On Might 17, 2023, the Federal Commerce Fee (“FTC”) an enforcement motion (“Enforcement Motion”) in opposition to Illinois-based Straightforward Healthcare Company (“Straightforward Healthcare”), which operates the Premom utility, for allegedly violating Part 5 of the FTC Act and the Well being Breach Notification Rule (“HBNR”). Straightforward Healthcare has developed, marketed, and distributed a cell utility known as the Premom Ovulation Tracker (“Premom”) that permits customers to enter and monitor varied sorts of private and well being data. Within the grievance (“Criticism”), the FTC alleges that Straightforward Healthcare deceived customers by disclosing customers’ delicate well being knowledge with third events and didn’t notify shoppers of those unauthorized disclosures in violation of the HBNR. The proposed order (“Proposed Order”), which was introduced by the U.S. Division of Justice on behalf of the FTC, imposes a civil penalty of $100,000 and prohibits Straightforward Healthcare from sharing person private well being knowledge with third events for promoting, amongst different necessities. As a part of a associated motion, Straightforward Healthcare has agreed to pay a further $100,000 to , the , and Oregon for violating their respective legal guidelines.

The most recent enforcement motion in opposition to Premom follows current FTC actions in opposition to for violating Part 5 of the FTC Act and the HBNR and for violating Part 5 of the FTC Act, which seems to be half of a bigger effort by the FTC to watch the practices of internet sites, apps, and linked units that seize shopper’s delicate well being data. The motion additionally indicators the FTC’s highlight on firms’ use of reproductive well being knowledge, significantly in menstrual cycle and fertility functions, within the wake of the Dobbs v. Jackson Ladies’s Well being Group (“Dobbs”) resolution.

The Criticism

In line with the , the FTC alleges that, between 2017 and 2020, Straightforward Healthcare repeatedly and falsely promised Premom customers in in its privateness insurance policies that (1) it could not share well being data with third events with out customers’ data or consent; (2) to the extent that the corporate collected and shared any data, it was non-identifiable knowledge, and that its use of third-party analytics software program recognized a person solely by IP tackle; and (3) the corporate would solely use such knowledge for its personal analytics or promoting. The FTC states that Straightforward Healthcare’s privateness insurance policies over time promised shoppers that it could notify and acquire consent from customers earlier than utilizing its customers’ knowledge for every other functions.

The FTC alleges that Straightforward Healthcare shared Premom customers’ identifiable well being data by way of “Customized App Occasions” to 3rd events. In line with the Criticism, Straightforward Healthcare included into the Premom app software program growth instruments, referred to as software program growth kits (“SDKs”),  which allowed Straightforward Healthcare to trace and analyze Premom customers’ interactions with Premom and switch its app customers’ knowledge—together with knowledge about customers’ fertility and pregnancies—to the writer of every SDK. The Criticism states that Straightforward Healthcare gave these firms (together with third-party advertising and analytics companies, a few of which had been overseas firms) broad latitude to make use of such knowledge as they noticed match by agreeing to their normal phrases of service.

The FTC additionally alleges that Straightforward Healthcare didn’t implement affordable privateness and knowledge safety measures, together with failing to adequately assess the privateness dangers of third-party SDKs that had been included into Premom, failing to watch adjustments within the privateness insurance policies and phrases and situations of the SDK publishers, and failing to interact in audits or compliance evaluations relating to the info assortment and privateness practices of third-party publishers. The FTC additionally discovered that Straightforward Healthcare didn’t implement compliance with their very own privateness guarantees to shoppers.

The Proposed Order

The states that Straightforward Healthcare should pay a civil penalty of $100,000 to the federal authorities. Along with the civil penalty, the Proposed Order prohibits Straightforward Healthcare from partaking in sure practices, requires it to inform people as required below the HBNR, and requires it to interact in varied actions designed to bolster its compliance program. Particularly, the Proposed Order consists of the next prohibitions and necessities:

• Completely prohibits Straightforward Healthcare from sharing customers’ private well being knowledge with third events for promoting;
• Requires Straightforward Healthcare to acquire person consent earlier than sharing private well being knowledge with third events for different functions;
• Requires Straightforward Healthcare to retain customers’ private data for less than so long as vital to satisfy the aim for which it was collected;
• Prohibits Straightforward Healthcare from making future misrepresentations about its privateness practices;
• Requires Straightforward Healthcare to adjust to the HBNR’s notification necessities for any future breach of safety;
• Requires Straightforward Healthcare to hunt deletion of knowledge it has shared with third events;
• Requires Straightforward Healthcare to ship and publish a shopper discover explaining the FTC’s allegations and the settlement; and
• Requires Straightforward Healthcare to implement complete safety and privateness packages that embody sturdy safeguards to guard shopper knowledge.

Takeaways

As mentioned in a previous , the FTC issued a in September 2021 to affirm that well being apps and linked units that accumulate or use shoppers’ well being data should adjust to the HBNR. Along with the coverage assertion, which seems to have considerably expanded the HBNR’s scope, the FTC just lately that it could be searching for touch upon proposed adjustments to the HBNR that embody clarifying the rule’s applicability to well being apps and different comparable applied sciences.

Furthermore, the Administration and the FTC have elevated scrutiny on firms that share delicate within the wake of the Dobbs resolution final spring reversing the constitutional proper to abortion. For the reason that launch of the Dobbs resolution, the Administration has labored to bolster protections for delicate well being knowledge associated to reproductive well being care by way of a mix of legislation enforcement and coverage initiatives, together with a earlier FTC enforcement motion in opposition to , the developer of a fertility monitoring app, along with from the FTC to guard shoppers from firms that misuse reproductive well being knowledge.

Digital well being firms and different organizations throughout the well being care business ought to pay attention to current enforcement actions, consider whether or not the HBNR applies to their enterprise, evaluation and replace insurance policies and compliance with FTC requirement, and proceed to watch FTC enforcement actions and different developments relating to the HBNR. That is significantly vital for firms that concentrate on girls’s well being.

For extra data or recommendation relating to the applicability of the Enforcement Motion to your group, please contact the skilled(s) listed beneath or your common Crowell & Moring contact.

---