HIPAA Compliant Web Tracking with Snowflake

The Problem

Marketers use tracking scripts to run ad campaigns that send conversion data from their websites to platforms like Google Ads, Meta, and Facebook. Unfortunately, this conversion data contains a combination of user identifiers and PHI, constituting a HIPAA violation.

It's technically possible to remove the tracking script altogether. However, removal introduces more issues. Without access to the conversion data, marketers can't track the attribution metrics that help them measure ad performance, campaign effectiveness, patient acquisition cost, and other necessary metrics.

As a result, the problem is not just a technical one. Without a means to measure campaign performance, marketers can's prove the ROI of their hard-fought marketing budgets.

The Solution

To make web trackers HIPAA-compliant, healthcare companies need:

• A secure server to process conversion data in a compliant location
• A secure, auditable, compliant data platform to store conversion data, user identifiers, and PHI for campaign performance measurement
• A platform to redact PHI from the conversion data sent to non-compliant ad platforms

In this use case, Snowflake is the compliant data platform, or 'intermediary,' between regulated entities and non-compliant web trackers. Snowflake is a connected data platform that HIPAA-regulated entities like healthcare clinics, insurance companies, and their business associates use to compliantly store structured and unstructured data.

So, why does Snowflake work so well for the HIPAA-compliant web tracking use case?

• Because Snowflake can compliantly store the PHI and user identifiers generated during marketing campaign interactions, it's an ideal platform for retaining the conversion information that non-compliant web trackers can't store.
• Snowflake signs BAAs for its connected data platform. With the BAA agreement, Snowflake confirms that it it's committed to safeguarding PHI, protecting regulated entities from the liabilities associated with PHI disclosures.
• Snowflake's connectivity allows it to plug into the workflows that support multiple ad platforms, process campaign conversion data, store conversion data, and redact PHI from user identifiers.

As part of the compliant workflow, Snowflake ensures that conversion data is retained – and redaction ensures that no identifiable health information is shared with third-party services that won't sign BAAs. As a result, regulated entities can use popular ad platforms compliantly while effectively measuring campaign performance.

When paired with workflows built in Google Tag Manager to redact PHI, the overall solution looks something like this.