Health Breach Notification Rule
Applies to many health apps and services not covered by HIPAA. The FTC treats unauthorized sharing of health data, including with ad platforms, as a breach that requires notice. Amended in 2024. [VERIFY]
Telehealth funnels ask health questions before checkout, often in a web app with its own tags. COMPLI3D reports each step that matters to your ad networks as a click ID and an opaque code, after the visitor opts in.
Single-page apps often push each answer to the data layer, where any tag can read and send it.
Plan and product names, such as a medication or a condition, become content parameters on purchase events.
Paths and query strings like ?condition=anxiety travel with every page view and sign-up.
Tags inside the patient app can send screen names and account IDs, often outside the marketing site's consent flow.
Each one keeps its full name in your dashboard and reaches the ad network as a code.
An account is created.
Sent to ad networks as c_8a5fThe questionnaire is complete. Nothing in it is sent.
Sent to ad networks as c_31e7A first appointment is scheduled.
Sent to ad networks as c_5b17A paid plan begins, with no plan name attached.
Sent to ad networks as c_7f3aApplies to many health apps and services not covered by HIPAA. The FTC treats unauthorized sharing of health data, including with ad platforms, as a breach that requires notice. Amended in 2024. [VERIFY]
Applies where your clinical entity is HIPAA-regulated. Revised in 2024 and partly vacated by a federal court. [VERIFY CURRENT STATUS]
Covers consumer health data held by companies HIPAA does not reach, requires consent before it is collected or shared, and allows private lawsuits. [VERIFY]
It depends on how your company and its medical groups are set up. Many telehealth companies have parts under each. Ask your counsel. [VERIFY]
It sees the steps you send to it, and reports each as a code with the click ID. Answers and screen names are never part of what is sent.
The ad itself is a policy question for each network. On your site, COMPLI3D keeps product and plan names out of what is sent back, so purchases reach the network as a code.
Yes. Consent Gateway is the banner and the control behind it. Nothing optional loads until the visitor chooses.
A report of every script that loads before consent and where it sends data.