Programmatic Advertising for Hospitals and Health Systems

Hospital marketers came to programmatic later than pharma, and the work looks different. There is no NPI target list, no OPDP, and usually no prescription data. There is a defined service area, a set of service lines with very different margins and capacity, and a legal status (HIPAA covered entity) that makes a lot of standard digital tactics risky. The guide to programmatic advertising in healthcare compares the health system playbook with pharma, devices, and payers.

Service-line marketing is the unit of planning

Health systems rarely run one campaign. They run a set of service-line campaigns, each with its own audience, geography, and economics. A useful planning view:

Service lines with capacity limits matter. Advertising a surgery program that already has a three-month wait wastes budget and frustrates patients. Get capacity data from operations before setting weights.

Geography and targeting for health systems

Geography does most of the targeting work. Primary and secondary service areas, defined by ZIP code from patient origin data, are the standard frame. Inside that frame, the common layers are:

• Contextual segments around the service line, which avoid most data questions. See how to build contextual segments; the method transfers directly to hospitals.
• Demographic layers such as age band, used carefully and without implying health status.
• Location targeting near facilities or competitor facilities, which needs a privacy review of the location data source, especially in states with consumer health data laws.
• Payer mix considerations, applied through geography rather than individual data.

The comparison of all options is in the healthcare programmatic targeting options article. For health systems, the high-risk rows (first-party patient data, retargeting, lookalikes seeded with patient lists) are the ones that need legal sign-off before anyone builds them.

HIPAA and the HHS tracking technology guidance

This is the part most health system media plans get stuck on, and it changed several times between 2022 and 2024. A conservative summary, not legal advice:

• In December 2022, the HHS Office for Civil Rights issued a bulletin on the use of online tracking technologies by HIPAA covered entities and business associates. It said that tracking pixels, cookies, and similar tools on hospital websites and apps can disclose protected health information (PHI) to third parties, and that this generally requires a business associate agreement or patient authorization.
• In March 2024, HHS updated the bulletin, adding detail on when information collected on unauthenticated public pages counts as PHI.
• In June 2024, a federal district court in Texas, in a case brought by the American Hospital Association and others, vacated the part of the guidance that treated the combination of an IP address and a visit to an unauthenticated page about specific health conditions as PHI.

What did not change: HIPAA itself still applies, the guidance for authenticated pages such as patient portals still stands, and state laws (Washington's My Health My Data Act among them) and FTC enforcement still apply to health data. Check the current state of the guidance and any appeals before you plan. Many health systems responded by removing third-party pixels from sensitive pages, moving to server-side tagging with strict controls, or using vendors that will sign business associate agreements. The governance side is covered in tracking pixel governance on health websites, and the broader HIPAA question in HIPAA and pharma advertising.

Measuring appointments, not clicks

The outcome a health system cares about is a booked appointment, a completed visit, or service-line volume. A workable measurement stack:

1. Define the conversion: appointment request form submissions, call tracking numbers, online scheduling completions, or class registrations, captured in a way your privacy team has approved.
2. Use geography as the comparison. Pick matched ZIP codes or markets to hold out, or run flights on and off by market.
3. Pull volume from your own systems, aggregated by ZIP and week, so no patient-level data goes to media vendors.
4. Compare lift, not totals. A hypothetical example: targeted ZIPs go from 400 to 480 orthopedic consult requests over a quarter (up 20 percent) while matched holdout ZIPs go from 300 to 330 (up 10 percent). The estimate of media-driven lift is the difference, about 10 percentage points, or roughly 40 consults above what the holdout trend predicts.
5. Report cost per incremental appointment by service line, so budget can move toward the lines that respond.

What usually goes wrong

Three patterns come up repeatedly. Plans spread budget evenly across service lines instead of weighting by margin, capacity, and growth goals. Teams report site visits and clicks because those are easy to get, and the board deck ends up claiming credit for appointments that would have happened anyway. And conversion tracking gets rebuilt in a hurry after a privacy review, breaking year-over-year comparisons. Fixing the third one early prevents the second.

Practical takeaway

Pick one service line with spare capacity and clear economics, define its conversion with your privacy team, and run a 10 to 12 week geo holdout test with matched ZIP codes. Use the result to set the cost per incremental appointment you will hold other service lines to.

Editorial note. Analysis and frameworks are the author's own and do not represent Acxiom or any current or former employer, client, or named platform. Examples labeled hypothetical or illustrative are not results from real campaigns. Nothing here is legal, regulatory, or medical advice.