BetterHelp

Protecting the privacy of health information: A baker’s dozen takeaways from FTC cases

• In the past few months, the FTC has announced case after case involving consumers’ sensitive health data, alleging violations of both Section 5 of the FTC Act and the FTC’s Health Breach Notification Rule.
• The privacy of health information is top of mind for consumers – and so it’s top of mind for the FTC.

Health Privacy: The Basics

• Rather, it’s anything that conveys information – or enables an inference – about a consumer’s health.
• Indeed, Premom, BetterHelp, GoodRx, and Flo Health make clear that the fact that a consumer is using a particular health-related app or website – one related to mental health or fertility, for example – or how they interact with that app (say, turning “pregnancy mode” on or off) may itself be health information.
• Our guidance on health and location highlights the fact that location data can convey health information.
• For example, repeated trips to a cancer treatment facility may convey highly sensitive information about an individual’s health.
• To stay on the right side of the FTC Act, take a broad view of what constitutes health data and protect it accordingly.
• Your obligation to protect the privacy of health information is a given.  The need for privacy-by-design is (or should be!)

HIPAA-related claims

• “HIPAA Compliant,” “HIPAA Secure,” and similar claims may deceive consumers.  Compliance with HIPAA, the national law protecting the privacy of certain health information, has become a shorthand among patients and providers alike for health privacy protection.
• Not surprisingly, companies offering health-related products and services often want to tout HIPAA compliance to give consumers comfort – even if these companies aren’t actually covered by HIPAA or aren’t actually complying with HIPAA.
• FTC enforcement actions like GoodRx, BetterHelp, Henry Schein, and SkyMed make clear that HIPAA claims like that may deceive consumers, whether those consumers are health care providers (like the dentists in Henry Schein) or regular people (like the therapy patients in BetterHelp).
• In ECM, the FTC proved in court that a company that gave its business customers labels and certificates bearing false claims about biodegradability had provided “the means and instrumentalities” to deceive downstream consumers.

Other Health Privacy Practices

•  It may be tempting to use your privacy policy to reserve the right to change your health data practices, so that any continued use of your service constitutes “consent” to the changes.
• The FTC’s action in Vitagene makes clear that’s not a lawful means for obtaining consent for material retroactive privacy policy changes.
• Hidden euphemisms don’t cut it.  Rather than living up to their legal obligation to tell consumers the whole truth, some companies hide key terms about data practices in dense privacy policies or terms of service filled with ambiguous language that cloaks how they really use consumers’ health information.
• The orders in our recent health privacy cases uniformly require affirmative express consent – consent that can be obtained only following a clear and conspicuous disclosure of all material facts.

Health privacy: A top priority for the FTC – and for your company

• These tracking technologies gather identifiable information about users, usually without their knowledge and in ways that are hard for users to avoid, as users interact with a website or mobile app.
• In their letter, both agencies reiterated the risks posed by the unauthorized disclosure of an individual’s personal health information to third parties.
• The unauthorized disclosure of such information may violate the FTC Act and could constitute a breach of security under the FTC’s Health Breach Notification Rule.
• Follow the FTC on social media, read consumer alerts and the business blog, and sign up to get the latest FTC news and alerts.

• The Federal Trade Commission finalized an order requiring online counseling service BetterHelp to pay $7.8 million and prohibiting it from sharing consumers’ health data for advertising, resolving allegations the firm shared consumers’ sensitive health data with third parties such as Facebook and Snapchat for advertising after promising to keep such data private.
• The $7.8 million that BetterHelp is paying as part of the order will be used to provide partial refunds to consumers.
• In addition to the prohibition on disclosing health data for advertising, the order, among other things, also bans BetterHelp from sharing consumers’ personal information for re-targeting.
• Follow the FTC on social media, read consumer alerts and the business blog, and sign up to get the latest FTC news and alerts.

FTC says online counseling service BetterHelp pushed people into handing over health information – and broke its privacy promises