In healthcare, the information that makes a message worth sending is also the information people are most careful about: a member’s coverage details, their primary providers, the benefit programs they’re enrolled in, the prescription they’re due to refill, etc.
The tension is real — recipients tend to engage with personalized messaging, but companies can quickly cross the line into something more Orwellian in appearance, even with the best of intentions. This pushes a lot of healthcare marketing messages toward “safe and generic”.
How personal is too personal?
Most marketers’ instincts tell them that “creepiness” scales with how much you personalize. That’s not necessarily true.
What recipients tend to object to is personal data that is unexpectedly used in their messaging. A lack of informed consent is the single biggest consumer concern — and most patients don’t even know who can see their data.
So the for “how personal is too personal” isn’t how much the company knows about the recipient. Instead, it’s:
Did the recipient give you what you’re using?
Does the recipient expect you to use their info through the channel they received it?
For example, flagging an unused benefit is a great way to personalize healthcare messaging — customers expect you to see their plan information.
Conversely, prompting someone about a heart-health risk they never raised and never opted into will likely cause concern — even though it’s the same “we can help” instinct.
That second example changes if the user had opted into a program that sends them alerts about personalized potential health risks.
The difference is in the expectation, not necessarily how sensitive the topic is.
That said, most healthcare personalization is ordinary and genuinely useful. For example:
A care marketplace surfacing providers a member has seen before, real open appointment times, or a program they already enrolled in.
A health plan flagging a benefit they haven’t used — “you still have covered visits left this year.”
None of these feel particularly invasive because they all run on what the member gave you and clearly expects you to have.
HIPAA requirements and limitations
All of that said, US Healthcare has a floor that consumer brands don’t: HIPAA (Health Insurance Portability and Accountability Act). HIPAA is a law designed to protect patient confidentiality. In general, you need signed authorization before using protected health information for marketing.
However, de-identified data isn’t considered PHI under HIPAA. This keeps options open for marketers to utilize what their customers actively gave them, and what they did inside the product. This is compliant and comfortable at the same time.
Our approach to personalization in Healthcare
We maintain three habits that keep messaging on the right side of personalization — and frankly, these extend beyond just the healthcare industry:
Use declared and expected signals — what customers have told you and what they would expect you to see, not guesses about sensitive information.
Lead with value exchange — tell users why you’re asking for their data and be clear about what they get back.
Trigger on behavior, not assumptions — react to what customers actually did, not what you inferred.
It all comes down to trust. In healthcare, trust is ultimately what decides whether people act on a message at all.
How to determine what information to personalize with
Generally speaking, don’t ask yourself how much you know. Ask whether you were given the information — and then whether your customer expects you to use it the way you’re planning.
Relevance built on consent feels like care. Relevance built on inference feels like spying. Healthcare users will notice the difference instantly.
Have a comment or a question? Reach out to us at hello@modularmarketing.com.