Investigations are under way in both the U.S. and the U.K. into the actions of the data analytics firm Cambridge Analytica. Their influence on both the 2016 U.S. presidential campaign and the Brexit vote in the UK is being closely examined. One key data source that fed the algorithms behind their micro-targeted campaigns? Personal data “scraped” from 50 million Facebook accounts.

This compromise in the spirit if not the letter of Facebook’s privacy policies has led the social media platform to a crisis point.Given this revelation, it’s not surprising that consumers might demand better protection of their personal data. Nor is it wrong for regulators to ask hard questions of the broader data industry, of which pharma marketing is a part.

What does this mean for pharma

Pharma marketing increasingly lives in a world of data. From a data perspective, patients are consumers. Many of the same tools and techniques used for promoting consumer goods are applicable in the patient marketing space. Which means that what happens in the world of Facebook cannot be ignored.

What is different is the level of sensitivity when it comes to accessing and using personal health information (PHI) for marketing. While compliance to HIPAA regulations is well-understood, there are still gray areas around consumer and patient data. Merging social media activity, third-party advertising and first-party identifiable data can enable pinpoint targeting that may not violate the law but could infringe on the spirit of privacy if not managed well.

Similarly, we need to be respectful of the broad data sets available on healthcare professionals (HCPs). Simply combining HCP data from publicly available sources with marketing engagement data is not in itself illegal or unethical. But how we source and use that information can affect trust.

Here’s a list of steps pharma marketers can take:

1. Achieving safe harbor

As an industry, we should use this crisis to re-examine our own data policies. Pharma marketers need to establish how their customer data are collected and aggregated and how they are used for patient or HCP marketing.

2. Know thy source

First consider how data are collected directly and through third parties. Review how your data vendors inform their consumers about the data collected and how they are shared with marketing partners. Ensure that consumers can opt-out. Demanding that data policies are aligned with consumers’ expectations will aid in raising the level of trust in the industry.

3. Keep only what you need

A general principle of PHI data is to collect and store only the minimum needed to achieve the business goal. Anything more introduces risk. It can be tempting to collect any and all data possible, but applying this useful filter is a start to ensure that we only collect data for which we can articulate a positive use case for customers.

4. Audit ourselves

Finally, before the regulators come in and mandate additional rules on transparency, we could make progress with the public by establishing our own guidelines. There are clear precedents of industry establishing audit and certification protocols. For example, the Internet Advertising Bureau (IAB) has established self-regulatory principles for online advertising and members of IAB are required to subscribe to its Code of Conduct.

A similar code of conduct could be established by PhRMA to establish guidelines on the care, security, and use of HCP and patient data for marketing purposes. Signatory companies could agree to periodic audits to certify their adherence.

While digital pharma marketing may not be on the cusp of its own Cambridge Analytica-like crisis, all digital marketing is facing a new level of scrutiny. We should learn from the lessons of others, ensure our practices match our ethics, and be prepared to speak to our customers about our standards and practices when it comes to the use of data.

Pharma marketing has real power to improve the lives of our customers. We should respect that responsibility and work diligently to use data ethically to deliver real value to our customers.