By Bernie Grohsman, Founder, Morpheus Consulting Inc.
LinkedIn: Bernard Grohsman
LinkedIn: Morpheus Consulting Inc.
Your marketing team wants to understand which campaigns generate inquiries. Intake has records that could help answer that question, and someone proposes connecting the two systems. Before anyone starts mapping fields, agree on what the report should reveal and who needs to see it.
That conversation gives IT a clearer assignment. A request to “connect intake to marketing” leaves almost everything open, including whether the destination receives a campaign summary or an individual’s care history.
Start with the report’s purpose
Consider a hypothetical clinic reviewing inquiries by campaign and reporting period. The marketing director wants to decide where to allocate the next month’s budget. A report of approved campaign counts may answer that question without clinical notes, reasons for seeking care, or a list of patients and appointments. Intake can continue using the detailed records within its authorized workflow.
The privacy lead should first establish whether the proposed use and any disclosure are permitted. Where HIPAA’s minimum necessary standard applies, the organization must take reasonable steps to limit protected health information (PHI) to what the purpose requires and define appropriate access. The standard has exceptions; it does not grant permission to share a record simply because the export contains fewer fields.
Then inspect the proposed report with the people who will use it. Would a campaign total support the budget decision? Does anyone need an individual record? Who could connect a reporting identifier back to intake? These answers help determine the fields and access to propose for review.
Removing a name does not settle those questions. A code attached to an appointment or intake outcome may still connect to a person, depending on the data and recipient. HHS recognizes two de-identification methods, Expert Determination and Safe Harbor. An opaque identifier, a hash, or a table of counts does not automatically establish that information is de-identified.
Even a count deserves closer review when it describes a very small group. For example, one inquiry about a narrowly defined service on a particular day could help a reader identify someone if the reader already knows about that person’s visit. Assess what the intended readers could infer from the report and other information available to them.
Check what each destination would receive
An approved internal reporting workflow needs a separate decision before its output goes to an advertising or analytics platform. Check the destination’s rules as well as the organization’s privacy obligations. Google, for example, prohibits sending PHI to Analytics and offers no Analytics business associate agreement. Google Ads’ customer data policy excludes sensitive health-category conversions from enhanced conversions and store-sales uploads. Those restrictions apply to specific products and features; they do not resolve every healthcare reporting decision.
For the hypothetical clinic, put the proposed flow on one page. Show where campaign information joins an intake record, which approved fields leave that environment, and where the report is stored. Identify who can read it, how long it is retained, and who owns changes to the connection. Record the recipient and approval for any later export separately.
Make the approved field list explicit. A report that needs a campaign label should not quietly acquire a notes field when the source system changes. Configure the connection to reject unapproved fields and flag the change for review. Check whether free text or identifiers could also appear in URLs, event labels, or diagnostic logs.
Test the connection with fictional records
Before activation, run a fictional record through an isolated test and inspect the actual output. Compare it with the approved map, including intermediate storage and logs. If an unapproved care detail survives a transformation, change the mapping and retest. If the report is visible to a wider group than intended, fix access before using real records. Confirm that unexpected fields are rejected rather than forwarded.
Repeat the review and relevant tests when a source field, recipient, or business purpose changes. A working connection can otherwise carry yesterday’s assumptions into a different reporting task. The approved map and test results should let marketing, intake, IT, and privacy owners explain what the report answers, who can read it, and which fields the connection will carry.
