On February 1, the Federal Trade Commission (“FTC”) announced its first-ever enforcement action under its Health Breach Notification Rule (“HBNR”) against digital health platform GoodRx Holdings Inc. (“GoodRx”) for failing to notify consumers and others of its unauthorized disclosures of consumers’ personal health information to third-party advertisers.  According to the proposed order, GoodRx will pay a $1.5 million civil penalty and be prohibited from sharing users’ sensitive health data with third-party advertisers in order to resolve the FTC’s complaint. 

This announcement marks the first instance in which the FTC has sought enforcement under the HBNR, which was promulgated in 2009 under the Health Information Technology for Economic and Clinical Health (“HITECH”) Act, and comes just sixteen months after the FTC published a policy statement expanding its interpretation of who is subject to the HBNR and what triggers the HBNR’s notification requirement.  Below is a discussion of the complaint and proposed order, as well as key takeaways from the case.

The Complaint

As described in the complaint, GoodRx is a digital healthcare platform that advertises, distributes, and sells health-related products and services directly to consumers.  As part of these services, GoodRx collects both personal and health information from its consumers.  According to the complaint, GoodRx “promised its users that it would share their personal information, including their personal health information, with limited third parties and only for limited purposes; that it would restrict third parties’ use of such information; and that it would never share personal health information with advertisers or other third parties.”  The complaint further alleged that GoodRx disclosed its consumers’ personal health information to various third parties, including advertisers, in violation of its own policies.  This personal health information included users’ prescription medications and personal health conditions, personal contact information, and unique advertising and persistent identifiers.

The FTC complaint alleged that GoodRx violated Section 5 of the FTC Act because its privacy practices amounted to “unfair or deceptive acts or practice, in or affecting commerce.”  Specifically, the complaint alleges:

  • GoodRx represented to consumers that it would never share personal health information with advertisers or other third parties, when in fact GoodRx shared such personal health information (e.g., prescription medications and personal health conditions) with a number of third parties, including third-party advertisers.  The personal health information was then used to target GoodRx users with personalized ads.
  • GoodRx represented that any third parties receiving consumers’ personal health information would be allowed to use such information only for limited purposes, but in fact GoodRx allowed third parties to use the shared personal health information for their own internal purposes, including research and development.
  • GoodRx represented compliance with the Digital Advertising Alliance’s principles, which provide that companies should obtain consent before using health information for advertising, when in fact GoodRx did not seek consent prior to disclosing consumers’ health information.
  • GoodRx misrepresented its compliance with the U.S. Health Insurance Portability and Accountability Act (“HIPAA”) by displaying a seal at the bottom of its telehealth services homepage that certified GoodRx was HIPAA-compliant, when in fact GoodRx was not.
  • GoodRx failed to implement policies and procedures to protect its users’ personal health information despite making statements that users could trust GoodRx with their information.

In addition to violations under the FTC Act, the complaint alleged that GoodRx is subject to the HBNR as a vendor of personal health records, for GoodRx lets users keep track of their personal health information, including to save, track, and receive alerts about their prescriptions, refills, pricing, and medication purchase history.  Under the HBNR, vendors of personal health records that are not otherwise regulated under HIPAA are required to notify individuals, the FTC, and, in some cases, the media following a breach involving unsecured identifiable health information.  Thus, by failing to notify consumers, the FTC, and the media about GoodRx’s unauthorized disclosure of individually identifiable health information to third parties — including third-party advertisers — GoodRx violated the HBNR.

Proposed Order

The proposed order requires GoodRx to pay $1.5 million in civil penalties for violating the HBNR, as well as prohibits GoodRx from engaging in the aforementioned deceptive practices and requires GoodRx to comply with the HBNR.  The proposed order further requires GoodRx to:

  • Prohibit the sharing of health data for advertisements;
  • Obtain users’ affirmative express consent before disclosing user health information with applicable third parties for any purpose other than advertising;
  • Require GoodRx’s third party partners to delete any consumer health information that it obtained from GoodRx;
  • Limit how long GoodRx may retain personal and health data according to a publicly posted retention schedule, and detail the information it collects and why such data collection is necessary;
  • Implement a comprehensive privacy program that adequately protects consumer data; and
  • Obtain an initial and biannual privacy assessment conducted by an independent, third- party professional.

The Commission voted 4-0 to refer the complaint and proposed order to the DOJ for filing, and Commissioner Christine S. Wilson issued a concurring statement.  The order must be approved by a court prior to taking effect.

Key Takeaways

As noted above, the GoodRx action marks the first instance of the FTC seeking enforcement under the long-dormant HBNR.  The HBNR was originally understood to encompass traditional data security breaches of individually identifiable health information.  However, in September 2021, the FTC adopted a policy statement that took a broad view of which health apps and connected devices are subject to the HBNR and what triggers the HBNR’s notification requirement.  This action is consistent with that policy statement, which advises that a “breach of security” under the HBNR occurs “[w]hen a health app, for example, discloses sensitive health information without users’ authorization.”  In its press release announcing the enforcement action, FTC foreshadowed that although the GoodRx action may be the first of its kind, it likely would not be the last, and that the FTC “will use all of its legal authority to protect American consumers’ sensitive data from misuse and illegal exploitation.”

The GoodRx enforcement action also further highlights the increased scrutiny federal and state regulators are placing on companies using and disclosing consumer health information.  For example, although the FTC has not previously sought enforcement under the HBNR, the FTC has previously brought an enforcement action focused on the alleged disclosures of sensitive health data in connection with the use of common Internet tracking technologies.  In addition, in September 2020, then-California Attorney General Xavier Becerra, who is now Secretary of the Department of Health and Human Services, announced a $250,000 settlement with Glow, Inc., resolving allegations that the fertility app had “expose[d] millions of women’s personal and medical information” and violated multiple laws, including California’s Confidentiality of Medical Information Act (“CMIA”).  Furthermore, state legislatures have also taken an increased interest in the health privacy and have proposed legislation to protect health data.  For example, Washington’s state legislature recently introduced a bill that would prevent a business’ sharing of health data without a consumer’s consent.

Photo of Libbie Canter Libbie Canter

Libbie Canter represents a wide variety of multinational companies on privacy, cyber security, and technology transaction issues, including helping clients with their most complex privacy challenges and the development of governance frameworks and processes to comply with global privacy laws. She routinely supports…

Libbie Canter represents a wide variety of multinational companies on privacy, cyber security, and technology transaction issues, including helping clients with their most complex privacy challenges and the development of governance frameworks and processes to comply with global privacy laws. She routinely supports clients on their efforts to launch new products and services involving emerging technologies, and she has assisted dozens of clients with their efforts to prepare for and comply with federal and state privacy laws, including the California Consumer Privacy Act and California Privacy Rights Act.

Libbie represents clients across industries, but she also has deep expertise in advising clients in highly-regulated sectors, including financial services and digital health companies. She counsels these companies — and their technology and advertising partners — on how to address legacy regulatory issues and the cutting edge issues that have emerged with industry innovations and data collaborations.

As part of her practice, she also regularly represents clients in strategic transactions involving personal data and cybersecurity risk. She advises companies from all sectors on compliance with laws governing the handling of health-related data. Libbie is recognized as an Up and Coming lawyer in Chambers USA, Privacy & Data Security: Healthcare. Chambers USA notes, Libbie is “incredibly sharp and really thorough. She can do the nitty-gritty, in-the-weeds legal work incredibly well but she also can think of a bigger-picture business context and help to think through practical solutions.”

Photo of Anna D. Kraus Anna D. Kraus

Anna Durand Kraus advises on issues relating to the complex array of laws governing the health care industry. Her background as Deputy General Counsel to the U.S. Department of Health and Human Services (“HHS”) gives her broad experience with, and valuable insight into…

Anna Durand Kraus advises on issues relating to the complex array of laws governing the health care industry. Her background as Deputy General Counsel to the U.S. Department of Health and Human Services (“HHS”) gives her broad experience with, and valuable insight into, the programs and issues within the purview of HHS, including Medicare, Medicaid, fraud and abuse, and HIPAA privacy and security. Anna is co-chair of the firm’s Health Care Industry practice group.

Anna regularly advises clients on Medicare reimbursement matters, particularly those arising under Part B and the Part D prescription drug benefit. She also has extensive experience with the Medicaid Drug Rebate program. She assists numerous pharmaceutical and device manufacturers, health care providers, pharmacy benefit managers, and other health care industry stakeholders to navigate the challenges and opportunities presented by the Affordable Care Act.

Anna is a trusted adviser on health information privacy, security and breach notification issues, including those arising under the Health Insurance Portability and Accountability Act (“HIPAA”) and the Health Information Technology for Economic and Clinical Health (“HITECH”) Act. Her background in this area dates back to the issuance of the original HIPAA privacy regulations.

Anna’s clients depend on her to guide them through compliance with the Anti-Kickback statute, the Stark regulations, and other laws preventing fraud and abuse in the health care industry. Her deep knowledge of these laws has made her an important component of the firm’s representation of pharmaceutical companies and health care organizations under federal investigation or facing allegations under the False Claims Act. In addition, clients contemplating acquisitions in the health care sector rely on her to guide due diligence efforts.

Photo of Olivia Vega Olivia Vega

Olivia Vega provides strategic advice to global companies on a broad range of privacy, health care, and technology issues, including in technology transactions, mergers and acquisitions, and regulatory compliance. Within her practice, Olivia counsels clients on navigating the complex web of federal and…

Olivia Vega provides strategic advice to global companies on a broad range of privacy, health care, and technology issues, including in technology transactions, mergers and acquisitions, and regulatory compliance. Within her practice, Olivia counsels clients on navigating the complex web of federal and state privacy and data security laws and regulations, including on topics such as HIPAA, California’s Confidentiality of Medical Information Act, and the California Consumer Privacy Act. In addition, Olivia maintains an active pro bono practice.