't provide

[00:15:00] [SPEAKER_00]: that, you can't leverage third party tracking to target or to optimize over

[00:15:06] [SPEAKER_00]: time, you have to take it a different approach.

[00:15:09] [SPEAKER_01]: So how are you helping people build that internally to their system?

[00:15:12] [SPEAKER_01]: A few different ways.

[00:15:14] [SPEAKER_00]: One, we've created HIPAA compliant data solutions where conceptually,

[00:15:19] [SPEAKER_00]: remember I described that third party tracking uses third party cookies.

[00:15:23] [SPEAKER_00]: Sites that may have dozens, sometimes larger sites have hundreds of third

[00:15:26] [SPEAKER_00]: party cookies and those cookies, that tracking technology by

[00:15:29] [SPEAKER_00]: definition is a HIPAA violation.

[00:15:32] [SPEAKER_00]: So we first implement a solution that gives each health system what's

[00:15:37] [SPEAKER_00]: called a private client ID.

[00:15:39] [SPEAKER_00]: That becomes the only way that data can be collected on a site.

[00:15:42] [SPEAKER_00]: All the other stuff goes away.

[00:15:44] [SPEAKER_00]: Everything that's collected goes through this private client ID and is defined

[00:15:49] [SPEAKER_00]: positively by the healthcare systems compliance team and the marketing team,

[00:15:54] [SPEAKER_00]: with legal review.

[00:15:55] [SPEAKER_00]: So now you know absolutely what's being collected.

[00:15:58] [SPEAKER_00]: And then we implement all of this in a context that's called server side.

[00:16:03] [SPEAKER_00]: So conventionally and historically analytics tracking, digital advertising

[00:16:07] [SPEAKER_00]: tracking occurred in the browser on what's called the client.

[00:16:11] [SPEAKER_00]: We're moving everything to the server so that all the connections, all

[00:16:16] [SPEAKER_00]: the communication is now between is by API.

[00:16:21] [SPEAKER_00]: It's directly to a server connection with a third party and the data that

[00:16:25] [SPEAKER_00]: is communicated via that API is also within the control of the health system.

[00:16:31] [SPEAKER_00]: So now we control the point of collection.

[00:16:33] [SPEAKER_00]: We control the point of sharing as well, and we can filter and share only

[00:16:39] [SPEAKER_00]: the information that we want to be shared with those third parties.

[00:16:43] [SPEAKER_00]: And it's all within control of the health system.

[00:16:46] [SPEAKER_00]: So we completely changed the paradigm from client side where you have no

[00:16:51] [SPEAKER_00]: control of what's being collected and you don't know if what's been

[00:16:54] [SPEAKER_00]: collected is a violation or not to only a single means of collection.

[00:16:58] [SPEAKER_00]: And all the communication is server side and it's entirely controlled

[00:17:02] [SPEAKER_00]: by the healthcare system.

[00:17:04] [SPEAKER_00]: And then we help our clients to glean the insights and aggregate the

[00:17:09] [SPEAKER_00]: data they need or to optimize campaigns because we have developed a HIPAA

[00:17:13] [SPEAKER_00]: compliant data warehouse and data science team.

[00:17:17] [SPEAKER_00]: And so we can bring in client first party data, third party data from

[00:17:22] [SPEAKER_00]: advertising platforms and analytics.

[00:17:25] [SPEAKER_00]: And we can aggregate into what's called harmonize that data so that

[00:17:30] [SPEAKER_00]: it all can be evaluated in the same way.

[00:17:32] [SPEAKER_00]: And we can look at performance, including the H I across campaigns and

[00:17:38] [SPEAKER_00]: platforms and surface the insights that our digital advertising analysts

[00:17:42] [SPEAKER_00]: need to then go out and adjust targeting and adjust campaign optimization

[00:17:47] [SPEAKER_00]: and drive performance.

[00:17:48] [SPEAKER_00]: And our experience has been that as we shifted to digital advertising

[00:17:52] [SPEAKER_00]: powered by first party data instead of third party data, the outcomes

[00:17:57] [SPEAKER_00]: that we're driving are much more successful than they have been in the past.

[00:18:00] [SPEAKER_00]: Takes a lot to get there, but the value that's delivered is extreme.

[00:18:06] [SPEAKER_01]: So share with the audience, the status of the lawsuits that are going on

[00:18:09] [SPEAKER_01]: because we were talking about that earlier.

[00:18:11] [SPEAKER_00]: Yeah.

[00:18:11] [SPEAKER_00]: So there are many, many, and I won't go into the individual lawsuits

[00:18:14] [SPEAKER_00]: against healthcare systems, but I will highlight one particular lawsuit

[00:18:18] [SPEAKER_00]: in response to the expanded definition of HIPAA that was offered by

[00:18:24] [SPEAKER_00]: HHS in November of 2022, the American hospital association sued HHS.

[00:18:30] [SPEAKER_00]: And in early June, a judge in federal district court in Texas, largely sided

[00:18:36] [SPEAKER_00]: with the American hospital association in a way that I think probably was

[00:18:39] [SPEAKER_00]: initially very exciting to folks.

[00:18:40] [SPEAKER_00]: I'm not sure if it's going to continue to be as exciting.

[00:18:43] [SPEAKER_00]: We'll stay at hoped.

[00:18:44] [SPEAKER_00]: The judges ruling was that HHS in effect created law without due review

[00:18:51] [SPEAKER_00]: and effectively due process.

[00:18:54] [SPEAKER_00]: So the ruling was against HHS, but it was a procedural ruling.

[00:18:58] [SPEAKER_00]: In fact, what was cited in the judgment was that the HHS violated

[00:19:03] [SPEAKER_00]: the administrative procedures act.

[00:19:06] [SPEAKER_00]: So if you distill this, I think 35 page single spaced ruling into sort of

[00:19:11] [SPEAKER_00]: the core, it was all right.

[00:19:13] [SPEAKER_00]: HHS expanding a definition of PHI to include IP address and URLs or content

[00:19:21] [SPEAKER_00]: visited by just an anonymous visitor is a step too far.

[00:19:25] [SPEAKER_00]: You created more and you allowed no one to actually weigh in on this.

[00:19:29] [SPEAKER_00]: You didn't allow administrative review.

[00:19:31] [SPEAKER_00]: You just published de facto law.

[00:19:35] [SPEAKER_00]: And although what you did may be good and maybe correct regulation,

[00:19:41] [SPEAKER_00]: which is what the judge said, this might well be good.

[00:19:44] [SPEAKER_00]: The way you went about it was wrong.

[00:19:46] [SPEAKER_00]: And so you need to, if you want this to have the force of law and

[00:19:50] [SPEAKER_00]: be a standing regulation, you have to take another run at it.

[00:19:53] [SPEAKER_00]: And the judge was explicit in saying, I am not precluding you from taking

[00:19:58] [SPEAKER_00]: another run at this and making this have the effect of law.

[00:20:02] [SPEAKER_00]: You just need to go about it a little bit differently.

[00:20:04] [SPEAKER_00]: So to me, that's a very narrow ruling.

[00:20:06] [SPEAKER_00]: And that means that healthcare systems should be cautious in jumping

[00:20:10] [SPEAKER_00]: for joy and believing that that expanded definition of HIPAA will go away.

[00:20:14] [SPEAKER_00]: I don't think it will.

[00:20:15] [SPEAKER_00]: And I think even if the expanded definition of PHI and that expansion

[00:20:21] [SPEAKER_00]: HIPAA didn't stand, the fact remains that 19 states have individual privacy

[00:20:27] [SPEAKER_00]: regulations, their own state level privacy regulations.

[00:20:30] [SPEAKER_00]: And some of those are more restrictive than the expanded definition of HIPAA.

[00:20:34] [SPEAKER_00]: And so, you know, I think whether it's a state level privacy

[00:20:37] [SPEAKER_00]: regulation or it's a federal mandate under HIPAA, I think the right

[00:20:42] [SPEAKER_00]: thing to do is what we've been helping our clients to do, and that

[00:20:44] [SPEAKER_00]: is take control of your own destiny by learning to cultivate and rely on

[00:20:50] [SPEAKER_00]: power, your digital marketing with first party data so that you don't have to

[00:20:54] [SPEAKER_00]: rely on third party platforms and third party data.

[00:20:57] [SPEAKER_01]: Well, you're a good straight man.

[00:20:59] [SPEAKER_01]: So the other piece we had talked about is that even if these suits get

[00:21:03] [SPEAKER_01]: delayed, the fact of the matter is that Europe is increasing their

[00:21:09] [SPEAKER_01]: personal standards and want to share with you on that it's coming.

[00:21:13] [SPEAKER_01]: You're not going to predict a year and when, but it's coming, right?

[00:21:16] [SPEAKER_01]: Yeah.

[00:21:16] [SPEAKER_00]: In our perspective is that the sort of highly restricted privacy

[00:21:20] [SPEAKER_00]: regulations that are first impacting healthcare organizations here are

[00:21:25] [SPEAKER_00]: going to begin to impact organizations full stop digital marketing writ

[00:21:30] [SPEAKER_00]: large in the United States.

[00:21:31] [SPEAKER_00]: And so we also operate in Europe and have clients who are in Europe.

[00:21:34] [SPEAKER_00]: And so we look at GDPR as the privacy measure that we should

[00:21:40] [SPEAKER_00]: aspire to be operating in, in the U S if we can operate in that sort of

[00:21:45] [SPEAKER_00]: context and particularly from the perspective of the data that is

[00:21:49] [SPEAKER_00]: required, the data collection methods and the data is required to be

[00:21:53] [SPEAKER_00]: effective if we can do that there, then we're in very good stead to

[00:21:57] [SPEAKER_00]: drive very successful outcomes and performance for clients in the U S

[00:22:01] [SPEAKER_00]: regardless of what happens with privacy regulations or what happens

[00:22:06] [SPEAKER_00]: with a particular browser like Google saying they will or will not

[00:22:10] [SPEAKER_00]: support third party cookies.

[00:22:11] [SPEAKER_00]: You don't want, we think you don't want to be in a position

[00:22:15] [SPEAKER_00]: where the actions of a regulatory body or the actions of some large

[00:22:19] [SPEAKER_00]: platform can completely upend your digital marketing in a way that's

[00:22:24] [SPEAKER_00]: massively disruptive.

[00:22:25] [SPEAKER_01]: And I think that's the point is that it's time to get on it.

[00:22:28] [SPEAKER_01]: Yeah.

[00:22:30] [SPEAKER_01]: So as you were talking, I thought about two business models that are

[00:22:34] [SPEAKER_01]: emerging that may be either enabled or inhibited by this in the first

[00:22:38] [SPEAKER_01]: is concept of a real time health system record where the public

[00:22:43] [SPEAKER_01]: health and the healthcare delivery organizations can share information to

[00:22:48] [SPEAKER_01]: be more predictive and anticipatory.

[00:22:50] [SPEAKER_01]: But I guess in that case, since they are all in the same business

[00:22:53] [SPEAKER_01]: of people, the business agreements probably would be sorted, but the

[00:22:58] [SPEAKER_01]: personal healthcare record category is attempting to pull down the

[00:23:03] [SPEAKER_01]: electronic health record information and allow you to connect your

[00:23:08] [SPEAKER_01]: watches and your weight measure devices and your blood ox and also

[00:23:14] [SPEAKER_01]: put in your own personal information.

[00:23:16] [SPEAKER_01]: And a lot of times those are coming from these third parties.

[00:23:20] [SPEAKER_01]: So does that inhibit the development of that model?

[00:23:23] [SPEAKER_00]: Well, it certainly creates a context in which the risks for those

[00:23:28] [SPEAKER_00]: third parties can become profound and maybe prohibited.

[00:23:32] [SPEAKER_00]: Remember you can share whatever you want to share if you have a

[00:23:36] [SPEAKER_00]: business associate agreement in place.

[00:23:39] [SPEAKER_01]: Yeah, but it's never going to happen with an Apple watch and a, you

[00:23:42] [SPEAKER_01]: know, your Quiro Q A R D I O blood pressure coughs and weight.

[00:23:47] [SPEAKER_01]: You know, they use that for high blood pressure and different things

[00:23:50] [SPEAKER_01]: like that today for some of the preventative systems that they're using.

[00:23:54] [SPEAKER_00]: Yeah.

[00:23:54] [SPEAKER_00]: And so in those contexts, it may be possible to get legal

[00:23:59] [SPEAKER_00]: consent from every end user.

[00:24:02] [SPEAKER_00]: That specific healthcare information can be shared for this specific

[00:24:06] [SPEAKER_00]: context.

[00:24:07] [SPEAKER_00]: And then if you can ensure that that specific healthcare information

[00:24:10] [SPEAKER_00]: isn't then shared again to a third party entity, to which consent

[00:24:15] [SPEAKER_00]: wasn't granted, that that information isn't ever aggregated and provided

[00:24:19] [SPEAKER_00]: to someone else for advertising purposes or marketing targeting or some

[00:24:25] [SPEAKER_00]: other form of analytics, then you could be all right.

[00:24:28] [SPEAKER_01]: So, I mean, the whole point of all these programs is we're increasing

[00:24:31] [SPEAKER_01]: our revenue and reducing our costs.

[00:24:35] [SPEAKER_01]: So you had said that by increasing our costs to get this capability,

[00:24:41] [SPEAKER_01]: that you're actually having more productivity on the close rate or the

[00:24:46] [SPEAKER_01]: lead generation hit rate is a double digit difference.

[00:24:50] [SPEAKER_01]: What do you say?

[00:24:51] [SPEAKER_00]: Yeah, it's double digit difference.

[00:24:53] [SPEAKER_00]: And the difference is we were chatting a little bit earlier about how easy

[00:24:57] [SPEAKER_00]: has been to log into a third party platform and define an audience for

[00:25:03] [SPEAKER_00]: targeting purposes that ease, I think, masked the lack of efficiency

[00:25:08] [SPEAKER_00]: in that targeting.

[00:25:10] [SPEAKER_00]: All of those platforms want it to feel very easy for you to tightly

[00:25:14] [SPEAKER_00]: define the audience that want to target.

[00:25:16] [SPEAKER_00]: And then the results are the results.

[00:25:18] [SPEAKER_00]: And because the targeting is in the context of that third party

[00:25:21] [SPEAKER_00]: platform and the performance is reported in the context of that

[00:25:24] [SPEAKER_00]: third party platform, your ability to then reconcile the apparent

[00:25:30] [SPEAKER_00]: performance in the platform versus real world business performance was

[00:25:34] [SPEAKER_00]: somewhat hamstrung.

[00:25:35] [SPEAKER_00]: And I think there was a disincentive to put in the extra effort to do

[00:25:39] [SPEAKER_00]: that, to export the data or create a data warehouse context where you

[00:25:44] [SPEAKER_00]: could in fact reconcile third party data with your own business results.

[00:25:48] [SPEAKER_00]: A shift to focusing on first party data by definition means that the

[00:25:53] [SPEAKER_00]: signals that we're using for targeting and the signals that we're using

[00:25:56] [SPEAKER_00]: to determine campaigner efficacy are truly the business result that

[00:26:01] [SPEAKER_00]: we want to achieve.

[00:26:03] [SPEAKER_00]: And so we're much closer to business value and we're optimizing

[00:26:06] [SPEAKER_00]: for true business value in our own data and we're targeting based

[00:26:10] [SPEAKER_00]: on our own data.

[00:26:11] [SPEAKER_00]: So the accuracy of the targeting is better and fidelity of the

[00:26:15] [SPEAKER_00]: business result that we're measuring is better as well.

[00:26:18] [SPEAKER_00]: And so we absolutely have seen well into double digit performance

[00:26:21] [SPEAKER_00]: gains and efficiency improvements as we've shifted the first party data.

[00:26:26] [SPEAKER_01]: So just maybe to make it really simple for the audience that if you

[00:26:30] [SPEAKER_01]: used to be in the old days with direct mail, you put out a hundred

[00:26:33] [SPEAKER_01]: pieces of mail and you were lucky to get 1%.

[00:26:37] [SPEAKER_01]: And you spent some money on that and you acquired the list, but

[00:26:41] [SPEAKER_01]: if you put out a hundred and you know somebody, you open it up,

[00:26:44] [SPEAKER_01]: and now that rate is 10%, what you're saying is that difference

[00:26:47] [SPEAKER_01]: could more than justify creating some internal capability to get those

[00:26:52] [SPEAKER_01]: numbers up to be highly accurate by having your own first party.

[00:26:56] [SPEAKER_00]: Absolutely.

[00:26:57] [SPEAKER_00]: The other thing that is implication here is that first party data has

[00:27:02] [SPEAKER_00]: become an asset for large companies and first party data has become

[00:27:07] [SPEAKER_00]: available as a targeting method for advertisers.

[00:27:12] [SPEAKER_00]: So I'm a healthcare system, I'm my own first party data.

[00:27:15] [SPEAKER_00]: Well, so too does a grocery store, a cable network, all sorts of

[00:27:21] [SPEAKER_00]: businesses that you might not otherwise consider to have first party data.

[00:27:25] [SPEAKER_00]: Certainly a retailer like Walmart and they all have very clear understanding

[00:27:30] [SPEAKER_00]: of their first party data and they have begun to are in the midst of

[00:27:34] [SPEAKER_00]: and may have mature models where they have monetized their first party

[00:27:39] [SPEAKER_00]: data in tandem with media networks so that you can using connected

[00:27:45] [SPEAKER_00]: television, for example, target Kroger shoppers with a specific

[00:27:50] [SPEAKER_00]: demographic profile or a specific purchase pattern or a specific

[00:27:56] [SPEAKER_00]: geography, you don't get access to the data.

[00:27:58] [SPEAKER_00]: So they maintain the privacy of the folks in their first party data

[00:28:03] [SPEAKER_00]: warehouse, but you get to target an audience in their first party data.

[00:28:08] [SPEAKER_00]: So it's your own first party data targeting and it's first party data

[00:28:11] [SPEAKER_00]: available to you through other networks, other business relationships

[00:28:16] [SPEAKER_00]: that have sprung up largely as a result of these increased privacy regulations.

[00:28:21] [SPEAKER_01]: Interesting.

[00:28:21] [SPEAKER_01]: So where could people go to get educated on this?

[00:28:24] [SPEAKER_01]: Have you written your book yet?

[00:28:25] [SPEAKER_01]: I haven't written my book yet.

[00:28:26] [SPEAKER_00]: We published quite a lot on it though.

[00:28:28] [SPEAKER_00]: So they can certainly visit our blog and read and also see lots of

[00:28:33] [SPEAKER_00]: video that we published on this topic.

[00:28:34] [SPEAKER_00]: If they have questions, they can certainly reach out to me.

[00:28:37] [SPEAKER_00]: I'm Aaron at wheelhouseemg.com and our website is wheelhouseemg.com as well.

[00:28:43] [SPEAKER_00]: Very good.

[00:28:44] [SPEAKER_00]: I will put that in the show notes.

[00:28:46] [SPEAKER_01]: Anything else you'd like to share with the audience?

[00:28:48] [SPEAKER_01]: No, I really appreciate the conversation.

[00:28:50] [SPEAKER_01]: It was great.

[00:28:50] [SPEAKER_01]: Well, in anticipation of the response, we talked about love to have

[00:28:55] [SPEAKER_01]: you back to talk about SEO because that's another changing world for

[00:28:58] [SPEAKER_01]: people and it's an important topic.

[00:29:01] [SPEAKER_01]: Yeah.

[00:29:01] [SPEAKER_01]: That's an exciting world right now.

[00:29:03] [SPEAKER_01]: Very good.

[00:29:03] [SPEAKER_01]: Well, thank you very much.

[00:29:04] [SPEAKER_01]: Thank you.

[00:29:06] [SPEAKER_01]: Thanks for tuning into the Chalk Talk Gym podcast for resources, show

[00:29:12] [SPEAKER_01]: notes and ways to get in touch.

[00:29:14] [SPEAKER_01]: Visit us at chalktalkgym.com