Privacy-First Marketing for Healthcare Organizations

Intro 0:01

Welcome to the She Said Privacy/He Said Security podcast. Like any good marriage, we will debate, evaluate, and sometimes quarrel about how privacy and security impact business in the 21st century. Hi,

Jodi Daniels 0:21

Jodi Daniels here. I’m the founder and CEO of Red Clover Advisors, a certified women’s privacy consultancy. I’m a privacy consultant and certified informational privacy professional, providing practical privacy advice to overwhelmed companies.

Justin Daniels 0:37

Hi, I am Justin Daniels. I am a shareholder and corporate M and A and tech transaction lawyer at the law firm Baker Donelson, advising companies in the deployment and scaling of technology. Since data is critical to every transaction, I help clients make informed business decisions while managing data privacy and cybersecurity risk. And when needed, I lead the legal cyber data breach response brigade.

Jodi Daniels 0:58

And this episode is brought to you by Justin. This is where you go. Ding, ding, ding,

Justin Daniels 1:04

ding.

Jodi Daniels 1:06

Red Clover Advisors. We help companies to comply with data privacy laws and establish customer trust so that they can grow and nurture integrity. We work with companies in a variety of fields, including technology, e-commerce, professional services, and digital media. In short, we use data privacy to transform the way companies do business. Together, we’re creating a future where there’s greater trust between companies and consumers. To learn more and to check out our best-selling book, Data Reimagined: Building Trust One Byte at a Time, visit Redcloveradvisors.com So today is kind of an interesting situation because in all the years we have recorded a podcast, Justin and I are always sitting next to each other, except for today. So when there’s weird blank pauses, no, we are not going to edit those out. Or when I’m looking at Justin because he’s supposed to do my intro with his little weird pat me on the head that no one can hear. We’re just going to have some some fun here. So, Justin, that’s where you don’t just smile. No one can hear you, and you say something.

Justin Daniels 2:12

What would? Why don’t you talk about what happened over the weekend to you?

Jodi Daniels 2:15

No, we’re not going to talk about that. We’re just going to say we we did have a little bit of a small break because life was very very busy for us this fall. We had some really exciting personal life events and a significant amount of travel, and we’re kind of getting back on the podcast recording bandwagon.

Justin Daniels 2:37

You’re not going to tell everybody what was this week that you had. We’re not. We’re not. We’re

Jodi Daniels 2:41

moving on. And would like to know about this cryptic nature. They can read newsletter number 41, and at the very bottom, I give a slight hint. So that’s that’s what we’re going to do here.

Adam Putterman 2:55

Like it. I like it.

Justin Daniels 2:56

Adam, call her out, man.

Jodi Daniels 2:58

No,

Adam Putterman 3:00

I didn’t realize this was going to be a marriage counseling session. All right, so let’s

Jodi Daniels 3:04

get into it. Today we have Adam Putterman, who is the co-founder of Ours Privacy, a HIPAA-compliant CDP and privacy platform used by many of the largest health systems and medical brands across the country. Previously, the CMO of a nationwide therapy platform, he is also a published author in university guest lecture on privacy first growth, HIPAA-compliant marketing and analytics. Adam holds an MBA and an MS in design innovation from Northwestern University’s Kellogg School of Management. Adam, welcome to the fun. You didn’t realize your therapy background was going to be a part of the

Adam Putterman 3:41

show. Very much not a therapist, so I feel like I have nothing but bad advice. But yeah, thank you for having me, Jodi. As I think you know, I’m a I’m a big fan, not just of the podcast, but your newsletter, basically everything you write. You know, we’re constantly sending it to clients, colleagues, our team, etc. So I I’m honored to be here. Thanks for thank

Jodi Daniels 4:00

you. See, then all of them can read the bottom of issue number 41 to get to what Justin is hinting at. All right, Justin, back to you. I feel like a news reporter over here. Back to you.

Justin Daniels 4:13

But they don’t know that you really wanted to be the weather girl.

Jodi Daniels 4:16

I didn’t want to be the weather girl. I wanted to be the news reporter. All right. Aaron.

Adam Putterman 4:21

Okay. So, why don’t you tell us a little bit about your background and what led you to start your current venture? Yeah. Before Ars Privacy, we were running a company called Ars Therapy. This was a couples therapy, marriage counseling, national telehealth company, which is why it’s funny to loop back to that a little bit, but as part of that, we were dealing with extremely sensitive data, and at the same time, we were a fairly sophisticated performance marketing group. So we were running lots of ads, doing lots of analytics, tracking, etc. As we transitioned from being a wellness platform to a covered entity, starting to take. Insurance starting to be regulated by HIPAA. A lot of this was pre most of the state privacy laws that exist today. We took a extremely conservative approach to tracking analytics, data privacy, including things like removing third party fonts from the site. Certainly, you know, removing all pixels, et cetera, et cetera. This had an extremely negative effect on our marketing, and we built a tool internally that helped balance those two things, giving people the privacy they need, giving companies the ability to comply with regulations, while still enabling marketing. That led to our privacy, the CDP and privacy platform that Jodi mentioned at the beginning, and that’s where we are today.

Jodi Daniels 5:40

Adam, talk to us a little bit about as you work with so many different healthcare companies. What are some of the privacy challenges that they’re facing, especially as they’re using advertising and different marketing technologies?

Adam Putterman 5:54

I think there’s a bunch there. The the first one is just understanding the landscape, and I think that’s why I’m such a big fan of the work you do, Jodi. Is that you can’t understand what you can do or can’t do, or what you should do or shouldn’t do, or even what is on like what the pieces on the playing field are, unless you know where to look and understand sort of the interplay and lack of interplay, like where things are are layering on top of each other, and where things are separate between various state privacy laws, the FTC, the HHS, OCR, all of those things. So, I think first and foremost is we’re back to almost like a late 2022 time period where people just often don’t even know what they should do, and there’s a lot of stress and sort of consternation around that, and then I think relatedly, the tech landscape has become so fractured and the tools have become so fractured that a lot of people just don’t understand even what they are doing. Right, like they bring on a marketing agency that installs a tool that happens to have a sub processor that they’re not aware of, things like that. So I think those are the two biggest things we’re seeing right now: lack of or sort of like confusion, concern around the increasing complexity, and then a lack of visibility into even the baseline reality of what what they are doing as a company.

Jodi Daniels 7:18

I see this too, and to help make it super practical, do you have a suggestion on maybe one of those challenges for someone listening? What they might what they might do to be unconfused?

Adam Putterman 7:30

Yeah, yeah. I mean, the the first one I have is is somewhat self serving, but you can do it outside of us very easily. Which is just audit the site, right? There are a lot of great tools out there, Ours Privacy is one that will provide scans, observability, tooling, etc. It is no longer a a technical challenge to understand to to gather the information needed to understand what’s doing on the site. So the first thing I would say is if you haven’t gotten like a free audit or a scan from company like ours, or you know, there’s lots of people that do this part of the work. I would start there, understand what’s on the site, what data is being captured, where it’s being sent, how consent is being collected or not, and how it’s being enforced.

Jodi Daniels 8:16

I think that ties really well, Justin, into maybe what you can move us to.

Justin Daniels 8:23

We’re going to get into consent management platforms.

Jodi Daniels 8:26

That sounds like a fun idea. Sure, why not?

Justin Daniels 8:29

Oh, all right then. Many companies have implemented these consent management platforms and believe they are compliant. What are they potentially missing when it comes to how data is actually collected and shared?

Adam Putterman 8:42

Yeah, I think extremely nuanced question. So without answering it comprehensively, I think the number one thing that we see in the market, and I think the helpline case is is sort of the archetype here, is it how that consent is being enforced and translated downstream to the various platforms or data sharing activities that you’re doing. So the obvious example is: if someone opts out of tracking, do you still then fire all of your tracking cookies? Do you still then share all of that data down the line with third-party ad platforms or analytics platforms or things like that, so I think the number one thing is just just because there’s a cookie banner, just because consent is being collected, does not mean it’s being enforced, tracked, audited. Jodi, I’m sure you have something else there too that that you recommend that you often see.

Jodi Daniels 9:35

Well, there’s so many different parts. You kind of have to know what kind of pixels you have because might it be considered a sale and share of data? And if it’s just the tracking pixel, that’s one piece. But what if there’s more happening? What if you also have an email that’s getting collected and shared in a different way for targeted ads? Now you have to connect those two pieces. We find that’s a really challenging. Piece of compliance. Are you seeing similar things?

Adam Putterman 10:04

This this reminds me of something we talk about a lot internally, which is sort of the spectrum of maturity around consent management, which you know starts with I’m doing nothing, right? Like we’re just everything’s firing, everything’s happening. There’s no there’s no privacy policy even, right? Then like number number one on that, which is like a very small leap up, is we at least have disclosures. We have a privacy policy. We’re telling people what we’re doing. Then the step above that is we’ve incorporated a cookie banner that is giving people the the appearance or more prominent information of what’s being disclosed. Track. Then the step beyond that is consent management, which is the choices in that cookie manner are actually provably enforced downstream. To to your point of the the first part of what you discussed, right? Like if someone opts out, you then don’t track or don’t fire or whatever it is you said you were not tracking or not firing. But then the next step, which is I think what you were getting into, which we we see people being open to having this conversation more and more is unified preference management, right? Or like a preference center, which is a lot of people think just because you have the cookie banner, you’re done. But then when you start to think about email platforms, care platform communication, like an EHR sending an appointment reminder, as well as all of these sort of marketing opt-ins, or even a HIPAA authorization, if you go that far for for other other things, like all of those things, typically needed need to be gathered in a centralized, governed, and usable way, whether it be in a data warehouse or like a full stack preference management tool so that they can be updated once, and I think there’s a lot of increasing focus, particularly from the states, on the ability for you to do those things in a centralized, easy to access manner. You know, even like the all the things we’re seeing around text messages right now.

Jodi Daniels 12:00

Well, we have a lot of states with a lot of requirements. We also have federal in the healthcare space. Excuse me, with requirements, and then you have companies and organizations who actually still just want to market. And you had shared how you started and had to figure out a way to be able to balance effective marketing and also in a privacy-friendly way, what are you seeing for how companies can actually do that?

Adam Putterman 12:28

Yeah, I think there’s a sort of like a false dichotomy that a lot of companies come to, which is we either have to be we either have to be compliant or privacy-focused, or we have to market. And what we find is that general, or what we found is that generally, by taking a privacy first approach, particularly investing in a flexible first party, usable infrastructure upfront, the sort of agility and visibility that you get from a marketing perspective offsets any sort of marketing loss from not doing some of the sort of riskier things that you were maybe doing beforehand, but generally, I think the the biggest tactical thing we’ve seen people do in order to accomplish you know sort of both ends is just centralized tools, centralized platforms. I think a lot of the privacy challenges and the marketing challenges both arise from just having too many tools doing too many different things that overlap in too many different ways, and then cause sort of like paralysis analysis or whatever you would call it.

Jodi Daniels 13:35

You also have some thoughts on server side. Can you explain a little bit what server side is because I think there’s a lot of people listening who don’t understand, and then how that is privacy friendly.

Adam Putterman 13:47

Yeah, I think this is another. These are great questions because this is another sort of I think common misconception: server side versus client side. Like the metaphor I would use is just pipes or roads. It’s just a different way to get the data from A to Z, like a train versus an airplane versus a car. There’s nothing magical in itself, right? Like by doing by going server side. Server side is not like a pen of or like a an easy fix. To we went server side. Now we’re now we’re privacy friendly. It is a easier way to accomplish the privacy objectives that you likely need to accomplish because of the control it gives you in what data is collected, how it is modified or not, and where it goes. So, in the same way that, like, if you’re on a train, you you you can’t turn right. Like, you’re going from A to z1. you’ve given up a lot of choices for maybe speed and ease of use. Versus in a car, you have 15 different routes you could get. You could get there. Some are more dangerous, some are less dangerous, some are faster, some are slower. In this case, like client side would be the train, and server side would be the car. And this is the first time I’m using that metaphor, so I’m curious if it resonates or works. Works for you? I think it’s right. I’m sure, like at two a.m. tonight, I’ll be like, “Oh no, it doesn’t work, because you have to put gas in the car, and that doesn’t, or something like that. But I think it works. I think it works well.

Jodi Daniels 15:10

Excellent, thank you. I appreciate you sharing. I’m

Justin Daniels 15:14

curious. When does the conversation around the dark patterns enter this discussion, or is that something separate. Well,

Jodi Daniels 15:21

that is Justin’s favorite phrase ever that I say. As you know, Adam, I’m on a mission to reduce dark patterns. They show up everywhere. They show up in subscriptions. They show up in buying airline insurance. Everywhere it drives me. It drives me bonkers. All right, but Adam, in your universe, what are your thoughts on dark patterns?

Adam Putterman 15:42

I don’t think anything unique or different than what you’ve already mentioned. Maybe the thing that this makes me think of a lot is just I think one of the things that we’ve seen people talk about more or spend more time on since the FTC hymns. action was released, or whatever you would call it, is the importance of like essentially anti dark anti dark patterns and like explicit disclosure of what you’re doing, whether it be privacy forward or not, right? Like there’s sort of different layers of getting in trouble, right? There’s doing something wrong, then there’s doing something wrong and saying you’re doing something right, and the latter is always worse than the former, certainly. And so I think maybe just like a lack of my least favorite dark pattern would be a lack of explicitness in a in a policy, I guess, like a privacy policy, like a spot where you are supposed to be disclosing in plain language what is being done or not done.

Jodi Daniels 16:54

Justin, are you now all up to speed on all all things dark patterns?

Justin Daniels 17:00

I think so. I guess I was just thinking, healthcare is a bit of a different story when you’re making decisions that impact your health, and then what is considered health is pretty interesting, particularly when you talk about the privacy law in Washington. Yeah. So that’s what I was thinking. But anyway, with increasing regulatory scrutiny and litigation surrounding these website tracking technologies, what practical practical steps should privacy, security, and marketing teams take to reduce their risk? Especially now that we have AI stuff, because I got to tell you, when I delve into the AI world and we touch healthcare, my head is about to explode.

Adam Putterman 17:43

Yeah, I bet. Well, I think first and foremost, you gotta hire firms like Red Clover and Baker Donaldson to tell you what to do. I think we all agree that’s the number one thing you have to do to reduce your risk. No, I think the in all seriousness, it’s bring on outside counsel and expertise when you don’t have it, a first and foremost, b is what I said at the beginning. Understand what you’re doing. I think it’s amazing how many people jump to a solution before understanding what the problem is or even what reality is. And then, if we’re getting super super practical, go to your site, open the network tab, click refresh, and then just look at a few of the things that are firing and see if any of them are surprising. I think that be surprised how many organizations would benefit from from doing that.

Jodi Daniels 18:31

Adam, earlier you mentioned that companies should test; they should run a scan. How often do you recommend that for companies?

Adam Putterman 18:40

At a minimum, weekly, I think, especially for larger companies that work with lots of vendors or lots of people or employees that have access to deploying things to the site. Some companies I recommend daily, but I think weekly is is sort of a minimum, in my opinion, maybe a little conservative, aggressive, but yeah.

Jodi Daniels 19:04

What I would like to add for anyone listening is, we find, and I’m having a lot of conversations with companies who use an agency. The agency is the one who has access and places all the pixels, and the company doesn’t know anything about them. And the company is responsible. The company is responsible. You, the company, are responsible for the website and all the pixels on it. You might have hired an outside agency to help you, and that’s fine. The knowledge has got to be transferred, and how how to identify how and how often and the process and all of those fine details can be sorted out. I just see too often marketing teams that I don’t know. That’s what they do,

Adam Putterman 19:46

yeah, and

Jodi Daniels 19:46

that is not an okay answer.

Adam Putterman 19:49

Yeah, and just to double click on that, I’ve also seen the opposite of that, which is an agency telling them, you know, or telling a client we can’t put a meta. Pixel on your site, and the client saying, “I don’t care. It’s my choice. Put it on. So it’s interesting that you you see it sort of both ways. Yeah.

Jodi Daniels 20:09

With everything you know, we always ask everyone what is the best personal privacy or security tip maybe you’d share with your friends and family when you’re out in a social gathering,

Adam Putterman 20:23

that’s a good question. I think my biggest one, which is maybe making me almost sound like a luddite of sorts, but I try to never ever click on a. I mean, this is like also sort of one on one, but just never click on a link in your email. Like always go direct, and then in general, I would say be wary of what’s it called? Like the for for for big company sort of like commodity tools, be wary of like the the first paid search result. There’s just another case recently of someone getting phished because they typed in you know United Airlines or something into Google. They clicked on the first result, which was an ad, which was not United Airlines. It was like a phishing attempt, and I think that stuff’s only going to increase. So in general, I think like URL hygiene and open things on your phone never click on it without double. That’s a

Jodi Daniels 21:19

really good one. We unfortunately know someone personally, and I won’t share too much details. But they went to a search. They needed. They were trying to find a particular website. They thought they found the appropriate one. It wasn. They gave all the personal information, and it ended up being quite a mess that they had to unwind, and they just didn’t know because they went to Google, and it looked legit. It looked like the right site.

Justin Daniels 21:48

Well, but Jodi, there’s a I think important point to add to what you said, and it’s the site that came up first wasn’t the correct site, but with the SEO, it came up first. You’re thinking, oh, the first one, it must be right when it was actually the second site that was right.

Adam Putterman 22:04

Yeah, yeah. I feel like we read a big one of those every two months, or a big case of those. So it’s it’s very common, and yeah, that’s a fun question.

Jodi Daniels 22:17

Yep. All right, Justin, you get to ask more fun questions.

Justin Daniels 22:21

Are you sure you still haven’t answered? It’s the end, and you still haven’t answered our fun question.

Jodi Daniels 22:27

I did go to newsletter 41.

Justin Daniels 22:30

You know what they call that? That’s a non denial denial.

Jodi Daniels 22:35

Whatever you want to call it.

Justin Daniels 22:37

I see. So when you’re not thinking about privacy, Adam and its implications, what do you like to do for fun besides my harassment of my wife?

Adam Putterman 22:49

We our our kids are getting into soccer now, so we do a lot of soccer backyard, which is fun, and I’m trying to get them into tennis. So just a lot of running around right now, which is great, and also why I’m standing is like my back’s lower all the time, you know. Yeah. What about you guys?

Jodi Daniels 23:08

Oh, Justin, what do you like to do for fun?

Justin Daniels 23:11

I have a terrible addiction to rocket sports since I play squash, I play pickleball, and I don’t have enough time to do my mountain body and all the other habits, then

Adam Putterman 23:23

that’s great. That’s great, fellow racket fan enthusiast. I can empathize,

Jodi Daniels 23:29

except not tennis. He’s an um a pickleball squash. Ready to try Padel probably sometime soon.

Adam Putterman 23:39

Everyone’s really into Padel right now. I feel like

Jodi Daniels 23:41

yeah, it’s like moving out. Bye bye pickleball.

Adam Putterman 23:44

Yeah, yeah, fun. What about you, Jodi?

Jodi Daniels 23:48

Well, Adam, we are so grateful that you came to join us this morning. If people would like to connect with you and learn more, where should they go?

Adam Putterman 23:57

I’m on LinkedIn. So Adam Puterman on LinkedIn, and then oursprivacy.com. Usually, you can get to me pretty easily there as well.

Jodi Daniels 24:08

Amazing! Thank you so much. We really appreciate it.

Adam Putterman 24:11

Awesome! Thank you.

Outro 24:16

Thanks for listening to the She Said Privacy/He, Said Security podcast. If you haven’t already, be sure to click subscribe to get future episodes and check us out on LinkedIn. See you next time.