On February 1, the Federal Trade Commission (“FTC”) announced its first-ever enforcement action under its Health Breach Notification Rule (“HBNR”) against digital health platform GoodRx Holdings Inc. (“GoodRx”) for failing to notify consumers and others of its unauthorized disclosures of consumers’ personal health information to third-party advertisers. According to the proposed order, GoodRx will pay a $1.5 million civil penalty and be prohibited from sharing users’ sensitive health data with third-party advertisers in order to resolve the FTC’s complaint.

This announcement marks the first instance in which the FTC has sought enforcement under the HBNR, which was promulgated in 2009 under the Health Information Technology for Economic and Clinical Health (“HITECH”) Act, and comes just sixteen months after the FTC published a policy statement expanding its interpretation of who is subject to the HBNR and what triggers the HBNR’s notification requirement. Below is a discussion of the complaint and proposed order, as well as key takeaways from the case.

The Complaint

As described in the complaint, GoodRx is a digital healthcare platform that advertises, distributes, and sells health-related products and services directly to consumers. As part of these services, GoodRx collects both personal and health information from its consumers. According to the complaint, GoodRx “promised its users that it would share their personal information, including their personal health information, with limited third parties and only for limited purposes; that it would restrict third parties’ use of such information; and that it would never share personal health information with advertisers or other third parties.” The complaint further alleged that GoodRx disclosed its consumers’ personal health information to various third parties, including advertisers, in violation of its own policies. This personal health information included users’ prescription medications and personal health conditions, personal contact information, and unique advertising and persistent identifiers.

The FTC complaint alleged that GoodRx violated Section 5 of the FTC Act because its privacy practices amounted to “unfair or deceptive acts or practice, in or affecting commerce.” Specifically, the complaint alleges:

  • GoodRx represented to consumers that it would never share personal health information with advertisers or other third parties, when in fact GoodRx shared such personal health information (e.g., prescription medications and personal health conditions) with a number of third parties, including third-party advertisers. The personal health information was then used to target GoodRx users with personalized ads.
  • GoodRx represented that any third parties receiving consumers’ personal health information would be allowed to use such information only for limited purposes, but in fact GoodRx allowed third parties to use the shared personal health information for their own internal purposes, including research and development.
  • GoodRx represented compliance with the Digital Advertising Alliance’s principles, which provide that companies should obtain consent before using health information for advertising, when in fact GoodRx did not seek consent prior to disclosing consumers’ health information.
  • GoodRx misrepresented its compliance with the U.S. Health Insurance Portability and Accountability Act (“HIPAA”) by displaying a seal at the bottom of its telehealth services homepage that certified GoodRx was HIPAA-compliant, when in fact GoodRx was not.
  • GoodRx failed to implement policies and procedures to protect its users’ personal health information despite making statements that users could trust GoodRx with their information.

In addition to violations under the FTC Act, the complaint alleged that GoodRx is subject to the HBNR as a vendor of personal health records, for GoodRx lets users keep track of their personal health information, including to save, track, and receive alerts about their prescriptions, refills, pricing, and medication purchase history. Under the HBNR, vendors of personal health records that are not otherwise regulated under HIPAA are required to notify individuals, the FTC, and, in some cases, the media following a breach involving unsecured identifiable health information. Thus, by failing to notify consumers, the FTC, and the media about GoodRx’s unauthorized disclosure of individually identifiable health information to third parties — including third-party advertisers — GoodRx violated the HBNR.

Proposed Order

The proposed order requires GoodRx to pay $1.5 million in civil penalties for violating the HBNR, as well as prohibits GoodRx from engaging in the aforementioned deceptive practices and requires GoodRx to comply with the HBNR. The proposed order further requires GoodRx to:

  • Prohibit the sharing of health data for advertisements;
  • Obtain users’ affirmative express consent before disclosing user health information with applicable third parties for any purpose other than advertising;
  • Require GoodRx’s third party partners to delete any consumer health information that it obtained from GoodRx;
  • Limit how long GoodRx may retain personal and health data according to a publicly posted retention schedule, and detail the information it collects and why such data collection is necessary;
  • Implement a comprehensive privacy program that adequately protects consumer data; and
  • Obtain an initial and biannual privacy assessment conducted by an independent, third- party professional.

The Commission voted 4-0 to refer the complaint and proposed order to the DOJ for filing, and Commissioner Christine S. Wilson issued a concurring statement. The order must be approved by a court prior to taking effect.

Key Takeaways

As noted above, the GoodRx action marks the first instance of the FTC seeking enforcement under the long-dormant HBNR. The HBNR was originally understood to encompass traditional data security breaches of individually identifiable health information. However, in September 2021, the FTC adopted a policy statement that took a broad view of which health apps and connected devices are subject to the HBNR and what triggers the HBNR’s notification requirement. This action is consistent with that policy statement, which advises that a “breach of security” under the HBNR occurs “[w]hen a health app, for example, discloses sensitive health information without users’ authorization.” In its press release announcing the enforcement action, FTC foreshadowed that although the GoodRx action may be the first of its kind, it likely would not be the last, and that the FTC “will use all of its legal authority to protect American consumers’ sensitive data from misuse and illegal exploitation.”

The GoodRx enforcement action also further highlights the increased scrutiny federal and state regulators are placing on companies using and disclosing consumer health information. For example, although the FTC has not previously sought enforcement under the HBNR, the FTC has previously brought an enforcement action focused on the alleged disclosures of sensitive health data in connection with the use of common Internet tracking technologies. In addition, in September 2020, then-California Attorney General Xavier Becerra, who is now Secretary of the Department of Health and Human Services, announced a $250,000 settlement with Glow, Inc., resolving allegations that the fertility app had “expose[d] millions of women’s personal and medical information” and violated multiple laws, including California’s Confidentiality of Medical Information Act (“CMIA”). Furthermore, state legislatures have also taken an increased interest in the health privacy and have proposed legislation to protect health data. For example, Washington’s state legislature recently introduced a bill that would prevent a business’ sharing of health data without a consumer’s consent.