Privacy practices built for health data, beyond HIPAA

The FTC says Flo, GoodRx, BetterHelp, and Premom promised privacy, then shared health data with ad platforms. Five healthtech lessons on closing the gap between your policy and your practice.

Healthtech privacy class actions are surging as marketing pixels and vendor tools inadvertently share patient data. Prevent litigation with continuous site monitoring.

The U.S. government is warning telehealth firms about their use of trackers on their websites that may be illegally disclosing customers’ personal health data to third parties. In a letter sent to about 130 hospitals and telehealth providers last year, regulators stated that technologies such as Meta/Facebook pixel and Google Analytics can gather identifiable information about users without their knowledge or ability to opt out. Such trackers could collect data about health conditions, treatments and where a patient is seeking care. The letter also noted that companies not covered by HIPAA still have an obligation to protect health data users disclose on their websites.

The maker of the free Premom ovulation tracking app now has strict limits on sharing user data, following an FTC complaint that it had deceived users by sharing their personal health information with marketers without notification. The FTC alleged Easy Healthcare’s privacy policy made several false promises regarding how it would share personal data and if users could be identified through that data. Regulators claim the company failed to protect sensitive and private information, such as an individual user’s sexual and reproductive health, and their parental and pregnancy status. Easy Healthcare is now barred from sharing data for advertising, and the firm must collect consent before sharing users’ health information for any other reasons. It is also required to disclose to users how their data will be used.

The FTC has fined Cerebral $7 million and set strict limits for how the healthtech firm may use health data in marketing. Regulators allege the company improperly shared its customers’ personal health information to external parties for advertising. According to the FTC, Cerebral sent medical histories, insurance information and prescription data, among other personal information, to third parties that used the information for ads and analytics. In 2023, Cerebral had self-reported a health data breach that affected more than 3 million users. In what the FTC said is a “first-of-its-kind prohibition,” Cerebral is now banned from using any health information for most advertising purposes, and it must get consent for any instances when it does disclose health information. It was also required to post a notice about this penalty on its website and the steps it is taking to remediate the issue.