Programmatic Advertising in Healthcare: Full Guide

Programmatic advertising in healthcare is the automated buying of display, video, connected TV, audio and digital out-of-home ads through software that bids on each impression. A hospital, clinic, pharma brand or device maker sets the audience, budget and rules in a demand-side platform (DSP), and the DSP buys matching ad space across thousands of sites and apps in real time. It is the main way health brands buy reach outside Google Search and social media.

Healthcare changes the rules more than any other category. HIPAA limits what a provider can share from its own website and apps. State laws like Washington’s My Health My Data Act restrict health data and ban geofences near clinics. Google and Meta limit health targeting on their own platforms. This guide explains how programmatic works, which rules apply, which platforms healthcare buyers use, and how to plan and measure a budget with real numbers.

How Programmatic Advertising Works

Every programmatic ad passes through a short chain of systems. It all happens in the fraction of a second while a web page or streaming app loads.

• The publisher’s supply-side platform (SSP) offers the ad slot for sale. It might be a banner on a health news site, a spot in a streaming show, or a screen in a pharmacy.
• An ad exchange runs the auction and passes details about the slot to buyers. These include the page topic, device, rough location and any audience IDs.
• The advertiser’s DSP decides in milliseconds whether that impression fits the campaign and how much to bid. The highest bid wins, and the ad loads.

The type of deal decides who can bid and at what price. Open auctions are cheapest and widest, but you have the least control over where ads appear. Private marketplaces (PMPs) invite selected buyers to bid on a publisher’s inventory, often at a floor price. Programmatic guaranteed works like a traditional media buy with a fixed price and volume, delivered through the DSP. Health advertisers lean on PMPs because they can choose trusted medical publishers and avoid unsafe content.

Deal Type	Who Can Bid	Pricing	Best Healthcare Use
Open auction	Any buyer	Real-time bidding, lowest floors	Broad awareness with strict contextual and brand safety filters
Private marketplace (PMP)	Invited buyers	Auction with a floor price	Health publishers, condition content, point-of-care screens
Preferred deal	One buyer gets first look	Fixed price, volume not guaranteed	Testing a premium site before committing
Programmatic guaranteed	One buyer	Fixed price and fixed volume	Large CTV or HCP sponsorships with set delivery

Contextual vs Audience Targeting in Healthcare

There are two broad ways to decide who sees a healthcare ad. Contextual targeting places ads based on the content being viewed, such as an article about knee arthritis. It needs no personal data about the reader, so it carries little privacy risk. Audience targeting places ads based on who the person is thought to be, using cookies, device IDs, or matched data.

For health topics, audience targeting is where the legal and policy risk lives. The NAI, the self-regulatory body for ad tech companies, issued best practices on November 8, 2023 that favor demographic data such as age and gender over sensitive health information. It notes that detailed behavioral data “may inadvertently reveal a consumer’s health status” and may then need to be treated as sensitive (Hunton Andrews Kurth). The NAI also suggested using de-identified, population-level insights, such as regional patterns from claims data, to choose markets rather than people.

In practice, most hospitals and clinics should build campaigns from three safe layers. Use geography at the zip code or service area level, broad demographics, and health content context. Save audience segments built on health conditions for cases where the data provider has documented opt-in consent and you have legal review.

HIPAA and State Health Privacy Laws for Programmatic Ads

HIPAA and Tracking Pixels

HIPAA applies to providers, health plans and their business associates. For programmatic, the risk usually starts on your own site. A DSP pixel or retargeting tag on a patient portal or booking page can send PHI to an ad vendor. HHS says tracking vendors that receive PHI are business associates and must sign a BAA (HHS OCR). Most ad platforms will not sign one, so PHI cannot flow to them without patient authorization.

A federal court vacated part of that guidance in June 2024. The vacated part covered linking an IP address to a visit on a public page about a condition or provider, and HHS notes the ruling on the guidance page itself (HHS OCR). Logged-in pages, apps and booking flows are still covered. The safe setup is to keep ad pixels off authenticated pages and scheduling steps, and to pass conversions through a server-side tool covered by a BAA that strips PHI first.

Washington My Health My Data Act

Washington’s law reaches far beyond HIPAA. It covers consumer health data held by any business, including health inferences drawn from non-health data. Consent must be a clear, affirmative and specific act, and closing or muting content does not count. The law makes it unlawful to use a geofence within 2,000 feet of an in-person health care site to identify or track people seeking care, collect their health data, or send them health ads. Violations are enforced under the Consumer Protection Act, which includes a private right of action (Washington State Bar News).

The geofencing ban took effect July 23, 2023, and most other duties applied from March 31, 2024. Selling consumer health data needs a separate, specific authorization from the consumer (Davis Wright Tremaine). For a DSP buyer, this rules out the classic “conquest” tactic of drawing a fence around a rival clinic and serving ads to phones seen there.

FTC Actions on Health and Location Data

Federal regulators have also acted on the data behind programmatic segments. In January 2024, the FTC barred data broker X-Mode Social and its successor Outlogic from selling sensitive location data. The FTC said the company had sold data that could track visits to places such as medical and reproductive health clinics. In one contract, it provided marketing data on people who visited certain medical facilities and then pharmacies or infusion centers in the Columbus, Ohio area (FTC). The FTC also fined GoodRx $1.5 million over sharing health information with advertisers (Hunton Andrews Kurth).

The lesson for buyers is to ask every data vendor where its health and location segments come from. Ask how consent was collected, and whether sensitive places are removed. If the answer is vague, do not use the segment.

Google and Meta Health Ad Policies That Affect Programmatic

Google Ads treats health as a sensitive interest category. This covers physical and mental health conditions, treatments for chronic conditions, invasive procedures including cosmetic surgery, and disabilities. Its examples include fertility treatment, CPAP machines for sleep apnea, and support for parents of autistic children. Ads in these areas cannot use customer match, your data segments, audience expansion or lookalike segments. They can use Google’s own in-market, affinity, demographic and life event audiences (Google Ads policy).

Meta tightened its rules in January 2025. It classed health and wellness brands as a sensitive category and stopped many of them from tracking key lower-funnel events through their pixels (Click Consult). For health brands, that makes contextual buying and consented data on the open web and CTV more important. For search and social cost benchmarks, see our healthcare PPC statistics.

Endemic vs Non-Endemic Inventory

Endemic inventory is ad space on health and medical properties. Examples include consumer health sites, clinical reference tools, medical journals, EHR systems and screens in clinic waiting rooms. Non-endemic inventory is everything else, such as news, sports, recipes and general streaming TV.

Endemic inventory gives you strong context, and for HCP campaigns it puts you where clinicians work. It is limited in supply and usually costs more. Non-endemic inventory gives scale, which matters once you need to reach people who are not reading about their condition right now. Doceree described this tradeoff in May 2026, noting that buyers use cheaper reach-extension buckets and discount inventory where publishers cannot verify their audiences (Doceree).

A sound plan uses both. Put the core budget into endemic PMPs for the target audience, then add non-endemic reach with strict context controls. Exclude content you would never want next to a health ad.

HCP Targeting With NPI Data for Pharma and Devices

Pharma, biotech and medical device brands often need to reach doctors, nurse practitioners and pharmacists rather than patients. The key is the National Provider Identifier. CMS defines it as “a unique 10-digit number used to identify health care providers,” and every provider that is a HIPAA covered entity must have one. Public NPPES files list providers by NPI (CMS).

HCP platforms match those NPIs to verified digital identities, often through logins on medical sites. A brand uploads a target list, such as rheumatologists who treat a certain condition. The platform then serves ads only to devices tied to those NPIs and reports exposure by NPI. Since the HCP is targeted in a professional role, this is a different privacy question from patient targeting. FDA promotional rules and fair balance still apply to the ad itself.

The main question when choosing a vendor is verification. Ask how each NPI is matched, how often the list is refreshed, and whether reports show reach by NPI or only in aggregate. If you sell equipment to clinics and hospitals, also see our guide to medical equipment company SEO. Programmatic and search work best together for long B2B buying cycles.

Healthcare DSPs and Programmatic Platforms Compared

The four platforms below show the main options, from a general DSP with health tools to HCP specialists. The details come from each company’s own published information, and the scale figures are self-reported.

The Trade Desk

The Trade Desk is a general DSP used across industries, and it has built healthcare tools on top. In September 2025 it launched an endemic HCP pharma ad marketplace (The Trade Desk). In September 2026 it announced in-platform optimization with Veeva Crossix and IQVIA Digital toward audience quality and cost per target reach. It also announced multi-provider HCP decisioning to extend NPI reach, with new-to-brand prescription measurement planned for Q4 (The Trade Desk). It suits large brands and agencies that want one DSP for all channels with healthcare data added in.

DeepIntent

DeepIntent is built only for healthcare. Its demand-side platform, DeepIntent Cortex, buys across CTV, display, audio, video and point of care. Its HCP Planner builds audiences by prescribing behavior and specialty, and its Outcomes product ties media to new patient starts, doctor visits and prescription refills. The company says it reaches “250M+ verified patients” and more than 3.5 million verified HCPs in the US (DeepIntent). It suits pharma brands that want patient and HCP campaigns in one place.

PulsePoint

PulsePoint, a division of Internet Brands, focuses on HCP targeting. In September 2026 it extended its Audience Manager to YouTube, so brands can target verified NPI-level HCP audiences there. It reported a 1.9x higher click-through rate than broad demographic targeting in early campaigns. The company says clients can coordinate HCP buys across YouTube, search, e-newsletters, social, EHR, display, CTV and audio (PulsePoint press release). It suits brands whose main audience is clinicians.

OptimizeRx

OptimizeRx started in point-of-care messaging inside EHRs and now runs programmatic HCP media. It says it targets HCPs “at the National Provider Identifier (NPI) level,” with access to more than 2 million US providers. Its Dynamic Audience Activation Platform refreshes NPI audiences monthly and aims to reach prescribers when they are likely seeing eligible patients. Channels include display, online video, audio, social and CTV (OptimizeRx). It suits brands that want EHR and programmatic HCP messages from one vendor.

Platform	Type	Audiences	Channels Named by the Vendor	Published Healthcare Features
The Trade Desk	General DSP with pharma tools	Consumers and HCPs	All major programmatic channels	HCP endemic marketplace (2025); Crossix and IQVIA Digital optimization (2026)
DeepIntent	Healthcare-only DSP	Patients and HCPs	CTV, display, audio, video, point of care, DOOH	HCP Planner, Outcomes measurement tied to patient starts and refills
PulsePoint	Healthcare-focused platform	Mainly HCPs	YouTube, search, e-newsletters, social, EHR, display, CTV, audio	NPI-level DirectMatch targeting; YouTube HCP targeting (2026)
OptimizeRx	Point-of-care and HCP media	HCPs	Display, online video, audio, social, CTV, EHR	Monthly NPI audience refresh through its DAAP platform

Many provider brands do not need a specialist HCP platform at all. A hospital or dental group usually buys through an agency’s general DSP seat with contextual and geographic targeting. Our directory of pharma and life sciences marketing agencies lists firms that run HCP media, and our medical device marketing agencies page covers device brands.

CTV, DOOH and Audio for Healthcare Brands

Connected TV is the biggest growth area because it brings TV-style video to programmatic buying. Ads run in streaming apps and can be bought by geography and household traits. It suits health systems promoting a new service line and pharma brands with video creative. PulsePoint’s 2026 release noted that limits on linear TV are pushing pharma brands toward addressable digital video (PulsePoint).

Digital out-of-home (DOOH) covers screens in transit, retail, gyms and medical offices. Programmatic DOOH lets you buy those screens by daypart and location through a DSP. Place Exchange data reported by MediaPost put the average programmatic OOH CPM at $7.62 in the second half of 2024, up from $7.16 in the first half. Point-of-care venues were among the categories with significant CPM increases (MediaPost).

Streaming audio and podcasts reach people during commutes and workouts. Audio works well for awareness of services like urgent care or physical therapy, where the call to action is simple. As with other channels, buy audio by context and geography rather than by health conditions.

How to Measure Programmatic Healthcare Campaigns

Clicks and view-through conversions make programmatic look better than it is. Many people who saw an ad would have booked anyway. The better question is how many extra patients the campaign created. That is incrementality.

The standard method is a holdout test. Before launch, the DSP or measurement partner splits the target audience at random. Most get ads, and a control group, such as the 10% in our example below, gets none. After the campaign, compare the booking or conversion rate of the two groups. The gap is the lift caused by the ads. Pharma brands use the same idea with prescription data through partners like Crossix and IQVIA, which The Trade Desk now connects to its bidding (The Trade Desk).

Foot traffic reports need extra care in healthcare. They rely on device location data, which is the same kind of data the FTC limited in the X-Mode order. Data near clinics is also restricted in Washington. Treat a “store visit” report for a hospital or clinic as a privacy question first. Ask whether the vendor’s data was collected with consent and whether it removes sensitive locations. Where you can, measure with first-party bookings from your scheduling system, matched in aggregate under a BAA.

Worked Example: Planning and Measuring a Healthcare Programmatic Budget

The example below uses a hypothetical regional health system that spends $40,000 in one month to promote a new orthopedic center. The budget split and booking counts are illustrations. The DOOH CPM is the Place Exchange average cited above. We ran the arithmetic in Python.

budget = 40000
split = {"CTV": 0.40, "Contextual display and PMPs": 0.25,
         "DOOH": 0.15, "Streaming audio": 0.10, "Test budget": 0.10}
for channel, share in split.items():
    print(channel, budget * share)
# CTV 16000, display/PMPs 10000, DOOH 6000, audio 4000, test 4000

# DOOH impressions at the Place Exchange H2 2024 average CPM
print(round(6000 / 7.62 * 1000))          # 787402 impressions

# Highest CTV CPM that still reaches 60,000 households 4 times
impressions = 60000 * 4                    # 240000
print(round(16000 / (impressions / 1000), 2))  # 66.67

# Holdout test: 200,000 exposed households, 20,000 in control
exposed_rate = 600 / 200000                # 0.30% booked
control_rate = 40 / 20000                  # 0.20% booked
incremental = (exposed_rate - control_rate) * 200000
print(incremental)                         # 200 extra bookings
print(round((exposed_rate - control_rate) / control_rate * 100))  # 50% lift
print(round(budget / 600, 2), round(budget / incremental, 2))     # 66.67 vs 200.0

Three lessons come out of these numbers. First, at the reported average CPM, $6,000 buys about 787,000 programmatic DOOH impressions. Second, you can turn a reach goal into a price ceiling. If the goal is 60,000 households four times each, any CTV CPM above $66.67 means the $16,000 will fall short.

Third, and most important, the dashboard would credit the campaign with 600 bookings at $66.67 each. The holdout shows only 200 of them were extra, so the true cost per incremental booking was $200. That is three times higher. Planning on the first number would lead to overspending on channels that only take credit for patients who were coming anyway.

Choosing an Agency or Running Programmatic In-House

Most practices and many health systems do not hold their own DSP seat. Running a DSP well takes a trained trader and constant policy checks. Agencies spread that cost across clients, and good ones bring PMP deals with health publishers. When you compare agencies, ask four questions. Which DSPs do they use? How do they keep PHI out of ad tags? Do they avoid health-condition segments and geofences near clinics? Will they run a holdout test?

Our healthcare PPC agencies list includes firms that run paid media beyond search. Our full-service healthcare marketing agencies handle CTV and display alongside creative. Hospitals can start with our hospital and health system marketing agencies. More bidding and reporting now runs on AI, so our guide to AI agents in healthcare marketing explains the review steps to keep. You can also get matched with a vetted healthcare agency based on budget and specialty.

Is Programmatic HIPAA Compliant? Geofencing and NPI Questions

What Is Programmatic Advertising in Healthcare?

It is the automated, auction-based buying of digital ads for health brands through a DSP. It covers display, video, CTV, audio and digital screens, with targeting limited by HIPAA, state laws and platform health policies.

Is Programmatic Advertising HIPAA Compliant?

It can be, if no PHI reaches ad vendors without a BAA or patient authorization. Keep ad pixels off logged-in and booking pages, target by context and geography, and use BAA-covered tools for conversion data.

Can Healthcare Brands Use Geofencing?

Not around health care sites in Washington, where geofences of 2,000 feet or less around in-person care locations are banned for tracking or health ads. Elsewhere, broad geographic targeting by zip code or radius around your own service area is the safer choice.

What Is NPI Targeting?

NPI targeting reaches specific healthcare professionals using their 10-digit National Provider Identifier. HCP platforms match each NPI to verified devices or logins and report exposure by NPI.

What Is the Difference Between Endemic and Non-Endemic Ads?

Endemic ads run on health and medical properties, such as health publishers, clinical tools and EHRs. Non-endemic ads run on general sites and apps, which offer more scale but less health context.

eMarketer Forecast, Privacy Law Briefs and Ad Platform Policies

• eMarketer: US Healthcare and Pharma Ad Spending 2025
• HHS OCR: Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates
• Washington State Bar News: The Washington My Health My Data Act
• Davis Wright Tremaine: Washington My Health My Data Act FAQ
• Hunton Andrews Kurth: NAI Issues Best Practices Guidance on Health-Related Digital Advertising
• FTC: Order Prohibits X-Mode Social and Outlogic From Selling Sensitive Location Data
• Google Ads: Health in Personalized Advertising
• Click Consult: Meta’s New Advertising Restrictions for Health and Wellness Brands
• Doceree: What Pharma Advertisers Pay Premium CPMs For
• CMS: NPIs
• The Trade Desk: Pharma Ad Marketplace for HCPs
• The Trade Desk: Healthcare Measurement and Optimization Integrations
• DeepIntent: Solutions
• PulsePoint Brings Verified NPI Targeting to YouTube
• OptimizeRx: Programmatic Display Messaging for HCPs
• MediaPost: CPMs, Spend Rising in Most Programmatic DOOH Categories