FTC Takes First-Ever HBNR Enforcement Action Against GoodRx for Sharing Sensitive Health Data

What this means for your practice

This enforcement action by the FTC against GoodRx serves as a critical warning for all telehealth providers, digital health platforms, medspas, dental practices, chiropractic offices, and any healthcare business operating online. The FTC is actively monitoring how sensitive consumer health data is handled, shared, and monetized. Practices must rigorously ensure their privacy policies accurately reflect *all* data sharing practices, obtain explicit and informed consent for any data use beyond direct patient care, and implement robust internal policies and procedures to protect personal health information. Misrepresenting HIPAA compliance or failing to comply with the Health Breach Notification Rule (HBNR) can lead to substantial penalties, mandatory operational changes, and severe reputational damage. This case highlights the necessity for transparency, strong data governance, and strict adherence to privacy regulations, especially when integrating with advertising or analytics platforms.

WASHINGTON, D.C. – The Federal Trade Commission (FTC) has announced a significant enforcement action, marking its first application of the Health Breach Notification Rule (HBNR), against GoodRx Holdings Inc. This action targets the digital health platform for alleged unauthorized disclosure of consumers’ personal health information to various third-party advertising entities.

Core Allegations and Violations

According to the FTC’s complaint, GoodRx, a platform offering prescription drug discounts, telehealth visits, and other health services, engaged in several deceptive and unfair practices. Since at least January 2017, the company collected extensive personal and health information from its over 55 million users. Despite promising users that it would never share personal health information with advertisers or other third parties, the FTC alleges GoodRx repeatedly violated this promise. Specific violations outlined by the FTC include:

• Unauthorized Sharing of Personal Health Information: GoodRx allegedly shared sensitive personal health information, including users’ prescription medications and personal health conditions, with third-party advertising companies and platforms such as Facebook, Google, Criteo, Branch, and Twilio.
• Targeted Advertising Using Health Data: The company purportedly monetized users’ personal health information by using data shared with Facebook to target GoodRx’s own users with personalized health- and medication-specific advertisements on Facebook and Instagram. This involved compiling lists of users who purchased particular medications and uploading their identifiable information to Facebook for ad targeting.
• Failure to Limit Third-Party Data Use: GoodRx is accused of allowing third parties to use the shared data for their own internal purposes, including research, development, or improving advertising, without adequate restrictions.
• Misrepresentation of HIPAA Compliance: GoodRx allegedly displayed a seal on its telehealth services homepage falsely suggesting compliance with the Health Insurance Portability and Accountability Act of 1996 (HIPAA), a law that sets forth privacy and information security protections for health data, despite its practices.
• Lack of Sufficient Data Protection Policies: Until publicly revealed in February 2020, GoodRx reportedly lacked formal, written, or standard privacy or data sharing policies or compliance programs to protect its users’ personal health information.

Health Breach Notification Rule Enforcement

The FTC’s complaint asserts that GoodRx, as a vendor of personal health records, is subject to the Health Breach Notification Rule. GoodRx’s services, which allow users to track their prescriptions, refills, pricing, and medication purchase history, fall under the scope of this rule. The company allegedly violated the HBNR by failing to notify consumers, the FTC, and, in some cases, the media, of its unauthorized disclosures of personal health information.

Proposed Order and Penalties

To address these charges, a proposed order, filed by the Department of Justice on behalf of the FTC, stipulates that GoodRx will:

• Pay a Civil Penalty: GoodRx will pay a $1.5 million civil penalty for violating the Health Breach Notification Rule.
• Prohibition on Data Sharing: The company will be permanently prohibited from sharing user health data with applicable third parties for advertising purposes.
• Compliance Requirements: The order mandates specific compliance measures to ensure the protection of consumer health information moving forward.

This proposed order awaits approval by a federal court to go into effect. Samuel Levine, Director of the FTC’s Bureau of Consumer Protection, emphasized the agency’s stance, stating, “Digital health companies and mobile apps should not cash in on consumers' extremely sensitive and personally identifiable health information. The FTC is serving notice that it will use all of its legal authority to protect American consumers’ sensitive data from misuse and illegal exploitation.”

Broader Implications for the Healthcare Industry

This landmark enforcement action signals a heightened regulatory focus on data privacy within the digital health sector. Healthcare businesses, particularly those leveraging telehealth platforms or engaging in online marketing, must meticulously review their data collection, sharing, and consent practices. Transparency with consumers regarding data usage is paramount, as is ensuring that all privacy promises are accurately upheld. The FTC’s willingness to use its HBNR authority underscores the critical importance of safeguarding sensitive health information against unauthorized disclosure and misuse.

Key Facts

| Detail | Value | |---|---| | Enforcement Agency | Federal Trade Commission (FTC) | | Affected Entity | GoodRx Holdings Inc. | | Rule Violated | FTC Act, Health Breach Notification Rule (HBNR) | | Penalty | $1.5 million civil penalty | | Key Prohibition | Barred from sharing user health data with third parties for advertising purposes | | Significance | First-ever FTC enforcement action under the Health Breach Notification Rule |

Frequently Asked Questions

What is the primary allegation against GoodRx?

GoodRx is accused of failing to notify consumers and others about unauthorized disclosures of their personal health information to advertising companies, violating its privacy promises.

Which specific rules did GoodRx allegedly violate?

GoodRx allegedly violated the FTC Act and the Health Breach Notification Rule (HBNR).

What types of consumer health information did GoodRx allegedly share?

GoodRx allegedly shared sensitive personal health information, including users' prescription medications, personal health conditions, email addresses, phone numbers, and mobile advertising IDs.

What are the key components of the proposed order against GoodRx?

GoodRx will pay a $1.5 million civil penalty and be prohibited from sharing user health data with third parties for advertising purposes.

Why is this enforcement action particularly significant for the FTC?

This is the first enforcement action taken by the FTC under its Health Breach Notification Rule, signaling a stronger focus on digital health data privacy.

Source: ftc.gov — FTC Approves Final Order Against NextMed for Deceptive Telehealth Practices