HIPAA Compliant Web Tracking

Solving the Use Case

Overview

Ongoing class action lawsuits have prompted healthcare marketers and compliance teams to scramble, aiming to mitigate risks as highlighted in the December bulletin from the HHS.

According to the bulletin, certain data, such as email and IP addresses, may now be categorized as PHI. It's important to note that sharing PHI with any entity could potentially violate the HIPAA rule.

Current Gaps

As technologies like Google Analytics generally do not enter into Business Associate Agreements (BAA), most users do not provide consent for disclosure. Moreover, Protected Health Information (PHI) is often insufficiently de-identified. Consequently, many providers currently utilizing this technology may be in violation of HIPAA regulations.

As a result of the ruling, several providers have been compelled to discontinue their use of Google Analytics. Unfortunately, this action eliminates a critical element in tracking success across their web properties.

Solution

To address web tracking compliance, a secure server-side container is crucial for reducing the need to retag a website. By implementing the Google server-side tag manager component, either through the Google Cloud platform or a local server, we can ensure enhanced data privacy and security.

The server-side component leverages an API call to Salesforce Data Cloud for de-identifying Personal Health Information (PHI), ensuring the highest level of confidentiality. Additionally, the server-side task manager incorporates an ingestion API connector to seamlessly ingest the de-identified data into Salesforce Data Cloud.

This empowers our customers with the ability to re-identify the encrypted data, while maintaining the utmost level of security and privacy. With this comprehensive solution, we are able to provide a robust and reliable framework for safeguarding sensitive data and complying with web tracking regulations.