FTC Enforcement Towards Sharing Client Well being Data Continues

On March 2, 2023, the Federal Commerce Fee (“FTC”) introduced an enforcement motion in opposition to California-based on-line counseling service BetterHelp, Inc. (“BetterHelp”) for allegedly sharing customers’ well being data, together with delicate details about psychological well being challenges, for promoting functions in violation of Part 5 of the FTC Act.

This newest enforcement motion comes only one month after the FTC introduced an enforcement motion in opposition to GoodRx for allegedly violating Part 5 of the FTC Act and the Well being Breach Notification Rule (“HBNR”). The place the GoodRx enforcement motion marked the primary time the FTC enforced the HBNR, the BetterHelp enforcement motion equally units a brand new precedent for the FTC: That is the primary FTC enforcement motion returning funds to customers whose well being data was compromised by BetterHelp’s alleged misdeeds. The proposed order (“Proposed Order”) additionally units out intensive necessities to ban BetterHelp from disclosing well being data for promoting and misrepresenting its data sharing practices. The GoodRx and BetterHelp enforcement actions look like half of a bigger effort by the FTC to watch the practices of internet sites, apps, and linked gadgets that seize client’s delicate well being data.

The Criticism

In keeping with the Criticism, BetterHelp presents on-line counseling companies by matching customers with BetterHelp therapists and facilitating counseling by way of BetterHelp’s numerous web sites and apps. BetterHelp additionally presents specialised variations of its counseling companies for folks of the Christian religion, members of the LGBTQ neighborhood, and youngsters. To join BetterHelp’s companies, customers should fill out a questionnaire that asks delicate psychological well being questions, reminiscent of whether or not they have skilled despair or suicidal ideas, have beforehand been in counseling, or take any medicines. Customers additionally present their identify, electronic mail handle, beginning date, and different private data. In its press launch on the enforcement motion, FTC suggests that buyers are “pushed’ to offer this data by “repeatedly displaying them privateness misrepresentations and nudging them with unavoidable prompts to join its counseling service.” Customers are then matched with a BetterHelp counselor and pay between $60 and $90 per week for counseling.

The Criticism alleges that in recognition of the quantity of delicate well being data customers present, BetterHelp “repeatedly promised” to maintain this data “personal and use it just for non-advertising functions reminiscent of to facilitate customers’ remedy.” Nevertheless, over a interval of seven years from 2013 by means of 2020, BetterHelp purportedly “frequently broke these privateness guarantees, monetizing customers’ well being data to focus on them and others with ads” for BetterHelp’s companies. For instance, BetterHelp allegedly shared its customers’ electronic mail addresses and the actual fact they had been in counseling with Fb, which in flip recognized related customers and focused them with BetterHelp ads. BetterHelp additionally allegedly shared its customers’ data with different third-party promoting platforms, reminiscent of Pinterest, Snapchat, and Criteo. These promoting efforts reportedly introduced in “tens of hundreds of latest paying customers, and tens of millions of {dollars} in income” to BetterHelp. BetterHelp additionally allowed these third-party firms to make use of BetterHelp customers’ data for their very own analysis and product growth, additional proof that BetterHelp did not contractually restrict how third events may use customers’ well being data.

The Criticism additionally alleges that BetterHelp “did not make use of affordable measures to safeguard the well being data it collected from customers.” BetterHelp is accused of not coaching its staff on how one can correctly defend consumer data when utilizing it for promoting functions and never overseeing its employees’s use of consumer data.

The Proposed Order

The Proposed Order imposes a $7.8 million nice on BetterHelp, to be paid right into a fund, to refund customers who signed up and paid for BetterHelp’s counseling companies between August 1, 2017, and December 31, 2020. The FTC stories that that is the primary enforcement motion searching for to return funds to customers whose well being data was compromised. Along with the financial penalty, the Proposed Order prohibits BetterHelp from sharing customers’ “individually identifiable data referring to the previous, current, or future bodily or psychological well being or situation(s)” with third-parties for promoting or re-targeting earlier customers. Additional, the Proposed Order requires BetterHelp to:

• Acquire customers’ affirmative categorical consent earlier than disclosing private data to third-parties for any function;
• Set up, implement, and preserve a complete privateness program that features sturdy safeguards to guard client data;
• Direct third events to delete the patron well being data and different private data that BetterHelp revealed to them; and
• Restrict how lengthy BetterHelp retains private and well being data in accordance to a knowledge retention schedule. 

Takeaways

Digital well being firms and different firms that function web sites, apps, or linked gadgets that seize client’s delicate well being data ought to take heed of the FTC’s enforcement actions in opposition to each BetterHelp and GoodRx. As evidenced by the BetterHelp enforcement motion, firms should safeguard consumer data and never endeavor to leverage this data for promoting alternatives in violation of guarantees made to customers. The BetterHelp enforcement motion additionally underscores the necessity for applicable consumer notification mechanisms to acquire consumer consent earlier than disclosing their data to 3rd events. Additional, firms ought to recall from the GoodRx enforcement motion that even firms that aren’t topic to the necessities of the Well being Insurance coverage Portability and Accountability Act may nonetheless be topic to the HBNR. Whereas the FTC didn’t allege violations of the HBNR by BetterHelp, additional enforcement motion may nonetheless be looming.

The BetterHelp enforcement motion is very noteworthy as it’s the first time the FTC has endeavored to redress client accidents for these whose delicate well being data was inappropriately used and disclosed. That is the FTC’s second “first” within the space of well being data enforcement within the span of only one month, so firms must be looking out for extra to return.

For extra data or recommendation concerning this enforcement motion or information privateness points generally, please contact the skilled(s) listed beneath or your common Crowell & Moring contact.