First FTC Health Breach Notification Rule case addresses GoodRx’s not-so-good privacy practices

The company name may be GoodRx, but it’s unlikely that “good” is the adjective consumers would use to describe the way the company violated its privacy promises by disclosing their personal health information to companies like Facebook and Google without authorization. How did GoodRx accomplish that? By using automatic “plug and play” tracking pixels and software development kits (SDKs) from Facebook, Google, and other companies that are designed to grab a substantial amount of consumer data and turn it over for advertising purposes. In the case of GoodRx, this included consumers’ personal and health information.

To settle the FTC’s first action alleging a violation of the Health Breach Notification Rule, GoodRx will pay a $1.5 million civil penalty. But there’s another first-of-its-kind provision in the proposed settlement sure to generate water cooler talk among app developers, privacy professionals, and others in the burgeoning health technology industry. Read on for details.

GoodRx runs a digital health platform where consumers can compare prescription drug prices and get prescription drug coupons. It also offers a paid monthly subscription service, GoodRx Gold, which claims to offer greater discounts and virtual telehealth visits through a product called GoodRx Care. GoodRx collects a substantial amount of personal data – including highly sensitive health information – from consumers and from pharmacy benefit managers, which are companies that manage prescription drug benefits, confirming when someone uses a GoodRx coupon to get a prescription.

Although the specific language has changed over the years, GoodRx has made numerous privacy promises to consumers. For example, in describing its use of third-party tracking tools, GoodRx assured people, “[W]e never provide advertisers or any other third parties any information that reveals a personal health condition or personal health information.” GoodRx also promised users that it “rarely shares” personal health information with third parties, and when it does, it “ensures that these third parties are bound to comply with federal standards as to how to treat ‘medical data’ that is linked with your name, contact information and other personal identifiers.” In addition, GoodRx stated it would share users’ personal  information only for certain limited administrative functions – for example, “to provide services directly to users,” “to comply with the law or legal process,” “to act in an emergency to protect someone’s safety,” or “to handle customer requests.”

To use a phrase we’ve had to repeat with troubling frequency in recent blog posts, that’s what the company promised, but the FTC says what GoodRx was doing behind the scenes contradicted those soothing assurances. According to the complaint, beginning in at least 2017, GoodRx broke its privacy promises by sharing information about users’ prescription meds, health conditions, and personal information – like contact information and personal identifiers – with some of the biggest names in digital advertising.

You’ll want to read the complaint for details about how the FTC says GoodRx broke its privacy promises, but here’s the shorthand version. In building its website and mobile app, GoodRx incorporated third-party trackers from companies like Facebook, Google, and Criteo, typically in the form of SDKs or automated web beacons called tracking pixels. Despite what GoodRx had told consumers, the trackers sent their information back to those businesses for marketing and other purposes.

For example, GoodRx configured a Google tracking pixel on its website and an SDK on its app to share with Google information that included the name of the drug for which a user had received a coupon, the health condition the drug treats, and the user’s phone number, email, zip code, and IP address. In addition, the Google Android and iOS SDKs shared users’ latitude and longitude coordinates and unique advertising IDs, which can be used to target individuals with ads.

The FTC says GoodRx configured a Facebook pixel on certain of its sites to send Facebook the same kind of information – and even more. According to the complaint, GoodRx was able to identify customers who had Facebook and Instagram accounts and then used their personal and health information to target them with ads on that platform. For example, people who accessed GoodRx coupons for, say, Viagra, would see ads for erectile dysfunction medication on their Facebook or Instagram page ads. Similarly, people who had used GoodRx’s telehealth services to get treatment for sexually transmitted diseases would get ads for STD testing services. In some cases, GoodRx disclosed to Facebook the medication purchase data it receives from pharmacy benefit managers, and also used the data to target ads.

Image

What was the real-world impact of GoodRx’s practices? By using Facebook’s ad targeting platform, GoodRx designed campaigns that targeted customers with ads based on their health information. For example, if a customer had revealed a possible erectile dysfunction issue to GoodRx, they might have seen an ad on Facebook like Exhibit A in the FTC complaint.

The complaint charges GoodRx with violating Section 5 of the FTC Act and the Health Breach Notification Rule. According to the lawsuit, GoodRx violated Section 5 by – among other things – telling consumers it wouldn’t disclose personal health information to advertisers or other third parties when the company went ahead and did just that. The FTC says GoodRx’s promise that it would disclose users’ personal information only for limited purposes was also false or deceptive because GoodRx disclosed users’ names, addresses, email addresses, phone numbers, and other personal identifiers to advertisers for marketing purposes. The complaint also alleges that GoodRx deceptively promised that it would limit how third parties that received personal health information could use that information, but failed to do so. As a result, companies like Facebook, Google, and Criteo had free rein to do what they wanted with the information for their own business purposes, including for advertising.

In addition, the FTC alleges that GoodRx’s failure to prevent the unauthorized disclosure of health information was an unfair practice, as was its failure to get consumers’ consent before using and disclosing health information for advertising purposes.

The complaint also charges that GoodRx is a “vendor of personal health records “subject to the Health Breach Notification Rule. Consumers can use the company’s services to keep track of their health information, including details about their prescription drug history. The FTC says GoodRx violated the Rule by failing to notify customers, the FTC, and the media about the company’s unauthorized disclosure of personally identifiable health information to Facebook, Google, Criteo, and other companies.

In addition to a $1.5 million civil penalty for the Rule violation, the proposed order includes a remedy seen for the first time in an FTC case. Simply put, the order imposes a flat-out prohibition on GoodRx sharing user health data with applicable third parties for advertising purposes. It’s a novel remedy, but one the FTC believes is crafted to protect consumers in the future from similar illegal conduct. What’s more, GoodRx must get users’ consent before sharing their health data with applicable third parties for any other purpose, and must notify consumers of its unauthorized sharing with Facebook and others.

What can your company take from the law enforcement action against GoodRx?

Tell the truth about how you intend to use customers’ health data. Be transparent about your practices, provide a proper just-in-time explanation, and get consumers’ express affirmative consent before collecting, using, or sharing health information. But promises aren’t enough. Companies should have a program in place to ensure their practices live up to those promises. 

If sensitive health data is part of your business, understand that you’ve upped the ante on ensuring its security and privacy. Like a truck hauling flammable material on the highway, companies that collect sensitive consumer data should exercise particular caution. That includes maintaining and implementing appropriate policies to protect that information from unauthorized disclosure, collecting only data for which you have a legitimate business need, training your staff to handle it with care when it’s in your possession, and disposing of it securely when you no longer have a good reason to maintain it. 

Set contractual boundaries on how third parties use information obtained from your company. Consider adding provisions in contracts with third parties that touch on how data is shared. It might be tempting to gloss over what seem like “click through” agreements. But the wiser course of business is to harmonize all agreements about consumer data you reach with other companies with the privacy promises you’ve made to consumers and your actual practices. In addition, have service provider agreements in place that contractually limit how those providers can use consumer data.

Monitor the data flow to all third parties your site or app may be connected to via an SDK or other interface. Ad tech tools can be easy to use and integrate into and app or website – perhaps as simple as toggling a button – but they also can grease the wheels for the disclosure of highly sensitive information. In fact, the companies behind those tools often profit from collecting as much user data as possible for the purpose of targeted advertising. It’s your responsibility to make sure people understand up front how you to intend to use their personal information, and even then, don’t use ad tech tools unless you understand exactly how they work and are prepared to configure them appropriately. Give app events anonymous names that don’t convey sensitive information. And never violate your own privacy promises.

Are you covered by the Health Breach Notification Rule? Consider this a clarion call for compliance. The FTC’s Health Privacy site is a good place to start. Consult Complying with FTC’s Health Breach Notification Rule for the fundamentals. Next on your reading list: the 2021 Statement of the Commission on Breaches by Health Apps and Other Connected Devices. Don’t miss this key sentence:

[T]he Commission reminds entities offering services covered by the Rule that a “breach” is not limited to cybersecurity intrusions or nefarious behavior. Incidents of unauthorized access, including sharing of covered information without an individual’s authorization, triggers notification obligations under the Rule.