FTC FINES GOODRX FOR UNAUTHORIZED SHARING OF HEALTH DATA

In a first-of-its-kind enforcement, the Federal Trade Commission has imposed a $1.5 million penalty on telehealth and prescription drug discount provider GoodRx Holdings Inc. for sharing users’ personal health data with Facebook, Google and other third parties without their consent.

Under a settlement, California-based GoodRx also accepted that it will be prohibited going forward from sharing user health data with third parties for advertising purposes, the FTC said. GoodRx admitted no wrongdoing and said in a blog post that it settled “to avoid the time and expense of protracted litigation.” The agreement is pending federal court approval.

Consumer protection advocates hailed Wednesday’s announcement as a potential game-changer that could seriously curtail a little-known phenomenon: The trafficking in sensitive health data by businesses not strictly classified as healthcare providers.

“Digital health companies and mobile apps should not cash in on consumers’ extremely sensitive and personally identifiable health information,” Samuel Levine, head of the FTC’s Bureau of Consumer Protection, said in a statement. “The FTC is serving notice that it will use all of its legal authority to protect American consumers’ sensitive data from misuse and illegal exploitation.”

The enforcement is the first under a 2009 law, the Health Breach Notification Rule, which applies to personal health record vendors and related providers not covered by HIPAA, the federal privacy rules that govern the healthcare industry,