Health Tech: $11M for Answers(Now)

Yesterday’s crackdown GoodRx highlights the FTC’s growing efforts under Activist Chair Lina Khan to protect consumers’ digital health privacy from federal regulators.

Why it matters: The proposed order could have broad implications for the health technology sector, where ad-targeting practices — especially among direct-to-consumer businesses — are nearly ubiquitous.

Quick catch: The order marks two firsts for the FTC:

1. Its first use of the Health Breach Notification Rule, which requires health apps to notify users of a breach of their data.
2. It is the first time such an order has sought to expressly prohibit a company from using consumer health data for ad-targeting.

Context: Startups and big tech companies collect personal data on fertility, exercise, health conditions and prescriptions that aren’t as expressly protected as other data covered by HIPAA.

Expand: Specifically, the FTC’s complaint alleges that GoodRx shared personally identifiable data on users’ prescription drugs and health conditions with Google and Facebook.

• The complaint also alleges that GoodRx targeted users of its telemedicine service, HeyDoctor, who searched online about STDs with advertisements for STD testing services.
• The complaint characterized such practices as fraudulent and unauthorized, something that could have wide-ranging implications for a sector where such practices are common.

Yes but: GoodRX agreed to settle the lawsuit Wednesday but said it disagreed with the agency’s allegations and admitted no wrongdoing.

Flashback: While the FTC has stepped up its actions in recent years with similar actions against health tech companies, the GoodRx order goes further than previous cases aimed at prohibiting the company from future ad-targeting.

• In 2021, for example, the FTC found fertility tracking app developer Flow had shared menstrual cycle and pregnancy data with Google and Facebook, and although Flow agreed as part of a settlement to obtain user consent before sharing such information, it expressly excluded such data. Not blocked. behavior

Other end: In a statement issued alongside the court order, FTC Commissioner Christine S. Wilson said the settlement falls short in that it “does not hold senior executives accountable and does not change the core GoodRX business model.”

• “I would have supported a larger civil penalty,” Wilson wrote, noting the company’s previous market value of $18 billion and adding, “I believe the company has profited significantly from silence about its unreasonable privacy practices — far more than a $1.5 million fine.”