FTC Announces First Enforcement Action Under Rule on Reporting Health Insurance Violations
The announcement marks the FTC's first request to enforce HBNR promulgated under the Health Information Technology for Economic and Clinical Health ("HITECH") Act of 2009, and the FTC issued a statement It took place just 16 months after issuing the Directive. This expands the interpretation of who is subject to her HBNR and what triggers his HBNR reporting requirements. Below is a discussion of the complaint and the proposed order, as well as the key findings of the lawsuit.
The Complaint
As described in the complaint, GoodRx is a digital healthcare platform that advertises, distributes, and sells health-related products and services directly to consumers. As part of these services, GoodRx collects both personal and health information from its consumers. According to the complaint, GoodRx “promised its users that it would share their personal information, including their personal health information, with limited third parties and only for limited purposes; that it would restrict third parties' use of such information; and that it would never share personal health information with advertisers or other third parties.” The complaint further alleged that GoodRx disclosed its consumers' personal health information to various third parties, including advertisers, in violation of its own policies. This personal health information included users' prescription medications and personal health conditions, personal contact information, and unique advertising and persistent identifiers.
The FTC complaint alleged that GoodRx violated Section 5 of the FTC Act because its privacy practices amounted to “unfair or deceptive acts or practice, in or affecting commerce.” Specifically, the complaint alleges:
- GoodRx represented to consumers that it would never share personal health information with advertisers or other third parties, when in fact GoodRx shared such personal health information (e.g., prescription medications and personal health conditions) with a number of third parties, including third-party advertisers. The personal health information was then used to target GoodRx users with personalized ads.
- GoodRx represented that any third parties receiving consumers' personal health information would be allowed to use such information only for limited purposes, but in fact GoodRx allowed third parties to use the shared personal health information for their own internal purposes, including research and development.
- GoodRx represented compliance with the Digital Advertising Alliance's principles, which provide that companies should obtain consent before using health information for advertising, when in fact GoodRx did not seek consent prior to disclosing consumers' health information.
- GoodRx misrepresented its compliance with the U.S. Health Insurance Portability and Accountability Act (“HIPAA”) by displaying a seal at the bottom of its telehealth services homepage that certified GoodRx was HIPAA-compliant, when in fact GoodRx was not.
- GoodRx failed to implement policies and procedures to protect its users' personal health information despite making statements that users could trust GoodRx with their information.
In addition to violating FTC laws, the complaint alleges that GoodRx as a personal health record provider is subject to HBNR. This is because GoodRx allows users to track personal health information, including storing, tracking and receiving prescription and refill notifications. Drug prices and purchase history. Under HBNR, personal health record providers not otherwise regulated under HIPAA must notify individuals, the FTC, and, in some cases, the media, of breaches of unprotected personally identifiable health information. GoodRx violated her HBNR by not notifying consumers, the FTC, and the media that GoodRx had unauthorized disclosed their personally identifiable health information to third parties, including third-party advertisers.
Key Takeaways
As noted above, the GoodRx action marks the first instance of the FTC seeking enforcement under the long-dormant HBNR. The HBNR was originally understood to encompass traditional data security breaches of individually identifiable health information. However, in September 2021, the FTC adopted a policy statement that took a broad view of which health apps and connected devices are subject to the HBNR and what triggers the HBNR's notification requirement. This action is consistent with that policy statement, which advises that a “breach of security” under the HBNR occurs “[w]hen a health app, for example, discloses sensitive health information without users' authorization.” In its press release announcing the enforcement action, FTC foreshadowed that although the GoodRx action may be the first of its kind, it likely would not be the last, and that the FTC “will use all of its legal authority to protect American consumers' sensitive data from misuse and illegal exploitation.”
The GoodRx enforcement action also further highlights the increased scrutiny federal and state regulators are placing on companies using and disclosing consumer health information. For example, although the FTC has not previously sought enforcement under the HBNR, the FTC has previously brought an enforcement action focused on the alleged disclosures of sensitive health data in connection with the use of common Internet tracking technologies. Additionally, in September 2020, then-California Attorney General Xavier Becerra, now Secretary of Health and Human Services, said the fertility app violated "[d] the personal and medical records of millions of women," You have violated multiple laws, including the California Medical Information Confidentiality Act (“CMIA”). Additionally, state legislatures have also shown growing interest in health privacy and are proposing legislation to protect health information. For example, the Washington state legislature recently introduced a bill banning businesses from sharing health information without consumer consent.
Post a Comment for "FTC Announces First Enforcement Action Under Rule on Reporting Health Insurance Violations"