Electronic Health Records Company Settles FTC Charges It Deceived Consumers About Privacy of Doctor Reviews

Practice Fusion, a cloud-based electronic health record company, has agreed to settle Federal Trade Commission charges it misled consumers by soliciting reviews for their doctors, without disclosing adequately that these reviews would be publicly posted on the Internet resulting in the public disclosure of patients’ sensitive personal and medical information.

The settlement with the FTC will prohibit Practice Fusion from making deceptive statements about the privacy or confidentiality of the information it collects from consumers, and will also require the company, prior to making any consumers’ information publicly available, to clearly and conspicuously disclose this fact and obtain consumers’ affirmative consent.

“Practice Fusion’s actions led consumers to share incredibly sensitive health information without realizing it would be made public,” said Jessica Rich, Director of the FTC’s Bureau of Consumer Protection. “Companies that collect personal health information must be clear about how they will use it – especially before posting such information publicly on the Internet.”

According to the complaint, Practice Fusion made plans to launch a public-facing healthcare provider directory in 2013. In order to be able to populate the directory with patient reviews, Practice Fusion began sending emails in April 2012 to patients of healthcare providers utilizing Practice Fusion’s electronic health records service. The emails appeared to be sent on behalf of the patients’ doctors, and asked consumers to rate their provider “[t]o help improve your service in the future.”

According to the complaint, consumers who clicked on the five-star rating image in the e-mail were taken to an online survey form with questions about their recent medical visit. The survey included a text box where patients could enter any information they wished within a set character limit. Because patients likely thought the information was only shared with their provider, many of them included in the text box their full name or phone number along with personal health information inquiries. For instance:

• one consumer asked for information on dosing for “my Xanax prescription”;
• one consumer included a request for help with a depressed child, writing “I think she is depressed and has stated several times this week that she wishes she was dead”; and
• one consumer wrote that “I did a little research and I think I have a yeast infection called candida.”

In its complaint, the FTC cites these examples of patient information that then appeared in reviews publicly posted by Practice Fusion.

Under the terms of the proposed settlement, Practice Fusion will be prohibited from misrepresenting the extent to which it uses, maintains and protects the privacy or confidentiality of data it collects. The company must also, prior to making consumers’ information publicly available, clearly and conspicuously disclose – separate and apart from a privacy policy, terms of use or other similar document – that it is making such information publicly available and obtain consumers’ affirmative consent. The settlement also prohibits Practice Fusion from publicly displaying the reviews it collected from consumers during the time period covered by the complaint.

The Commission vote to issue the administrative complaint and to accept the consent agreement was 3-0. The FTC will publish a description of the consent agreement package in the Federal Register shortly. The agreement will be subject to public comment for 30 days, beginning today and continuing through July 8, 2016, after which the Commission will decide whether to make the proposed consent order final. Interested parties can submit comments electronically.

NOTE: The Commission issues an administrative complaint when it has “reason to believe” that the law has been or is being violated, and it appears to the Commission that a proceeding is in the public interest. When the Commission issues a consent order on a final basis, it carries the force of law with respect to future actions. Each violation of such an order may result in a civil penalty of up to $16,000.

The Federal Trade Commission works to promote competition, and protect and educate consumers. You can learn more about consumer topics and file a consumer complaint online or by calling 1-877-FTC-HELP (382-4357).  Like the FTC on Facebook, follow us on Twitter, read our blogs and subscribe to press releases for the latest FTC news and resources.