Providers of Consumers Medical Profiles Agree to Comply with Fair Credit Reporting Act

Two providers of consumers’ medical profiles used in determining eligibility for life and health insurance have agreed to settle Federal Trade Commission charges that, as consumer reporting agencies (CRAs), they failed to provide insurance companies with the Notice to Users of Consumer Reports required by the Fair Credit Reporting Act (FCRA).

“Consumer reporting companies sell information that can play a critical role in the price consumers pay for a variety of products and services – or even whether they're eligible for them,” said Lydia Parnes, Director of the FTC’s Bureau of Consumer Protection. “These cases make clear that all consumer reporting companies must comply with the laws that protect consumers’ rights.”

The proposed respondents, Ingenix, Inc. and Milliman, Inc., provide individual medical profiles, including prescription drug purchase histories of insurance policy applicants, to insurance companies that use them in making underwriting decisions. With applicants’ consent, Ingenix and Milliman obtain five-year prescription drug histories from Pharmacy Benefit Mangers and create prescription medical profiles. Based on their analysis of the information, they report potential medical conditions that may be present.

According to the Commission, the medical profiles are consumer reports because they include information that bears on an individual’s personal characteristics and are used to determine their eligibility for insurance. Ingenix and Milliman are CRAs because they assemble and evaluate consumer report information for the purpose of furnishing it to third parties.

The FTC’s complaint alleges that the proposed respondents failed to provide to the users of the consumer reports the “Notice to Users of Consumer Reports: Obligations of Users Under the FCRA”(“Notice to Users”), which describes their FCRA responsibilities and obligations, including, but not limited to, notifying consumers if adverse action is taken, based in whole or in part, on information contained in the consumer report.

Under the proposed consent agreements, Ingenix and Milliman will provide to users of their consumer reports the Notice to Users and continue to follow procedures that ensure that consumer reports are furnished only to those with a permissible purpose, that reports are accurate, that accuracy disputes are handled appropriately, and that consumer records are disposed of properly, all in compliance with the FCRA.

The Commission votes approving the complaints and consent orders were 5-0. The orders will be subject to public comment for 30 days, until October 12, after which the Commission will decide whether to make them final. Comments should be sent to: FTC, Office of the Secretary, 600 Pennsylvania Ave., N.W., Washington, DC 20580.

NOTE: A consent agreement is for settlement purposes only and does not constitute an admission of a law violation. When the Commission issues a consent order on a final basis, it carries the force of law with respect to future actions. Each violation of such an order may result in a civil penalty of $11,000.

Copies of the complaint, consent order, and analysis to aid public comment are available now on the FTC’s Web site. The FTC works for the consumer to prevent fraudulent, deceptive, and unfair business practices and to provide information to help spot, stop, and avoid them. To file a complaint in English or Spanish, click http://www.ftc.gov/ftc/complaint.shtm or call 1-877-382-4357. The FTC enters Internet, telemarketing, identity theft, and other fraud-related complaints into Consumer Sentinel, a secure, online database available to more than 1,600 civil and criminal law enforcement agencies in the U.S. and abroad. For free information on a variety of consumer topics, click http://ftc.gov/bcp/consumer.shtm.