Location-Based Marketing Solutions in a Hospital: What They Are, What the Law Requires, and Where They Touch Staffing

A hospital shopping for location-based marketing solutions is usually about six months away from running a staffing tool, and the two are the same purchase. The sensing layer is identical. A phone that can be shown a message because it is standing outside the outpatient pharmacy is a phone that can be routed to a ward, and the badge that locates a nurse is the same radio problem as the handset that guides a visitor.

What differs is the policy sitting on top of the signal. This article covers what these systems are, which signals they run on, what the law requires before you switch one on, and how a deployment bought for patient engagement ends up being judged on staff time.

What are location-based marketing solutions?

Location-based marketing solutions change what a person sees or receives based on where they are standing, using satellite positioning outdoors and radio or magnetic positioning indoors. The category bundles four distinct jobs that are frequently sold as one product.

Those four are not equally useful in a hospital, and they are not equally legal. Proximity messaging to patients is the smallest of the four and the most constrained, because the message is being delivered to someone whose presence in the building is itself a health fact. Analytics and wayfinding carry most of the value. A retail mall buys this stack to lift footfall into stores; a hospital buys the same stack and discovers that the thing it is really measuring is how long people spend lost in its own corridors. The marketing label survives the procurement process. The use case rarely does.

Why do hospitals buy location software for operations before marketing?

Because the return lands in staff minutes rather than click-through, and the staffing arithmetic is already severe enough that minutes are the currency leadership is counting.

The World Health Organization projects a global shortfall of around 10 million health workers by 2030, concentrated in low and lower-middle-income countries (WHO, health workforce). The pressure is not confined to those countries. In the United States, the Bureau of Labor Statistics projects roughly 194,500 openings for registered nurses every year across its 2023 to 2033 projection decade, the large majority of them replacing people who leave the occupation or retire (Occupational Outlook Handbook, registered nurses, 2023 to 2033 projections).

Against that backdrop, a system whose headline benefit is a better promotional message to a visitor has a hard case to make. A system that stops a clinical nurse being stopped nine times a shift for directions has an easier one. Same platform. Different slide.

Which positioning technology do these solutions actually run on?

Indoors, almost never GPS. Satellite signals need a sky view that concrete and steel remove, so indoor systems fall back on Wi-Fi, Bluetooth Low Energy, ultra-wideband, magnetic field patterns and the phone’s own inertial sensors.

It is worth seeing how coarse the outdoor fallback is, because a regulator has already written the number down. The Federal Communications Commission’s 911 location accuracy rules require wireless carriers to deliver either a dispatchable location or a horizontal position within 50 meters for 80% of wireless 911 calls, plus vertical accuracy of plus or minus 3 meters for handsets able to report it (FCC, 911 location accuracy, rules as amended through 2021). Fifty meters covers most of a hospital floor plate. Three meters of vertical uncertainty is about one storey, which in a hospital is the difference between the cardiac ward and the car park lift lobby.

Each of those carries a cost that only appears after year one. Ultra-wideband buys the tightest accuracy in the list and charges for it twice, in anchors on the ceiling and in a tag on every tracked item. Bluetooth Low Energy beacons are cheap to buy and are a maintenance line item forever, because batteries die quietly and a dead beacon degrades a route without raising an alarm. Wi-Fi positioning reuses infrastructure you already own, and it inherits whatever access point layout the network team chose for throughput rather than for geometry. Magnetic and inertial approaches avoid installed hardware entirely and pay for it with a survey requirement.

Standards work is narrowing some of these gaps. IEEE 802.11az adds fine timing measurement to Wi-Fi for ranging (IEEE 802.11az), and Bluetooth Low Energy direction finding adds angle of arrival to a protocol that previously only had signal strength. Neither removes the need to decide what accuracy you are actually buying. Beacons are sometimes the right answer. If you need to know which of two adjacent bays a mobile ventilator is parked in, a hardware-light approach will not get you there, and an honest assessment says so rather than selling around it.

What does the law require before you use someone’s location?

Consent, in most of the jurisdictions that matter, and a documented lawful basis in all of them. Location tied to an identifiable person is personal data, and several regimes treat it as a higher-risk category than ordinary contact details.

Under the General Data Protection Regulation, Regulation (EU) 2016/679, location data that can be linked to a person is personal data and needs one of the six lawful bases in Article 6 (EUR-Lex, consolidated text). Separately, Article 5(3) of the ePrivacy Directive, Directive 2002/58/EC, requires informed consent before storing or gaining access to information already stored on a user’s terminal equipment, which is what a scanning-based analytics product does (EUR-Lex, Directive 2002/58/EC).

California draws the line in feet. Civil Code section 1798.140, as amended by the California Privacy Rights Act of 2020, classifies precise geolocation as sensitive personal information and defines it as data locating a consumer within a radius of 1,850 feet (California Civil Code 1798.140). In a US care setting, a location record attached to a patient in a treatment context can also be protected health information under the HIPAA Privacy Rule at 45 CFR Part 164 (HHS, HIPAA for professionals).

One technical fact deserves a place in the legal conversation, because it changes what passive analytics can deliver. Both major mobile platforms randomize Wi-Fi MAC addresses during scanning. Counting unique devices by hardware address no longer produces a stable count of unique people, so any proposal that quietly assumes it does is describing a product from several years ago.

Accessibility belongs in the same paragraph as privacy, since both get discovered late. If the wayfinding front end is a web app, WCAG 2.1 Level AA is the conformance target to name in the contract (W3C, WCAG 2.1), and a route that cannot be read by a screen reader is a route that excludes exactly the visitors most likely to need it.

How does a location-based deployment end up on the staffing side?

Three routes, none of which appear in a marketing dashboard: visitors stop interrupting clinical staff for directions, equipment stops being hunted, and agency or newly hired staff orient themselves without a chaperone.

The first is the quietest and probably the largest. Every lost visitor converts into an interruption, and interruptions land on whoever is visible, which in a corridor means nursing staff rather than the information desk two floors down. The second is the one most often quantified, and here is where this article is going to decline to give you a number. The equipment-search figures that circulate in this market trace back to supplier material rather than to a study you can open and check. A number you cannot verify is worse than no number in a business case, because the first person who checks it will discount everything around it.

Measure it on your own floor instead. Pick one unit, shadow a shift before go-live, log every search and every direction request with a timestamp, and repeat the exercise twelve weeks after. That baseline is the only figure that will survive a finance review, and it costs one observer for two weeks.

The third route matters most where turnover is highest. A travel nurse on a four-week placement spends the first days learning a building rather than a caseload, and a maintained indoor map moves that cost from the person to the software.

The trade-off that belongs in the business case

Locating staff is surveillance, and calling it anything else is how these programs fail at the consultation stage rather than the technical one. The same infrastructure that routes a visitor can produce a minute-by-minute record of where a named employee stood all shift.

Decide the boundary before procurement, not after the first incident. Zone-level resolution rather than point-level, retention measured in days rather than years, an explicit prohibition on using the data in individual performance management, and a written answer to who can query an individual’s history. In the European Union, Article 88 of the GDPR specifically contemplates member state rules on processing in the employment context, and works council consultation is a real gate rather than a formality. Staff who help design the boundary tend to defend the system. Staff who discover it tend to disable the badge.

What should you ask before you sign?

Four questions, and the quality of the answer matters more than the feature list attached to it.

The first question is the one that quietly decides the outcome. Hospitals renovate continuously. A wayfinding deployment whose map is updated by a supplier ticket with a two-week turnaround will be wrong within a quarter and distrusted within two, and a route that sends someone to a department that moved is worse than no route at all, because the first one was believed.

What does the first 90 days look like?

A survey, one wing live, and a measured baseline. Not a campus-wide launch, which is how these projects acquire a long tail of broken routes nobody owns.

Resist the temptation to switch on proximity messaging in the same quarter. Wayfinding either works or visibly does not, so it earns trust fast. Messaging is the capability most likely to generate a complaint, and a complaint in month two will take the map down with it.

Frequently asked questions

Four questions buyers ask most often about running location software inside a hospital.

Do location-based marketing solutions work indoors without GPS?

Yes, and indoors they have to. Satellite positioning needs a sky view that a hospital’s structure removes. Indoor systems substitute Wi-Fi signal measurements, Bluetooth Low Energy beacons or direction-finding antennas, ultra-wideband anchors, or the building’s own magnetic field combined with the phone’s inertial sensors. Accuracy and cost vary widely between those options, so the right question is which resolution a specific use case genuinely requires.

Is indoor location data personal data?

If it can be linked to an identifiable person, yes. Under the General Data Protection Regulation it is personal data requiring an Article 6 lawful basis, and the ePrivacy Directive separately requires consent before accessing information on someone’s device. California classifies precise geolocation as sensitive personal information. In a US treatment context, a patient’s location record can additionally fall under the HIPAA Privacy Rule at 45 CFR Part 164.

Do you need Bluetooth beacons for indoor positioning?

Not always. Beacons give reliable room-level proximity and a predictable installation model, at the cost of hardware you own and batteries you replace on a schedule. Approaches built on Wi-Fi measurements or on magnetic and inertial sensing avoid that hardware but depend on a surveyed, maintained map. For tight asset tracking inside a bay or bed space, installed infrastructure such as ultra-wideband remains the dependable choice.

Can this data be used to track individual staff?

Technically yes, which is why the policy needs writing before the install. Sensible deployments restrict resolution to zones rather than points, cap retention at days, prohibit use in individual performance management, and record who may query an individual history. In the European Union, Article 88 of the GDPR addresses processing in the employment context and works council consultation applies. Involving staff in setting that boundary is what keeps the system switched on.

Where should a hospital start?

With the map and the consent flow, before any messaging. Those two decisions set the ceiling on everything the platform can do afterwards, and both are cheaper to settle on paper than to retrofit once a wing is live.

If you are weighing a location-based deployment for a hospital or campus, the useful first conversation is about your building rather than about software: how often the floor plan changes, who owns the map, what resolution your actual use cases need, and what the consent flow has to say. Mapsted works on indoor positioning, indoor mapping and wayfinding, and that scoping discussion is free. Book a scoping call.