The Federal Trade Commission has taken its first enforcement action under its Health Breach Notification Rule, The action, filed against the telehealth and prescription drug discount provider GoodRx Holdings Inc., alleges that the company failed to notify consumers and others of its unauthorized disclosures of consumers’ personal health information to Facebook, Google, and other companies. Under a proposed order, GoodRx will be prohibited from sharing user health data with applicable third parties for advertising purposes, and has agreed to pay a $1.5 million civil penalty for violating the rule. The proposed order must be approved by the federal court to go into effect. The FTC’s press release, with links to the the rule, complaint, and the proposed order, is here.
Federal Trade Commission, Privacy
First FTC enforcement action under Health Breach Notification Rule
