Telehealth Marketing Without Pixels: The 2026 HIPAA-Compliant Playbook for DTC Health

When a patient books a virtual mental health consultation or searches for a dermatology appointment, every click from ad to confirmation page creates Protected Health Information. Traditional marketing pixels transmit this PHI directly to ad platforms—appointment URLs containing provider specialty, form fields capturing symptoms, behavioral signals revealing diagnosis intent. This exposure violates HIPAA and leaves telehealth marketers facing OCR penalties like those handed to GoodRx ($1.5M) and BetterHelp ($7.8M) for pixel-based PHI disclosure.

Key Takeaways

• GoodRx ($1.5M) and BetterHelp ($7.8M) faced OCR penalties for pixel-based PHI disclosure, establishing enforcement precedent.

• Telehealth market reached $65.35 billion with 70% provider adoption, but conversion tracking dropped 40%+ post-iOS 14.5.

• Mental health and prescription digital therapeutics have 21-60 day conversion windows with 40-60% match rates, vs. dermatology's 7-14 days.

• Client-side pixels violate HIPAA by transmitting Protected Health Information to ad platforms without Business Associate Agreements.

• Server-side APIs with first-party data capture enable HIPAA-compliant tracking for telehealth companies processing 100+ monthly conversions.

The 2026 telehealth market has reached $65.35 billion with over 70% provider adoption and 80%+ patient preference for hybrid care models. Yet browser restrictions (Safari ITP, Firefox blocking, Chrome Privacy Sandbox) and platform policies (Meta Special Ad Categories, Google healthcare remarketing limits) have made pixel-based tracking unreliable. Telehealth companies that built patient acquisition on Meta Pixel and Google Ads conversion tags now face measurement blackouts—conversion tracking dropped 40%+ post-iOS 14.5, match rates stay below 50%, and legal teams flag HIPAA concerns while engineering bottlenecks delay server-side implementations.

This guide provides the complete technical and strategic infrastructure for telehealth marketing without client-side pixels. You'll learn how to rebuild conversion tracking with server-side APIs, capture first-party patient journey data, maintain campaign optimization, and prove ROI while staying compliant with HIPAA and browser privacy rules—including differentiated strategies for mental health, dermatology, and primary care verticals.

Is This Guide for You?

This playbook is designed for performance marketing managers at telehealth companies who face one or more of these signals:

If you manage telehealth ad spend exceeding $15,000/month and process 100+ patient conversions monthly, you'll benefit from the full server-side infrastructure outlined here. Smaller providers may use the simplified decision criteria in the "When Server-Side Tracking Isn't Worth It" section.

How Tracking Requirements Differ by Telehealth Vertical

"Telehealth marketing" isn't monolithic—PHI sensitivity, patient journeys, and measurement windows vary dramatically by specialty. Understanding your vertical's unique tracking challenges is the first step in building compliant infrastructure.

Mental health and prescription digital therapeutics face the strictest compliance requirements—any tracking of therapy type, diagnosis intent, or medication requests constitutes PHI. Dermatology and primary care allow slightly more flexibility but still require careful sanitization of symptom-related behavioral signals. Use these benchmarks to set realistic expectations for match rates and conversion windows when building your measurement framework.

What Qualifies as PHI in Telehealth Marketing

Before implementing any tracking system, you must classify which conversion events contain Protected Health Information. HIPAA defines PHI as any individually identifiable health information—including behavioral data that reveals health status, treatment, or provider relationships.

The key principle: if an event or behavioral signal can be linked to an identifiable individual AND reveals health information, it's PHI. This includes not just explicit form submissions but also URL parameters, page sequences that imply diagnosis, and behavioral patterns that indicate treatment intent. When in doubt, classify as PHI and sanitize before transmission to third parties.

Why Client-Side Pixels Fail for Telehealth Marketing

Traditional marketing pixels fire in the user's browser and send conversion data directly to ad platforms. For telehealth companies, this architecture creates a fundamental HIPAA violation compounded by browser privacy restrictions and platform policy enforcement.

Browser-based pixels transmit Protected Health Information to third parties without Business Associate Agreements. When a patient books a dermatology consultation or fills out a mental health intake form, the pixel captures the URL (often containing provider specialty or appointment type), form fields (symptoms, diagnosis history), and behavioral signals (pages viewed, time spent on treatment information) that qualify as PHI under HIPAA. The October 2022 OCR guidance explicitly states that tracking technologies on patient-facing websites can create impermissible PHI disclosures when data flows to ad platforms without proper safeguards. GoodRx paid $1.5 million for pixel-based PHI sharing; BetterHelp settled for $7.8 million. These aren't edge cases—they're enforcement precedents establishing that client-side pixels on telehealth sites violate HIPAA when PHI reaches third parties.

Browser privacy restrictions compound the tracking problem. Safari's Intelligent Tracking Prevention limits cookie persistence to seven days; Firefox blocks third-party cookies by default; Chrome's Privacy Sandbox phases out cross-site tracking through 2025. These changes eliminate the persistent identifiers pixels need to track users across sessions. For telehealth, where conversion windows span 21–45 days for mental health and 14–30 days for primary care, short cookie lifespans break attribution even when pixels remain technically functional.

Ad platform policies layer additional restrictions on healthcare tracking. Meta prohibits Special Ad Categories (which include healthcare services) from using detailed targeting or retargeting based on health-related behavior. Google Ads limits remarketing list duration for healthcare advertisers and restricts prescription drug advertising. TikTok's Commerce Policy restricts pixel-based conversion tracking for Rx marketers. These policy constraints make pixel-based optimization impossible even when HIPAA and browser restrictions didn't exist.

Step 1: Build Server-Side Conversion Infrastructure

Server-side tracking moves conversion data collection from the user's browser to your controlled server environment. Instead of pixels firing client-side and sending PHI directly to ad platforms, your server captures conversion events, sanitizes Protected Health Information, and forwards compliant data through platform APIs.

When Server-Side Tracking Isn't Worth It

Before committing engineering resources to server-side infrastructure, evaluate whether simpler approaches meet your needs. Server-side tracking requires significant upfront investment—200 to 400 engineering hours at $150–$250/hour, plus ongoing maintenance (0.5–1.0 FTE) and platform fees ($2,000–$10,000/month for CDPs, $500–$3,000/month for data warehouse compute).

Consider simpler alternatives if you meet these criteria: monthly ad spend below $15,000, fewer than 100 conversions per month, no dedicated engineering resources, or single-channel campaigns (especially Google Ads with auto-tagging, which handles basic conversion tracking without custom APIs). Small telehealth practices in these situations may accept measurement gaps in exchange for compliance simplicity—using Google-only with basic conversion tracking, Meta with Customer Match lists only, or brand-focused campaigns with directional measurement.

For providers spending $15,000+/month with multi-channel campaigns and engineering support, server-side infrastructure is the only path to compliant, optimized patient acquisition. The measurement precision and HIPAA compliance gains outweigh implementation costs when patient lifetime values exceed $500 and acquisition volumes justify algorithmic optimization.

Design Telehealth-Specific Event Taxonomy

Generic conversion events like "Purchase" or "Lead" don't capture the nuanced patient journey stages that matter for telehealth optimization. Your server-side tracking must distinguish between inquiry, scheduling, and treatment commitment—with vertical-specific variations.

Build a conversion event hierarchy that aligns with patient acquisition economics:

• inquiry_submitted – Patient submitted contact form or symptom checker (no PHI transmitted). Low-value signal but indicates intent. Track for top-of-funnel volume.

• appointment_scheduled – Patient booked initial consultation. Medium-value signal. Sanitize provider specialty and appointment type before API transmission. This is your primary conversion event for most telehealth campaigns.

• appointment_completed – Patient attended virtual visit. High-value signal indicating treatment initiation. Use for optimization when you can pass revenue data without PHI exposure.

• treatment_plan_selected – Patient committed to ongoing care (therapy package, Rx fulfillment, chronic condition management). Highest-value conversion. Optimize toward this when volume supports it.

• prescription_fulfilled – For Rx telehealth, actual medication delivery. Ultimate outcome but often 30+ days post-attribution window.

For mental health telehealth, distinguish between initial consultations (often lower-value evaluation sessions) and committed therapy packages (10+ session bundles with higher LTV). For dermatology, separate visual consultations (quick assessments) from treatment plans requiring follow-up. For primary care, track chronic condition management enrollment separately from acute visit bookings. This granularity prevents algorithms from optimizing toward low-value volume at the expense of high-value patients.

Implement Conversion APIs for Major Platforms

Each major ad platform provides a server-side conversion API that accepts authenticated POST requests containing conversion event data. Rather than reproducing full API specifications available in Meta's CAPI documentation, Google Ads API guides, and TikTok Events API references, focus on telehealth-specific implementation challenges these platforms don't address:

Mapping patient identifiers across scheduling/EHR/CRM systems: Your conversion API payload requires hashed user identifiers (email, phone) to match conversions back to ad clicks. But telehealth patient data lives across fragmented systems—scheduling platforms (Acuity, SimplePractice, Healthie), electronic health records, and marketing CRMs. Build identity resolution logic that links a patient's booking email in your scheduling system to their CRM contact record to their EHR patient ID. Without unified identifiers, you'll hash different email addresses for the same patient (personal email vs. work email), tanking match rates.

Hashing patient emails vs. provider emails: Multi-provider telehealth networks create a specific failure mode—accidentally hashing provider email addresses instead of patient emails when booking confirmations come from provider-specific systems. Validate that your event pipeline extracts the patient identifier, not the provider who delivered care.

Handling multi-provider networks: When a single patient books with multiple clinicians (common in mental health for therapy + psychiatry, or primary care with multiple specialists), ensure your conversion events don't double-count. Use patient-level deduplication windows rather than session-level, and pass a consistent external_id tied to the patient record, not the individual appointment.

API authentication for healthcare IT security: Healthcare organizations enforce stricter API key management than typical e-commerce. Your conversion API credentials (Meta access tokens, Google Ads developer tokens, TikTok API keys) must be stored in HIPAA-compliant secrets management systems (AWS Secrets Manager, HashiCorp Vault), rotated quarterly, and logged for compliance audits. Build infrastructure that supports credential rotation without breaking live conversion tracking.

Design HIPAA-Compliant Event Pipeline

Your server-side tracking pipeline must sanitize PHI before forwarding conversion data to ad platforms.

Capture conversion events at the server level when users complete actions like appointment booking, form submission, or treatment plan selection. Store raw event data in your HIPAA-compliant data warehouse with proper access controls and audit logging.

Create a transformation layer that strips PHI from conversion events before API transmission. Remove treatment type details, symptom descriptions, prescription information, and diagnosis-related fields. Retain only the minimum data required for conversion counting: event timestamp, hashed user identifier (email or phone), conversion value, and generic conversion category.

Implement hashing for all user identifiers using SHA-256 before API transmission. Normalize email addresses (lowercase, trim whitespace) and phone numbers (remove formatting, use E.164 format) before hashing to improve match rates with ad platform user databases.

Build retry logic and error handling for API requests. Ad platform APIs return various error codes for validation failures, rate limiting, and authentication issues. Queue failed events for retry with exponential backoff. Log all API requests and responses for troubleshooting and compliance auditing.

Conversion API Match Rate Troubleshooting

Low match rates—when ad platforms can't link your server-side conversion events back to users who clicked ads—are the #1 reason server-side tracking fails to improve campaign optimization. If match rates stay below 50%, your conversion data won't meaningfully inform algorithmic bidding.

Step-by-step diagnostic for sub-50% match rates:

1. Check email normalization: Export 100 sample conversion events from your server-side pipeline. Verify that all emails are lowercased and whitespace-trimmed BEFORE hashing. A single "User@Email.com" vs. "user@email.com" discrepancy drops match rates 10–15 percentage points.

2. Test hashing implementation: Use platform-provided hashing tools (Meta's CAPI Test Event) to verify your SHA-256 output matches platform expectations. Confirm you're hashing normalized values, not raw user input.

3. Verify API authentication: Check that your access tokens, pixel IDs, and conversion action IDs match the accounts receiving ad traffic. Test vs. production credential mismatches are the #2 cause of zero match rates.

4. Confirm event deduplication logic: Review your event_id generation. Each conversion should have a unique event_id that's identical in both client-side pixel fires (if still running dual-tracking) and server-side API posts. Platforms use event_id to deduplicate; missing or mismatched IDs cause double-counting or zero matching.

5. Inspect user_data field completeness: Platforms match on email, phone, and external_id. Sending only email yields 40–50% match rates; adding normalized phone numbers (E.164 format: +1234567890) lifts rates to 60–70%. Include all available identifiers in the user_data payload.

6. Analyze data freshness: Platforms take 24–48 hours to process server-side conversions and update match rate reporting. If you just launched API integration, wait 72 hours before diagnosing match rate issues. Also check that your event timestamps reflect actual conversion time, not batch processing time—events older than 7 days may not match.

Common telehealth-specific failure: hashing provider emails instead of patient emails when booking confirmation systems send events from provider accounts. Validate that your event extraction logic pulls the patient identifier, not the care delivery team member.

Maintain Click IDs and Attribution Parameters

Server-side conversion tracking depends on passing platform-specific click identifiers from ad click to conversion event. Telehealth patient journeys complicate this with appointment scheduling platforms, patient authentication flows, and cross-device behavior.

Preserve URL parameters from ad traffic through your entire conversion funnel. Meta's fbclid, Google's gclid, TikTok's ttclid, and other platform identifiers must persist across page loads, form submissions, and redirects. Store these values in first-party cookies or session storage with appropriate expiration windows—21 days minimum for mental health (to cover longer consideration cycles), 14 days for dermatology and primary care.

Telehealth journey complexity: Click ID persistence breaks when patients book through external scheduling platforms (Acuity embeds, SimplePractice booking widgets, Calendly integrations). When a patient clicks your ad, lands on your marketing site, then redirects to a third-party booking system, URL parameters are often lost. Solutions: (1) Pass click IDs as hidden form fields before the scheduling redirect, storing them in your database linked to the patient email, then retrieve when the scheduling platform webhooks back confirmation data. (2) Use first-party cookies set on your root domain that the scheduling platform can read if it's embedded via iframe rather than full redirect. (3) Implement server-side session management where click IDs are stored server-side against a session token that persists through the booking flow.

Patient authentication flow interruptions: When patients must log into a patient portal to complete booking, URL parameters don't survive the authentication redirect unless explicitly preserved. Configure your identity provider (Auth0, Okta, custom auth systems) to append preserved parameters to post-login redirect URLs.

Pass click identifiers to your server when users convert. Include the stored click ID in conversion event payloads sent to platform APIs. This linkage enables platforms to match server-side conversions back to the originating ad click for accurate attribution.

Implement fallback matching when click IDs are unavailable. Hashed email and phone number matching allows platforms to attribute conversions based on user identity rather than click tracking. This approach works for organic conversions, cross-device journeys (patient researches on mobile, books on desktop), and users who clear cookies between ad click and conversion. For telehealth, where 40–50% of patients research on one device and book on another, identity-based matching is critical for capturing cross-device conversions that click ID tracking misses.

When Server-Side Tracking Makes Performance Worse

Server-side conversion reporting can break campaign optimization in specific edge cases. Honest assessment of when the recommended approach fails:

1. Conversion volume drops below platform learning thresholds: Meta requires 50+ conversions per week per ad set for algorithmic optimization; Google needs 30+ conversions per month per campaign. If aggressive PHI filtering reduces reported conversion volume below these thresholds (because you're stripping content_category signals or consolidating granular events into generic "appointment_booked"), algorithms lose the signal density needed for bid optimization. Result: CPMs rise, auction performance degrades. Mitigation: Use broader conversion events ("appointment_scheduled" instead of "therapy_package_purchased") to maintain volume above learning thresholds, even if less precise.

2. Delayed server-side event transmission prevents real-time optimization: If your booking confirmation webhooks have 4+ hour delays (common with some EHR integrations), and you send conversion events to APIs only after webhook receipt, platforms receive conversion data too late for same-day campaign adjustments. Campaigns optimizing toward next-day conversions outperform delayed server-side reporting. Mitigation: Send preliminary conversion events at booking time (before EHR confirmation) using patient-provided data, then send updated events with revenue/LTV data when EHR confirms. Accept some event duplication to maintain signal freshness.

3. Aggressive PHI filtering strips signals algorithms need: If you remove all content_category, product_id, and custom_data fields to avoid PHI exposure, you may strip behavioral signals that improve match quality and optimization. Meta's algorithm performs better with rich conversion data ("booked therapy consultation" + value=$200 + content_category="mental_health") than sparse events ("conversion" + value=$200). Mitigation: Use non-PHI categorical labels that provide signal without diagnosis disclosure—"initial_consultation," "ongoing_care," "premium_service"—rather than "anxiety_therapy" or "adhd_treatment."

4. Loss of view-through conversions when moving from pixel to API-only: Pixels capture view-through conversions (users who saw but didn't click ads, then converted). Server-side APIs only capture click-through conversions unless you implement complex impression tracking. For upper-funnel awareness campaigns, losing view-through attribution makes performance appear worse even if actual incremental impact is unchanged. Mitigation: Keep lightweight client-side pixel for impression tracking (without PHI exposure) alongside server-side conversion APIs. Use dual reporting to preserve view-through visibility while keeping PHI out of click-based events.

5. Multi-product catalogs where product IDs expose PHI: Dermatology or weight management telehealth selling specific treatments (acne medication, hair loss Rx, GLP-1 prescriptions) can't pass product-level data without revealing treatment type (which is PHI). But product catalog campaigns need product IDs for optimization. Mitigation: Create non-PHI product groupings ("dermatology_tier_1," "dermatology_tier_2" based on price/LTV rather than condition treated). Or accept measurement blindness for certain verticals and optimize toward aggregate appointment value rather than product mix.

For each edge case, the solution is either (a) hybrid tracking—keep limited client-side pixels for specific non-PHI signals, (b) accept measurement gaps in exchange for compliance, or (c) restructure campaign targeting to work within server-side constraints rather than forcing server-side into pixel-era campaign structures.

Step 2: Deploy First-Party Data Capture Systems

First-party data infrastructure collects patient journey signals directly from owned properties without relying on third-party tracking technology. This data foundation enables audience building, personalization, and measurement when pixels fail.

Telehealth-Specific Data Sources

Generic "website analytics and mobile app events" don't capture the full patient journey for telehealth. Your first-party data strategy must integrate clinical and operational systems that e-commerce marketers never touch.

Patient scheduling platform APIs: Acuity Scheduling, SimplePractice, Healthie, and Calendly integrations provide appointment booking data, cancellation/reschedule signals, and provider selection patterns. Extract: appointment type (initial vs. follow-up), booking-to-appointment lead time, cancellation rates by acquisition channel, provider preference signals (patients booking with specific specialties or credential levels).

EHR integration for treatment completion: When patients complete care (attended appointment, received diagnosis, started treatment), EHR systems (Epic, Cerner, Athenahealth) log clinical outcomes. HIPAA-compliant API connections extract: appointment completion status (attended vs. no-show), treatment initiation (started therapy, received prescription), and high-level outcome categories (completed care vs. churned before treatment). Never extract diagnosis codes or clinical notes—only completion/churn signals needed for LTV modeling.

Patient portal engagement analytics: Track behavior within authenticated patient portals: symptom checker usage (which conditions researched), provider profile views (specialty, credentials, availability), insurance verification steps (which plans checked, verification completion), appointment self-service (reschedules, cancellations, intake form completion rates). This data lives behind authentication, making it first-party by definition and not subject to cookie restrictions.

Telehealth platform session data: For virtual care visits, your video consultation platform (Zoom Healthcare, Doxy.me, proprietary systems) logs: session duration, connection quality, chat transcript sentiment (if analyzed with PHI controls), follow-up appointment scheduling during consultation. Use engagement signals to identify high-intent patients (completed 45-minute therapy session vs. 10-minute triage call) for remarketing and LTV prediction.

Each source requires a Business Associate Agreement before integration. But unlike ad platform pixels, these are your systems—you control PHI exposure and can sanitize data before marketing use.

Instrument Owned Digital Properties

Deploy server-side analytics on your website, patient portal, and mobile app to capture behavioral data in your controlled environment—replacing client-side pixels with server-side tagging that filters PHI before external transmission.

Implement server-side Google Analytics 4 using Google Tag Manager Server-Side or equivalent analytics platforms. Configure your web server or tag management server to process analytics requests rather than sending data directly from user browsers to Google. This architecture gives you control over what data reaches third-party analytics tools and enables PHI filtering before external transmission.

Telehealth event tracking priorities: Generic page view tracking misses the patient journey micro-conversions that predict booking likelihood. Track:

• Provider search and filter usage: Specialty selected, insurance filter applied, availability preferences (evening appointments, weekend slots), location/telehealth toggle. Signals care urgency and acquisition channel match quality.

• Treatment information engagement: Time on condition pages, FAQ expansions, treatment comparison table interactions, cost estimator usage. Predicts booking intent and informs content optimization.

• Scheduling funnel abandonment points: Insurance verification drop-off (40–60% exit rate if verification fails or seems complex), provider selection abandonment (too few available slots), appointment time selection drop-off (availability doesn't match patient schedule). Identifies friction points for CRO.

• Patient portal feature adoption: Symptom checker completion, secure messaging usage, intake form saves vs. completions, prescription refill requests. Distinguishes engaged patients from tire-kickers.

Cross-domain tracking for external scheduling platforms: When patients book through embedded widgets or external scheduling systems, implement cross-domain tracking to persist the patient journey from your marketing site → scheduling widget → confirmation page. Use server-side session tokens or first-party cookies that survive domain transitions. Pass patient email as a key to link scheduling platform conversion data back to your marketing attribution data.

Assign persistent first-party identifiers to users across sessions and devices. Generate a unique user_id when patients create accounts or provide contact information. Store this identifier in secure, HTTP-only, first-party cookies and link it to patient records in your HIPAA-compliant database. This persistent ID enables longitudinal journey tracking without cross-site cookies—critical for telehealth where patients research over weeks before booking.

Build Healthcare-Compliant Customer Data Platform

A customer data platform unifies patient data from multiple sources into complete behavioral and transactional profiles. For telehealth, this means reconciling marketing touch points with clinical and operational data while maintaining HIPAA compliance.

Ingest data from all patient touchpoints: website analytics, mobile app events, appointment scheduling system, EHR integration (treatment completion only, no clinical details), customer support interactions, email engagement, SMS responses, and call center logs. Each source sends events or batch data to your CDP's unified data layer.

Telehealth identity resolution complexity: Linking anonymous website visitors to known patients is harder in healthcare than e-commerce due to patient vs. caregiver ambiguity, family account structures, and shared household devices requiring mental health privacy.

• Distinguishing patient from caregiver: When a parent researches pediatric telehealth for a child, or an adult child searches for elder care for a parent, the person clicking ads isn't the patient. Your identity graph must handle "caregiver researches → patient books" journeys. Solution: separate caregiver contact records from patient records in your CDP, link via household relationships, attribute marketing touches to caregiver but conversion value to patient.

• Family account structures: Primary care and pediatric telehealth serve entire families under single accounts—one parent email linked to multiple patient profiles (spouse, children). Conversion events must specify which family member booked, and LTV models should aggregate household value rather than individual patient value. Configure your CDP's identity resolution to support one-to-many (one contact record → multiple patient profiles) relationships.

• Shared device privacy for mental health: When household members share devices, cookie-based tracking can't distinguish users. Mental health patients especially avoid account login during research to maintain privacy from family members. Fallback: rely on email/phone submission at booking to definitively identify the patient, accept that early-funnel anonymous behavior may be ambiguous.

Create audience segments based on behavioral and transactional data. Build segments for patients at specific journey stages (awareness: viewed 3+ pages but no inquiry; consideration: submitted inquiry but no appointment; appointment booked; active treatment; lapsed: no appointment in 90+ days), treatment interests (dermatology, mental health, weight management—inferred from page views, not diagnosis data), engagement levels (highly engaged: opened 3+ emails + portal login; at-risk: no engagement in 30 days), and lifetime value tiers (high-value: completed premium care packages; standard-value: single appointment completers). Export these segments to ad platforms as Custom Audiences or Customer Match lists for targeting and suppression.

Compliance requirements beyond BAA signing: Selecting a CDP that "supports HIPAA" isn't sufficient. Evaluate vendors on:

• Healthcare customer references: Does the vendor actively serve 10+ telehealth or healthcare clients? Generic enterprise CDP vendors often lack the healthcare data model nuances (patient vs. caregiver, family accounts, appointment lifecycle tracking) built into healthcare-focused platforms.

• Data residency options: Some state privacy laws require health data storage within state borders. Does the CDP offer region-specific data residency (AWS US-East, US-West, EU) to comply with state telehealth licensing and data residency requirements?

• Audit log retention: HIPAA mandates 6-year retention of access logs. Confirm the CDP retains audit logs meeting this requirement without additional cost or manual export.

• Breach notification SLAs: HIPAA requires breach notification within 72 hours. Does the vendor contractually commit to this timeline in their BAA, or do standard SLAs allow 5-day response windows incompatible with HIPAA?

Vendors meeting these criteria include Segment (Healthcare tier), Hightouch (with healthcare customers), and RudderStack (BAA standard). Avoid generic marketing CDPs without healthcare experience—implementation failures and compliance gaps become expensive.

Activate First-Party Audiences for Targeting

Use captured first-party data to build ad platform audiences that don't rely on pixel-based behavioral tracking—the replacement for cookie-based remarketing that HIPAA and browser restrictions killed.

Export hashed patient email lists and phone numbers to Meta Custom Audiences, Google Customer Match, TikTok Custom Audiences, and LinkedIn Matched Audiences. Upload lists for: (1) suppression—existing patients you don't want to retarget with acquisition campaigns, (2) conversion optimization—teach algorithms what converted users look like by uploading recent converters, and (3) lookalike expansion—find similar users based on your high-LTV patient characteristics.

Refresh audience uploads regularly to maintain accuracy. Schedule daily or weekly exports from your CDP to ad platforms, ensuring new patients are added to suppression lists within 24 hours of booking (to avoid wasted spend) and recent converters inform optimization algorithms while signals are fresh.

Match rate troubleshooting for audience uploads: If your Custom Audience match rates stay below 50% (see diagnostic table in Step 1), the most common telehealth-specific failures are:

• Uploading provider emails instead of patient emails: Multi-provider networks sometimes export scheduling data with provider contact info. Validate that your audience export pulls patient email/phone, not care team members.

• Multiple email addresses per patient: Patients provide different emails at different touchpoints (personal email for initial inquiry, work email for appointment booking, partner's email for family account). Your CDP's identity resolution must merge these into a single profile and upload all known emails to maximize match rates.

• Phone number formatting inconsistencies: Hash phone numbers in E.164 format (+1234567890) after removing all formatting (spaces, dashes, parentheses). A single formatting inconsistency drops match rates 15–20 points.

Layer first-party audiences with platform-native targeting criteria. Combine your uploaded patient lists with demographic, geographic, and interest-based targeting available through platform tools. Example: upload your "appointment_booked_last_90_days" list, exclude them from acquisition campaigns (suppression), then build a Lookalike Audience from that list and layer 25-mile radius targeting around your licensed provider locations. This hybrid approach balances compliance constraints with sufficient audience scale for campaign delivery.

For mental health and other Special Ad Category verticals where detailed targeting is restricted, first-party audiences and lookalikes become your primary targeting mechanism—making match rate optimization and regular audience refreshes critical for campaign scale.

Step 3: Implement Privacy-Preserving Measurement Models

When pixel-based multi-touch attribution breaks down, telehealth marketers need alternative measurement approaches that quantify marketing effectiveness without granular user-level tracking. This means moving from "which ad converted this specific patient" to "which channels drive incremental patient volume."

Marketing Mix Modeling vs. Incrementality Testing: Selection Framework

MMM and incrementality testing answer different questions and require different organizational capabilities. Use this framework to determine which methodology fits your telehealth company's maturity and measurement needs.

Minimum viable specifications for MMM: You need at least 52 weekly observations (one year of data, though 104 weeks / two years is better for seasonal pattern detection). Track 5+ marketing inputs (paid search, paid social, display, affiliate, podcast, TV, direct mail—whatever channels you run). Annual marketing spend should exceed $500,000 to justify the $30K–$75K cost of building and maintaining MMM models (agency or internal data science resources). Below these thresholds, MMM produces unreliable estimates with wide confidence intervals that don't inform decisions.

Minimum viable specifications for incrementality testing: Each test cell (treatment vs. control) needs 2,000+ conversions to detect a 10% lift at 80% statistical power and p<0.05 significance. For telehealth with 7–45 day conversion windows, tests run 4–12 weeks depending on vertical. You'll sacrifice 15–20% of potential conversions during the test (the control group that doesn't see ads). Below 2,000 conversions per cell, you lack statistical power to distinguish signal from noise—your test will be "inconclusive" most of the time.

Recommended approach for most telehealth companies: Start with incrementality testing to validate your highest-spend channels (does paid search actually drive incremental bookings, or are you paying for patients who would have found you organically?). Once you prove incrementality for 2–3 core channels, build MMM for ongoing cross-channel optimization and budget allocation. Use incrementality tests quarterly to validate MMM estimates and recalibrate models.

Deploy Marketing Mix Modeling

Marketing mix modeling uses statistical analysis of aggregate marketing spend and conversion data to estimate channel contribution and ROI—without requiring user-level tracking. It's the privacy-safe measurement methodology that works when pixels fail.

Collect time-series data for all marketing inputs and outputs. Track daily or weekly spend by channel (paid search, paid social, display, affiliate, podcast, TV, direct mail), impressions or reach where available, and conversion outcomes (appointments booked, new patients, revenue). Include external factors that influence conversion rates: seasonality (mental health demand peaks in January and September), competitive activity (new telehealth competitor launches), market conditions (health insurance open enrollment periods), and offline events (PR coverage, word-of-mouth spikes after major healthcare news).

Build regression models that correlate marketing inputs with business outcomes. Modern MMM approaches use Bayesian methods and machine learning to estimate the incremental impact of each marketing channel while accounting for:

• Lag effects: How long marketing takes to drive conversions. Paid search for acute dermatology may show 0–3 day lags; mental health therapy package purchases often lag 21–45 days after initial ad exposure. Model distributed lag structures (adstock models) that credit marketing exposures across the appropriate time window.

• Saturation curves: Diminishing returns at high spend levels. Your first $10K in paid social may yield $50K in patient revenue; the next $10K might yield $35K; the next $10K only $20K. MMM quantifies these saturation effects to identify optimal spend levels per channel.

• Interaction effects: How channels work together. Paid search + paid social running simultaneously may drive 30% more conversions than the sum of each channel in isolation (due to multi-touch awareness → conversion journeys). MMM captures these synergies.

Generate channel-level ROI estimates and optimization recommendations. MMM outputs show which channels drive the most incremental conversions per dollar spent, where you're hitting diminishing returns (should reduce spend), and where you're under-investing (should increase spend). Update models monthly or quarterly as you accumulate more data—MMM accuracy improves with dataset size.

MMM works without user-level tracking, making it inherently privacy-safe and HIPAA-compliant. The aggregate analysis never processes individual patient journeys or PHI. You're modeling "$50K paid social spend in week 23 → 150 appointments in weeks 23–27" relationships, not "patient X clicked ad Y and booked appointment Z."

Telehealth-specific MMM considerations: Mental health and other high-consideration verticals require longer lag structures (30–60 day adstock windows) than e-commerce MMM (7–14 days). Primary care with insurance verification steps may show bimodal lag distributions (immediate bookings for urgent care, 14–30 day lags for non-urgent appointments). Test multiple lag specifications and select based on model fit (AIC/BIC criteria) rather than assuming e-commerce-style short lags.

Run Incrementality Tests

Incrementality testing uses controlled experiments to measure the causal impact of marketing activities rather than relying on correlation-based attribution. It's the gold standard for proving that ads drive patient volume beyond what would have happened organically.

Design geo-holdout tests: Split your target markets into test and control groups with similar baseline characteristics (population, competition, seasonality). Run higher ad spend in test markets while maintaining lower or zero spend in control markets. Compare conversion rates between groups to isolate the incremental impact of the marketing investment.

Example: You run paid search for dermatology telehealth in 30 metro areas. Rank markets by size, pair similar markets, randomly assign one market in each pair to "high spend" (your target budget level) and the other to "low spend" (50% of target) or "zero spend" (paused entirely). Run for 6–8 weeks. Compare appointment booking rates between high-spend and low-spend groups. If high-spend markets show 25% more bookings per capita, that's your incremental lift from paid search.

Conduct audience-based holdout tests: Meta and Google allow you to create randomized control groups excluded from ad exposure. Run campaigns to the majority of your target audience (80–90%) while holding back a statistically significant control group (10–20%). Measure conversion rate differences between exposed and unexposed users to quantify true incrementality.

Example: You run Meta awareness campaigns targeting parents of teens (for teen mental health services). Create a control group of 15% of your target audience who never see your ads. After 8 weeks, compare appointment booking rates between the 85% exposed group and the 15% control. If the exposed group books at 0.8% rate vs. 0.65% for control, your Meta campaigns drive 0.15 percentage points (23% relative lift) of incremental bookings. All other bookings in the exposed group would have happened anyway (organic search, word-of-mouth, competitor ads).

Test frequency and budget requirements: Run incrementality tests for major channels quarterly or bi-annually. Holdout tests require sufficient budget and volume to achieve statistical significance—you need 2,000+ conversions per cell (treatment and control) to reliably detect 10% lifts. For telehealth companies processing 500 bookings/month, a 10–20% control group means sacrificing 50–100 bookings during the 8-week test period. This is the cost of certainty—you lose short-term volume to gain long-term optimization confidence.

Telehealth vertical considerations: Mental health requires 8–12 week incrementality tests to capture the full 21–45 day conversion lag. Dermatology can run 4–6 week tests due to shorter cycles. If your conversion volume is too low for powered tests (under 1,000 conversions per month), consider testing at the channel level ("all paid social" vs. "no paid social") rather than campaign level to aggregate sufficient volume.

Combine incrementality test results with MMM estimates. Use holdout experiments to validate and calibrate your marketing mix models. If MMM estimates paid social drives $3.50 ROI but incrementality tests show $2.20 ROI, your MMM is over-crediting paid social (likely due to organic correlation—patients who see ads were already likely to book). Adjust MMM coefficients based on incrementality ground truth, improving forecast accuracy.

Post-Pixel Telehealth Performance Benchmarks

Set realistic expectations for measurement visibility and performance changes after migrating from pixel-based tracking to server-side infrastructure. These benchmarks reflect aggregate industry data from telehealth companies post-iOS 14.5 and browser privacy enforcement.

Use these benchmarks to set stakeholder expectations and avoid under-investing in server-side infrastructure because "conversion tracking dropped." The visibility loss is universal across telehealth—companies that adapt measurement methodologies (MMM, incrementality testing, first-party data activation) maintain performance despite reduced tracking granularity. Those that delay adaptation lose market share to competitors who rebuilt measurement infrastructure faster.

Implement Unified Measurement Reporting

Post-pixel measurement requires combining data from multiple sources and methodologies into coherent performance reporting. No single measurement system tells the complete story anymore—you need triangulated visibility across platform-reported conversions, server-side event data, MMM estimates, and incrementality test results.

Build a centralized marketing data warehouse that ingests spend, impression, click, and conversion data from all advertising platforms, server-side conversion APIs, first-party analytics, CRM systems, and appointment scheduling tools. Normalize data schemas (unify "appointment_booked" vs. "appointment_scheduled" vs. "booking_completed" across systems), deduplicate conversions counted in multiple systems (same patient booking reported by both Meta CAPI and Google Ads API), and apply consistent attribution logic (last-click, linear, time-decay—choose one and apply uniformly).

Create unified dashboards that show campaign performance across the full patient journey. Report on:

• Awareness metrics: Impressions, reach, video completion rate, brand search lift. Shows top-of-funnel campaign delivery and message resonance.

• Consideration metrics: Website visits, page depth, content engagement time, form starts, symptom checker completions. Bridges awareness to conversion intent.

• Conversion metrics: Appointments booked (all sources), server-side conversion API counts (undercounted but directionally accurate), platform-reported conversions (even lower due to tracking loss), appointment completion rate, treatment initiation rate, patient lifetime value.

Layer different measurement methodologies in your reporting framework rather than relying on a single source of truth:

This multi-method approach provides triangulated performance visibility when no single measurement system tells the complete story. Show platform-reported conversion counts ("Meta reports 450 conversions this month"), server-side data ("Our server tracked 620 appointment bookings from Meta traffic"), MMM estimates ("MMM attributes 680 incremental bookings to Meta, accounting for organic correlation"), and incrementality test results ("Q3 holdout test showed Meta drives 15% incremental lift = ~590 true incremental bookings"). The range across methods reflects measurement uncertainty—but the directional consistency validates that Meta is working, even when precise attribution is impossible.

For executive reporting, lead with MMM-based channel contribution and ROI estimates (the most complete view of marketing impact), support with server-side conversion counts (operational tracking), and reference incrementality test results (proof of causality). Avoid leading with platform-reported conversions—stakeholders who see "conversions dropped 45%" without context assume performance collapsed, when reality is measurement visibility collapsed while actual patient volume stayed stable or grew.

Step 4: Optimize Campaigns with Limited Tracking Signals

Reduced conversion visibility doesn't mean abandoning algorithmic optimization. It means adapting campaign structures and bidding strategies to work with the signals you still have—and accepting that manual judgment plays a larger role than in the pixel era.

Campaign Structure for Incomplete Tracking

When conversion data is incomplete or delayed, consolidate campaigns to concentrate conversion signals and maintain algorithmic learning. Fragmented campaign structures that worked with pixel-based tracking now starve algorithms of the volume they need.

Consolidate to broader targeting: Instead of running separate campaigns for "anxiety therapy," "depression treatment," "ADHD counseling," and "couples therapy" (each with 20–40 conversions/month), consolidate into "mental health services" campaigns with 100+ conversions/month. Use ad creative and landing page variations to address specific conditions rather than campaign-level segmentation. This consolidation keeps you above platform learning thresholds (Meta: 50 conversions/week; Google: 30 conversions/month) even with tracking loss.

Use value-based bidding when LTV data is available: If your server-side conversion API can pass appointment value or predicted patient LTV (without exposing PHI), optimize toward conversion value rather than conversion volume. This teaches algorithms to favor higher-value patients (premium therapy packages, ongoing care commitments) over low-value volume (single consultation bookings). Requires clean revenue data in your conversion events and sufficient value variance (if all appointments are $150, value-based bidding doesn't help).

Expand conversion windows: Default platform attribution windows (7-day click) are too short for telehealth. Extend to maximum available windows: Meta allows 28-day click, Google allows 90-day click. For mental health with 21–45 day consideration cycles, shorter windows undercredit ads that influence early-stage research. Longer windows capture more of the true conversion lag, improving apparent performance and giving algorithms more signal to optimize against.

Creative Testing with Less Conversion Data

When conversion data is sparse or delayed, optimize toward proxy metrics earlier in the funnel rather than waiting for conversion volume that may take weeks to accumulate.

Use engagement metrics as leading indicators: video completion rate (for awareness video ads), landing page time on site (for consideration content), form start rate (for conversion-focused ads). These metrics show within hours or days, while conversion data lags weeks. If two ad creatives show similar click-through rates but one drives 40% higher landing page engagement, that creative is likely to outperform on conversions—scale it before waiting for statistically significant conversion data.

Test ad creative variations that improve conversion likelihood independent of tracking: clearer value propositions ("$99 initial consultation, most insurance accepted" vs. generic "start your mental health journey"), social proof (patient testimonials, provider credentials), and friction reduction ("no insurance verification required" for self-pay services, "same-day appointments available"). These tests improve actual conversion rates, not just measurement accuracy.

Multi-State Licensure and Geographic Tracking Challenges

Telehealth companies with providers licensed in multiple states face unique conversion attribution challenges when patient location differs from provider location or billing address.

Scenario: A patient in New York City books an appointment with a California-licensed mental health provider for virtual care delivered via video. Google Ads shows the conversion in California (provider's location), Meta attributes it to New York (patient's IP address), and your CRM tags it as New Jersey (billing address). Which state gets credit for geographic optimization?

Solution approaches:

• Attribute to patient location: Most accurate for campaign targeting decisions (where to spend ad budget). Use IP-based geolocation at booking time, stored in your conversion event pipeline. Disadvantage: some telehealth networks serve patients nationally, making "patient location" nearly useless for optimization (every geo looks identical).

• Attribute to provider licensed state: Relevant for supply-side optimization (which states need more provider hiring). Disadvantage: disconnected from ad targeting, which is patient-focused.

• Attribute to billing address: Aligns with revenue recognition and reimbursement rules. Disadvantage: billing address may be parent's address for young adults, or partner's address for shared accounts, making geo data unreliable.

Select one attribution rule and apply consistently. Document the rule in your data dictionary so all stakeholders interpret geo reports identically. Most telehealth marketers choose patient IP location for campaign optimization, with separate provider-location-based reporting for capacity planning.

Step 5: Ensure HIPAA Compliance and Legal Requirements

Rebuilding tracking infrastructure isn't just a marketing measurement problem—it's a compliance requirement. HIPAA, state health privacy laws, and platform policies all impose legal constraints on how you collect and share patient data.

Execute Business Associate Agreements with All Data Vendors

HIPAA requires Business Associate Agreements with any third party that receives Protected Health Information on your behalf. For telehealth marketing, this includes not just your CDP and data warehouse, but also ad platforms, analytics providers, tag management systems, and even some agency partners.

Who requires a BAA:

• Always require BAA: Customer data platforms (Segment, Hightouch), data warehouses (Snowflake, BigQuery, Redshift), marketing automation platforms (HubSpot, Marketo), analytics platforms that store user-level data (Amplitude, Mixpanel), server-side tag management (Google Tag Manager Server-Side if processing PHI), call tracking providers (CallRail, DialogTech), and agencies with access to patient-level data.

• Usually don't require BAA (if used correctly): Ad platforms receiving only sanitized, hashed conversion data via APIs (Meta, Google, TikTok—no BAA because you've stripped PHI before transmission). Client-side pixels (if you've removed them entirely or limited to non-PHI pages). BI tools that only visualize aggregate data without storing patient records (Looker, Tableau connected to your warehouse but not storing independent copies).

• Depends on implementation: Google Analytics 4 requires a BAA if you send any user-level health data (page paths revealing conditions, user IDs linked to patient records). Doesn't require a BAA if you only send sanitized, aggregated data. CRMs (Salesforce, HubSpot) require BAA if storing patient contact info linked to health data; may not require if you separate marketing contacts from patient records.

Execute BAAs before sending any data to vendors. Many vendors (especially ad platforms and analytics tools) don't offer BAAs for standard plans—this is a signal to evaluate whether you should use those tools at all, or only send non-PHI data that doesn't trigger BAA requirements.

Total Cost of HIPAA-Compliant Marketing Infrastructure

HIPAA compliance for telehealth marketing infrastructure carries significant costs beyond SaaS platform fees. Budget for these when planning your post-pixel migration:

Compare these costs against the risk-adjusted cost of non-compliance: OCR HIPAA penalties for pixel-based PHI disclosure range from $100 per violation (unintentional, corrected within 30 days) to $50,000 per violation (willful neglect). GoodRx's $1.5M settlement covered PHI disclosure affecting an estimated 3+ million users. At scale, non-compliance costs dwarf infrastructure investment.

Also budget for hidden performance costs: conversion visibility loss requires 15–25% higher ad spend to maintain the same patient volume (because you're bidding less efficiently without granular conversion data), and 2–4 week learning periods per platform after migration cause temporary performance dips. Factor these into your ROI calculations when deciding whether to invest in compliant infrastructure now or delay and risk enforcement.

State Telehealth Privacy Laws Beyond HIPAA

HIPAA is the federal baseline, but state laws layer additional requirements—especially for telehealth companies serving patients across state lines.

California (CCPA/CPRA): Patients have the right to know what health data you collect, request deletion, and opt out of "sale" (broadly defined—sharing patient emails with ad platforms for Custom Audience matching may qualify). Requires explicit consent for health data collection and prominent "Do Not Sell My Info" links. Applies when serving California residents, regardless of where your company is based.

Washington My Health My Data Act: One of the strictest state health privacy laws, effective since 2024. Prohibits collecting health data without explicit consent, bans "sale" of health data (including ad targeting), and requires data minimization. Covers any entity collecting Washington residents' health data—not limited to HIPAA-covered entities. Particularly impacts telehealth marketers using behavioral tracking or lookalike audiences.

State-specific telehealth licensing and data residency: Some states require health data generated within state borders to be stored on servers physically located in-state or in the U.S. Verify your data warehouse and CDP infrastructure meets these requirements if you serve patients in states with data residency rules. Most cloud providers (AWS, GCP, Azure) offer region-specific deployments—configure appropriately.

Consult healthcare counsel to map state privacy laws applicable to your licensed service areas. Multi-state telehealth networks face the most complex compliance matrices—you must meet the strictest state's requirements across all operations to avoid violations.

Build vs. Buy: Server-Side Infrastructure Decision Matrix

After understanding what's required for post-pixel telehealth marketing, most teams face the build-vs.-buy decision: implement custom server-side tracking with internal engineering resources, or adopt a turnkey marketing data platform that handles server-side APIs, PHI filtering, and compliance out of the box?

Startup/growth-stage recommendation (seed to Series B): Adopt a turnkey platform. Your bottleneck is speed—you need conversion tracking operational in weeks, not quarters, and your engineering team is focused on product development, not marketing infrastructure. Platforms like Improvado provide pre-built server-side API connectors for Meta, Google, TikTok, and 1,000+s, plus HIPAA-compliant PHI filtering rules and automatic connector maintenance when platforms update APIs. Marketing teams get no-code interfaces for building dashboards and activating audiences; engineering gets full SQL access for custom transformations without managing infrastructure.

Enterprise recommendation ($50M+ revenue, 100+ marketing team members): Evaluate build vs. buy based on data engineering capacity and workflow customization needs. If you have 5+ data engineers supporting marketing and highly custom patient journey tracking (integrating proprietary EHRs, multi-region compliance requirements, real-time ML-based patient scoring), custom-built infrastructure may offer more flexibility. If your workflows align with standard telehealth patterns (scheduling platform → conversion API → ad platform optimization), turnkey platforms deliver faster with lower risk. Many enterprises adopt hybrid approaches: turnkey platform for 80% of use cases, custom builds for the 20% requiring proprietary logic.

Key differentiator for telehealth: Healthcare-specific compliance features matter more than generic marketing automation. Prioritize vendors with:

• Pre-built PHI classification and sanitization rules (not just "we support HIPAA")

• Proven telehealth customer base (reference checks with similar companies)

• BAA execution included in standard contracts (not enterprise-only add-on)

• Integration with healthcare-specific platforms (SimplePractice, Healthie, Acuity, major EHRs)

• Audit-ready logging and data lineage tracking (for HIPAA compliance documentation)

12-Week Migration Roadmap: From Pixels to Server-Side

Practical timeline for telehealth companies transitioning from pixel-based tracking to compliant server-side infrastructure. Adjust durations based on engineering capacity and platform complexity.

Most telehealth companies complete migration in 12–16 weeks with dedicated engineering resources. Startups using turnkey platforms (Improvado, Segment Healthcare, RudderStack) compress this to 4–6 weeks by eliminating custom development phases. Enterprise implementations with complex EHR integrations and multi-region compliance may extend to 20–24 weeks.

Critical path items that delay projects: BAA negotiation with enterprise vendors (can take 4–8 weeks for legal review), low match rate troubleshooting (often requires multiple debugging iterations), and stakeholder education (executives uncomfortable with measurement uncertainty post-pixel require extensive socialization of new attribution methodologies). Front-load these high-friction activities to avoid timeline slippage.

Conclusion

Telehealth marketing in the post-pixel era requires fundamental infrastructure changes—not just tactics tweaks. Client-side pixels expose Protected Health Information, violate HIPAA, and no longer function reliably due to browser restrictions. The telehealth companies that maintain patient acquisition efficiency through 2026 and beyond are those that rebuilt measurement infrastructure around server-side conversion APIs, first-party data capture, and privacy-preserving methodologies like marketing mix modeling and incrementality testing.

The migration isn't trivial. It requires engineering resources (200–600 hours for custom builds, or weeks with turnkey platforms), legal compliance investments ($5K–$30K for BAA execution), ongoing maintenance costs (0.5–1.5 FTE), and acceptance of measurement uncertainty (±15–25% attribution accuracy vs. the pixel-era illusion of precision). But the alternative—continuing to use pixels and risking OCR penalties, platform policy violations, and persistent measurement blackouts—is worse.

Start with your highest-priority implementation based on current pain: If conversion tracking dropped 40%+ and campaigns can't optimize, prioritize server-side conversion APIs (Step 1). If legal flagged HIPAA concerns or you lack BAAs with vendors, focus on compliance infrastructure (Step 5). If match rates stay below 50% despite having server-side APIs, work through the diagnostic troubleshooting (Step 1, match rate section). If you need to prove marketing ROI to executives skeptical of new measurement approaches, implement MMM or incrementality testing (Step 3).

Most importantly, recognize that post-pixel telehealth marketing is a solved problem for companies willing to invest in proper infrastructure. The playbook is clear: sanitize PHI before external transmission, capture first-party patient journey data in owned systems, use server-side APIs for platform optimization, and measure incrementality when user-level attribution fails. Execute this infrastructure once, and you'll maintain acquisition efficiency regardless of future browser restrictions, platform policy changes, or privacy regulation—while competitors still running pixels face measurement collapse and compliance risk.