Healthcare marketing data is one of the strangest markets on the internet. You have vendors selling lists of “patients” who may never have had the condition you’re targeting. You have pricing that swings from a few cents per record to six figures a year for a license. And you have sales decks that all recite the same three magic words: HIPAA-compliant, deterministic, consented.
Here’s the uncomfortable reality: almost nobody in this space is selling you “healthcare data.” They’re selling one of about four very different products, and they all describe themselves the same way on the landing page. If you compare vendors on the features they advertise, you’ll end up picking the one with the best marketing team. If you compare them on how the pipeline actually works, you’ll pick the one that won’t blow up in your lap six months in.
Rule Zero: Figure Out What You’re Actually Buying
Before you look at a single vendor, sort the market into buckets. Most providers are really one of these wearing a different logo:
- Compiled consumer records. Contact info, demographics, and inferred health interest built from public records, surveys, warranty cards, loyalty programs, and web behavior. Cheap, broad, and heavily modeled.
- Claims-derived data. Records sourced from insurance adjudication. Contains actual diagnosis codes and procedure codes. Sold de-identified or aggregated. Expensive, slower, and usually the most accurate signal you can legally buy.
- Pharmacy and prescription signals. Fill events, refill patterns, therapeutic class. Great for adherence and chronic condition targeting, narrower on everything else.
- Clinical or EHR-derived de-identified data. Lab values, vitals, encounter history. The deepest layer, the smallest sample, and the most heavily regulated.
Half of the comparison work is just refusing to compare a claims vendor against a compiled-list vendor. They are not competitors. They’re different tools.
1. Source Provenance — Ask How the Sausage Gets Made
This is the question vendors dodge hardest. “We have 250 million records” tells you nothing. Ask:
- Is the data first-party, licensed, or compiled?
- What’s the original source of the health signal — a claim, a script, a survey, or a model?
- Is the condition label documented or inferred? A record that says “diabetic” because the person bought a glucose meter is a different animal than one with two ICD-10 codes and a metformin fill.
- What percentage of the file is modeled versus observed? Good vendors know this number. Bad vendors get vague.
If a rep can’t tell you the upstream origin without “proprietary algorithm” hand-waving, that’s your answer.
2. Match Rates and Identity Resolution
You will not use the vendor’s file in isolation. You’ll match it against your own CRM, your site visitors, your email list, or your ad platform audiences. So the real question isn’t coverage — it’s overlap.
- Deterministic matching (hashed email, phone, address) gives you fewer matches but higher confidence.
- Probabilistic matching gives you more matches and more false positives, which in healthcare means marketing a diabetes program to someone who isn’t diabetic.
- Ask for a measured match rate against a sample you provide, not a stated one from a slide.
- Ask what identifiers they support and whether their identity graph survives the deprecation of mobile ad IDs. A vendor whose whole resolution strategy was device IDs is a walking time bomb.
Run the test yourself with 5,000 of your own records. It takes an afternoon and it’s the single best predictor of whether the partnership works.
3. Consent and Legal Exposure
This is where “we’re compliant” becomes a real conversation.
- Consent provenance: Who opted in, when, to what, and can they produce the timestamp? If the consent was collected by a third party and resold four times, that trail is usually broken.
- Authorization vs. de-identification: A record that’s genuinely de-identified under the applicable standard is a different legal object than one that’s identifiable and covered by an authorization form. Vendors love to blur these.
- Role assignment: Are they acting as a business associate, a data licensor, or just a list broker? Each creates different obligations for you.
- Indemnification: Will they stand behind the data in writing if a regulator or plaintiff comes knocking? Most won’t. The ones who will usually have the cleanest sourcing.
- Downstream restrictions: Can you use the data for paid media, direct mail, phone outreach, or modeling only? Some licenses permit one and prohibit the rest.
The tell is simple: ask for the specific legal basis for the health attributes. If you get a PDF about “privacy by design” instead of an answer, keep shopping.
4. Condition-Level Accuracy, Not File-Level Accuracy
Every vendor claims 95%+ accuracy. What they mean is that the address is deliverable and the name matches. Nobody’s claiming 95% condition accuracy, because it doesn’t exist.
Ask for accuracy by condition. Rare and stigmatized conditions are usually where the models fall apart. And ask how they validate: against a holdout set, against a clinical registry, or against their own marketing copy. Only one of those counts.
5. Freshness and Refresh Cadence
Claims data lags. Sometimes by months. If your campaign depends on someone being currently in a treatment window, a 9-month-old file is worthless no matter how accurate it is.
- How often is the file rebuilt — daily, monthly, quarterly, annually?
- What’s the average lag between event and availability?
- Do you get incremental updates, or do you re-license the whole thing each cycle?
- Can you filter by recency of signal?
6. Suppression Hygiene
This is the boring stuff that determines whether people hate you and whether you get fined. A serious provider maintains and applies:
- Deceased suppression
- Opt-out and do-not-contact lists
- Address and phone hygiene, including move updates
- Do-not-sell and deletion request propagation
- Sensitive-condition flags that let you exclude categories you don’t want to touch
Ask them to prove how a deletion request flows through their pipeline. Most can’t draw the diagram.
7. Delivery, Format, and Onboarding Time
A great dataset you can’t consume is a liability. Compare API access versus flat file drops, whether they push to your CRM or ad platform directly, turnaround from contract to first record, and whether there’s an implementation fee hiding in the SOW. Also check usage metering — per-record, per-match, CPM, or seat-based. The pricing model shapes your campaign design more than the data does.
8. Contract Terms That Decide Everything
- Usage rights and channel restrictions
- Term length and auto-renewal traps
- Exclusivity (rare, expensive, occasionally worth it)
- Audit rights — can you verify what you were sold?
- Data return or destruction on termination
- Price escalation on renewal
The Ten-Minute Bake-Off
- Send every shortlisted vendor the same 5,000-record sample.
- Ask for the same three conditions back, with a confidence field.
- Measure match rate, condition hit rate, and duplicate rate yourself.
- Request documentation for consent and lineage on those exact records.
- Price it out per usable record, not per record sold.
The vendor that complains about the test is the vendor that fails it.
Bottom Line
Healthcare marketing data is one of the few purchases where the cheapest option and the most expensive option can both be wrong, and where the sales deck is nearly useless as a signal. Compare on origin, overlap, legality, condition-level truth, freshness, hygiene, and contract — in that order. Everything else is packaging. Do the sample test, get the consent trail in writing, and assume any number a rep gives you is a marketing claim until your own data says otherwise.