The Federal Trade Commission alleges GoodRx shared consumers’ personal health information with Facebook, Google and other third parties.
The Justice Department, on behalf of the FTC, filed a complaint and proposed a permanent injunction against the company on Wednesday. By order, GoodRx will be banned from sharing health information with third parties and fined $1.5 million. The order, which the digital health and consumer drug price comparison company agreed to, requires approval from the US District Court for the Northern District of California.
Not a Modern Healthcare subscriber? Sign up today.
This is the first time the FTC has implemented the 2009 Health Infringement Notification Rule, which requires companies that collect and share consumers’ health information to notify those consumers. The move will likely serve as a warning shot to other digital health companies that share personal health data with third parties.
In a statement, GoodRx said the company disagrees with the FTC’s allegations and it admits no wrongdoing. The company says participating in the settlement will help it avoid the time and expense of lengthy litigation.
According to the FTC, GoodRx allegedly aggregated lists of users buying drugs and uploaded their email addresses, phone numbers, and mobile advertising IDs to Facebook in August 2019 so their profiles could be identified. GoodRx then allegedly used that information to target these users with health-related ads on Facebook and Instagram.
Samuel Levine, director of the FTC’s office of consumer protection, said: “Digital health companies and mobile apps should not monetize extremely sensitive and identifiable health information. individual consumer. “The FTC is making an announcement that it will use all of its legal authority to protect sensitive US consumer data from misuse and illegal exploitation.”
GoodRx says the use of the Facebook Javascript tracking pixel is common in consumer, healthcare, and government websites. It indicates that the information shared is not medical information but rather the IP address and URL information of the website associated with viewing the content.
The FTC also alleges that GoodRx data shared with Google, criteria, Twilio and Branches. An FTC spokesperson said the proposed order requires third parties to receive it GoodRx data to delete it. The spokesperson did not provide details on how the agency might enforce those directives.
Download Modern Healthcare’s app to stay informed when there’s breaking industry news.
The FTC also alleges GoodRx misrepresented its compliance with the Health Insurance Portability and Accountability Act of 1996 when using remote health care communication. The company sold its backend virtual technology to Wheel Health, a provider network and virtual health platform, for $19.5 million in cash in November 2022.
In May 2022, GoodRx disclosed that it has been under investigation by the FTC since March 2020 for its data-sharing tactics with third-party service providers. In the earnings report from May, GoodRx said FTC employees informed the company in October 2021 that they intended to recommend that the agency pursue an enforcement action. At that time, GoodRx said it was sent a draft complaint in January and planned to defend itself.
A spokesperson for the FTC declined to comment on whether other digital health companies are under investigation.
These actions follow a policy statement issued by the FTC in September 2021, warning health apps must comply with the rule.
GoodRx It’s been a challenging year financially. The company said in its third-quarter earnings report in November that its total revenue fell 4% to $187.3 million from $195.1 million in the same period last year. Its prescription trading business, which is GoodRx largest source of revenue, fell 16% from $155.7 million to $131.2 million.
Over the last year, the FTC has become more involved in overseeing digital health companies. Last August, it filed a lawsuit accusing the data broker, Kochava was on sale at the time locate Data from hundreds of millions of mobile phones can be traced to abortion clinics and can identify medical professionals who performed the procedure. by Kochava Superintendent Brian Cox said in a statement that the FTC was looking forward to a settlement and described its process as “bloated” and “frivolous.” .
In June 2021, the FTC settled with Flo Health, an ovulation and menstrual cycle tracking company, after the company failed to obtain user consent before sharing personal health information. their employees with Facebook, Google and other companies.
This story first appeared in Digital Health Business & Technology.
