Pharma HCP and DTC media: the layers, the data and the contract

Endemic platforms, HCP programmatic, health data rules and FDA scrutiny all add cost to pharma media. What to put in the agency contract to see each layer.

Pharma media has two supply chains running side by side. One reaches clinicians through endemic platforms and HCP-targeted programmatic. The other reaches patients through TV, streaming, search and social. Both have more layers than most brand teams can name, both carry data and privacy costs that did not exist ten years ago, and both are governed by agency contracts written for a simpler market.

The HCP side: endemic platforms and targeted programmatic

Endemic platforms are the sites and apps clinicians use for work. Doximity is the clearest public example. Its fiscal 2025 10-K says its members include more than 80% of U.S. physicians and more than two million registered members, and that pharmaceutical manufacturers and health systems are its customers. Revenue reached $570.4 million in fiscal 2025, up 20%. Two details from the filing matter for buyers: pharma customers buy programs brand by brand, and Doximity says it does not typically sign long-term contracts with them.

That second point cuts both ways. Short commitments give the brand flexibility. They also mean the price is set brand by brand, often by different agency teams, with little view across the portfolio.

HCP programmatic adds more layers. The buy runs through a demand-side platform, an audience built by matching clinician identities to devices, data fees for the targeting list, verification, and a measurement vendor for script lift. Each layer charges a fee or a markup. When the agency also packages the data and the inventory, the brand often sees one CPM and none of the layers.

The DTC side: big budgets, more scrutiny

DTC budgets are large. Campaign reported that Pfizer's ad spending rose to $3.7 billion in 2023 from $2.8 billion in 2022. TV still carries a big share, which is now where regulators are looking. King and Spalding counted 74 FDA enforcement letters to drug manufacturers in 2025, the highest annual total in nearly 25 years, and 42 targeted DTC television ads. Sixteen challenged promotion to health care professionals. The September 2025 crackdown also flagged digital and social media, including undisclosed paid influencer promotion, and FDA said it would start rulemaking on the "adequate provision" route that broadcast ads rely on.

Regulatory risk is not a media cost on its own. It becomes one when a finding forces a creative pull mid-flight and the media contract has no clause for cancelled or reallocated inventory.

Data and privacy: the cost line that keeps growing

Health data rules now shape how pharma can target and measure, and every vendor in the chain is part of the exposure.

• HIPAA and tracking. HHS issued a bulletin in December 2022 on online tracking technologies, treating an IP address linked to a visit to an unauthenticated health page as protected. In June 2024, a federal court in Texas vacated that part of the guidance in American Hospital Association v. Becerra, and HHS withdrew its appeal in August 2024. Hospitals and health systems got relief. Pixels on authenticated patient pages and patient support programs still need care.
• The FTC Health Breach Notification Rule. In February 2023, the FTC brought its first HBNR case, against GoodRx, with a $1.5 million penalty over health data allegedly shared with Facebook, Google and others for advertising. In April 2024 the FTC finalized amendments that bring health apps not covered by HIPAA squarely into scope and treat unauthorized disclosure to third parties as a breach. Breaches affecting 500 or more people require notice within 60 calendar days.
• FTC Act orders. In April 2024, Cerebral agreed to pay $7 million, and accepted what the FTC chair called a first-of-its-kind ban on using customers' health information for most advertising, after its tracking tools allegedly sent users' mental health answers to Meta.

None of those cases involved a pharma manufacturer. All of them involved the same tools pharma brands use on patient sites, savings card pages and telehealth partnerships. The cost shows up as consent management, clean rooms, privacy-safe audience vendors, legal review of every pixel, and higher CPMs for compliant audiences. It is real money, and it is usually spread across agency, technology and legal budgets where nobody adds it up.

What to put in the agency contract

The ANA's media agency contract template, updated in June 2023, is a good starting point. It keeps unlimited audit rights, requires approval and channel-level reporting for non-transparent services such as principal media, includes a schedule for invalid traffic, viewability and brand safety, and specifies transaction data to obtain from vendors. Yet in a recent ANA survey reported by Gala Law, only 61% of marketers said their contracts specifically address principal media and other non-transparent services. For pharma, add these:

• Layer-by-layer cost disclosure for HCP programmatic: media, DSP fee, data fee, identity matching, verification and measurement, each as its own line.
• Consent before principal or packaged buys, including bundled HCP data and inventory sold by the agency or its holding company.
• Endemic platform rates negotiated across brands, with the agency reporting what each brand pays each platform.
• A data processing schedule that lists every vendor receiving patient or HCP data, what it receives, and a ban on use for any purpose beyond your campaigns.
• Tag governance: no pixel, SDK or tracking script on brand or patient support properties without written approval, and an inventory you can audit.
• A regulatory pull clause: when a creative is withdrawn for regulatory reasons, the agency reallocates or cancels inventory at no fee, and reports the cost.
• Log-level data access for programmatic buys. Our piece on log-level data explains why that clause is worth more than a discount.

If the agency resists, our explainer on principal media covers what it is protecting.

The next step

Ask your media agency for one brand's last quarter of HCP programmatic, broken down into media, platform, data, verification and measurement costs, with the vendor named on each line. If it cannot produce that, the contract needs fixing before the next planning cycle. A Second Opinion reviews the agency agreement in five business days, and our pharma and consumer health work covers the rest of the commercial vendor stack, including the MLR process.

Sources: Doximity, Form 10-K for fiscal 2025, Business Wire, Doximity announces fourth quarter and fiscal 2025 results, Campaign, Pfizer moves creative from IPG to Publicis after just 10 months, King and Spalding, 2025 year in review: FDA drug and device advertising and promotion enforcement, King and Spalding, HHS and FDA declare crackdown on drug advertising and promotion, Hunton, Federal judge rules online tracking technologies guidance exceeded HHS authority, AHA News, HHS will not appeal AHA court victory in online tracking case, Data Privacy and Security Insider, GoodRx settles with FTC for sharing health information for advertising, Inside Privacy, FTC issues final rule to expand scope of the Health Breach Notification Rule, The Markup, Cerebral to pay $7 million fine and limit health data use for ads, ANA, ANA releases updated media buying contract template, Gala Law, Principal media and media agency contracts: lessons from the recent ANA survey.