The Federal Trade Commission (FTC) goes to ‘bare knucks’. BetterHelp, Teladoc’s promising telemental business, settled a complaint brought by the FTC in a 4-0 vote over ad trackers and sharing consumer health data with third parties. The ad trackers shared data with Facebook, Criteo, Pinterest, and Snapchat for ad retargeting to these customers, knowing their situation. While the $7.8 million fine has to be approved by a Federal judge (as does GoodRx’s), the $7.8 million will be returned to consumers whose data was shared. How this will be done is a question mark to this Editor, but the tracking was done from 2013 (prior to Teladoc’s buy in 2015) to 2021, so quite a few will be eligible. According to the complaint, BetterHelp made false and deceptive statements to users about the disclosure of their information and formally “disseminated, or caused to be disseminated, misleading and deceptive representations regarding its compliance with federal health privacy laws.”
BetterHelp did not disclose to users that it was sharing personal information with third parties and never obtained consent. In fact, they assured users on intake that their information would be private, between them and their therapist. BetterHelp did not offer disclosure of information sharing and an opt-out form until October 2021. The information shared was extensive:
- Intake questionnaire answers, such as whether the user was experiencing suicidal thoughts, and if they belonged to a group such as LGBTQ, teens, or Christians
- Prior therapy history if any
- Email addresses and IP addresses
- Financial status
The decisions on sharing information were delegated to a junior marketing analyst without training in PHI and protecting privacy from 2017. There was no formal compliance review or employee training in HIPAA practices. BetterHelp also displayed various logos, including HIPAA, to assure users that their information adhered to governmental standards and practices for health, when it clearly did not. (Editor’s note: as a marketer, both are shocking with Teladoc as a parent company well aware of these issues.)
Why this is important: Ad tracking is a form of revenue for companies, which now will be effectively shut off. This presents a decline in revenue hopes for Teladoc, which in January positioned BetterHelp as a bright spot of ‘balanced growth’. Expect that BetterHelp will be only the first of these companies in telemental health counseling to receive a working over from a newly-aggressive FTC–and with a return to in-person visits required for Schedule 2 meds, further depressing the entire category. Complaint, Healthcare Dive, Mobihealthnews
FTC’s shot across the bow to Amazon and everyone in DTC digital health. With Amazon closing the buy of One Medical, the FTC issued a 1 1/2 page public statement warning both companies that because of privacy representations they have made prior to and after the acquisition, any failure to maintain consumer privacy will be in violation of Section 5 of the FTC Act. FTC will be looking at ‘false net impressions’ and “make clear not only how they will use protected health information as defined by HIPAA but also how the integrated entity will use any One Medical patient data for purposes beyond the provision of health care. ” And in closing, a broader warning:
The Commission has long taken the position that personal health information is sensitive data and has reaffirmed this position through recent enforcement actions. Further, companies that fail to have adequate safeguards or controls in place to protect sensitive data or fail to obtain consumers’ express affirmative consent for marketing based on sensitive data such as health data may be in violation of the law.
The law requires companies to treat sensitive data with great care. Accordingly, the parties and the market more broadly should be on notice that the Commission will continue to monitor this space and bring enforcement actions whenever the facts warrant.