Web Series | Privacy, Data and Measurement in Healthcare Part 3: Closing the Gap Between Privacy Law and Healthcare Ad Tech

The latest episode of our web series with PurpleLab tackles a question regulators haven’t fully answered: what counts as health inference risk?

HIPAA’s expert determination standard assesses reidentification risk against a specific dataset, recipient, and use case. State privacy laws take a different path — built on personal data consent, opt-outs, and sensitive data labeling — without consistent technical standards of their own. The two frameworks don’t map onto each other, leaving a gap that companies have to navigate without a single clear rulebook. NAI’s five-factor analysis was built to help close it.

That gap shows up sharply in healthcare ad tech. As PurpleLab‘s General Counsel Andrew Lucking explains, the legal framework for using data shifts depending on the use case — so data that’s valuable for research (understanding drug response, identifying care gaps) has to be deliberately walled off from advertising applications. Ad tech wasn’t built with regulated healthcare data in mind, and getting that separation right is central to PurpleLab’s mission.