How Nebraska Medicine Runs HIPAA-Compliant Digital Marketing

The Challenge

Digital marketing and HIPAA compliance create a structural tension that every health system must actively manage. HIPAA is about limiting data to what’s needed, but ad platforms like Google and Meta collect as much data as possible. Combine that data with user identifiers, and you have a potential violation. For health systems, that means regulatory penalties and reputational damage. That compliance reality puts pressure on the entire organization, especially when the most straightforward risk-reduction path is:

“Just remove the web trackers”.

But removing web trackers means losing the ability to measure and optimize digital campaign performance. Nebraska Medicine’s marketing team knew that cost per lead (CPL) would skyrocket because it would be impossible to know which campaigns drove booked appointments.

The Solution

Penrod stepped in with Destinations.

Destinations ensures that Nebraska Medicine’s digital campaigns on Google Ads, Meta, Bing, The Trade Desk, and Pinterest are HIPAA compliant.

The core is a secure platform that sits between all of Nebraska Medicine's digital properties – the website and mobile app – and their ad and analytics platforms. Every piece of data passes through this layer before it reaches any third party.

For analytics platforms like GA4, health information is completely removed. For ad platforms like Google Ads and Meta, digital identifiers are removed. The destination sees just enough data to do its job. Nothing more.

But Destinations isn’t just about compliance. It’s compliance with benefits that helps Nebraska Medicine market more and risk less.

The data from Destinations will help Nebraska Medicine attribute appointments and revenue to specific campaigns, service lines, and patient segments. That means accurate targeting, better spend allocation, and improved ROI tracking that can greatly reduce CPL.

The Results

Nebraska Medicine now confidently runs compliant digital marketing campaigns. PHI, like IP addresses, stay inside a compliant perimeter, conversions track, and campaigns run.

Alison Freemyer, Nebraska Medicine's manager of marketing operations, put it simply:

Patient privacy has always driven how we build our digital infrastructure. Destinations lets our measurement capabilities reflect that. We know which campaigns drive engagement, what they cost, and where to put our budget next.

Alison Freemyer

Manager of Marketing Operations

CPLs drop. Confidence goes up.

HIPAA-Compliant Digital Marketing
Nebraska Medicine can now use Google Ads, Meta, and other ad platforms to acquire new patients and cross-sell services, all while keeping PHI secure and avoiding regulatory risks.

Improved Attribution & ROI Measurement
Marketing teams now have full visibility of the patient journey, enabling accurate measurement of campaign impact, patient engagement, and return on ad spend.

Faster, More Targeted Campaigns
With unified data in hand, Nebraska Medicine launches, adjusts, and optimizes campaigns based on accurate conversion data.

Effective marketing and patient privacy aren’t in conflict. With Destinations, Nebraska Medicine accomplishes both without compromise. If your health system is sitting on the sidelines because of compliance concerns, you don't have to be. Penrod has done this before, and we're ready to do it for you.