Consumer and HCP Identity Graphs: Where They Connect and Where They Must Not
How consumer and HCP identity graphs differ, where linking them helps, where it creates privacy risk, and the controls to require.
The short answer
Consumer identity graphs link people and households; HCP identity graphs link healthcare professionals, usually by NPI, to their professional and sometimes personal digital identifiers. Connecting them lets brands reach HCPs on personal devices and CTV, and suppress HCPs from consumer campaigns. The risks are mixing professional and consumer data in ways HCPs did not expect and carrying health or prescribing data into consumer contexts, so strict separation rules and privacy review are essential.
HCPs are also consumers. They watch CTV at home, browse on personal phones, and see DTC ads. Identity graphs can connect an NPI to those personal identifiers. That creates useful options and real risks.
Two kinds of graphs
| Consumer graph | HCP graph | |
|---|---|---|
| Key entity | Person or household | HCP, keyed on NPI |
| Main identifiers | Address, email, devices, CTV | NPI, professional email, work and personal devices |
| Typical use | DTC, consumer campaigns | HCP targeting, measurement |
| Sensitive data risk | Consumer health inferences | Prescribing behavior, professional data |
Useful connections
- Reaching HCPs off-duty. HCP campaigns on personal devices or household CTV. See CTV for HCPs.
- Suppression. Excluding HCPs from consumer campaigns where appropriate, or excluding household members from HCP campaigns.
- Frequency control across professional and personal contexts.
Where connections must not go
- Prescribing data into consumer targeting. An HCP's prescribing volume should not shape consumer ads to their household.
- Consumer health inferences onto HCPs. Do not attach a household's consumer health segments to an HCP profile.
- Patient data in any form. Neither graph should carry patient health information into media.
Controls to require
- Purpose limits written into contracts: which uses are allowed.
- Data separation between consumer and HCP segments, with documented exceptions.
- Sourcing transparency: how personal identifiers were linked to NPIs and under what notice.
- Opt-out handling across both graphs.
- Audit rights for the brand.
Household spillover
When an HCP campaign runs on household CTV, other members of the household see it. HCP-directed promotional content shown to consumers may raise review questions. Some brands use HCP CTV only with content suitable for a general audience, or limit it to professional placements.
Evaluating HCP identity providers
| Criterion | Question |
|---|---|
| NPI coverage | What share of my list do you link to digital identifiers? |
| Link types | How much is deterministic? |
| Verification | How do you confirm the person is the HCP? |
| Personal device linking | How was it built, and with what notice? |
| Separation | How do you keep HCP and consumer data apart? |
| Measurement | Can I use my own measurement partner? |
See comparing HCP targeting data providers.
Common mistakes
- Assuming HCP personal-device targeting is automatically fine.
- Using one combined graph without separation controls.
- Running HCP-only creative on household screens.
Practical takeaway
Ask your HCP identity provider for a written description of how personal identifiers are linked to NPIs and how HCP data is kept separate from consumer segments. Have your privacy team review it before scaling personal-device or CTV HCP campaigns.
Frequently asked questions
Can HCPs be targeted on personal devices?
Many HCP identity providers link NPIs to personal devices and household CTV, which allows HCP campaigns to reach them outside work. Privacy terms and company policy should allow it.
Should HCP and consumer campaigns share identity data?
Only for limited, reviewed purposes such as suppression. Mixing professional prescribing data into consumer targeting creates privacy and compliance risk.
How do I compare HCP identity graph providers?
Compare NPI coverage, link types, verification, refresh, data sourcing, and whether you can use your own measurement partner.
Sources
- NIST Privacy Framework
- Network Advertising Initiative
- FTC, Health Breach Notification Rule: The Basics for Business
External guidance and platform documentation change. Links were current at publication; check them again before relying on them for a decision.
Editorial note. Analysis and frameworks are the author's own and do not represent Acxiom or any current or former employer, client, or named platform. Examples labeled hypothetical or illustrative are not results from real campaigns. Nothing here is legal, regulatory, or medical advice.
New pharma programmatic breakdowns, occasionally
One email when I publish something worth reading. Benchmarks, measurement teardowns, and case studies with the caveats attached. No cadence promises, no reselling your address.
Unsubscribe any time. See the privacy policy.
Working through this decision on a real plan?
I work on health and pharma data, identity, and activation, after five years running HCP and DTC programmatic agency-side. Happy to talk through how this applies to your situation.