Lexology March 14, 2023
On February 1, the Federal Trade Commission (FTC) reached a settlement with digital health platform GoodRx for sharing users’ personal health information (PHI) with third parties without properly disclosing its data practices or obtaining users’ affirmative consent, as well as for failing to maintain adequate policies or procedures to protect users’ PHI. This is the FTC’s first-ever enforcement action under the Health Breach Notification Rule, which requires vendors of personal health records (PHRs) and certain PHR-related entities to notify consumers, the FTC and sometimes the media about discovery of certain data breaches.
The FTC’s Complaint
GoodRx operates a telemedicine platform and a mobile app that track prescription drug prices in the United States and provide drug coupons for discounts on...
Today's Sponsors
Today's Sponsor