On March 2, 2023, the Federal Commerce Fee (“FTC”) introduced an enforcement motion in opposition to California-based on-line counseling service BetterHelp, Inc. (“BetterHelp”) for allegedly sharing customers’ well being info, together with delicate details about psychological well being challenges, for promoting functions in violation of Part 5 of the FTC Act.

This newest enforcement motion comes only one month after the FTC introduced an for allegedly violating Part 5 of the FTC Act and the Well being Breach Notification Rule (“HBNR”). The place the GoodRx enforcement motion marked the primary time the FTC enforced the HBNR, the BetterHelp enforcement motion equally units a brand new precedent for the FTC: That is the primary FTC enforcement motion returning funds to customers whose well being info was compromised by BetterHelp’s alleged misdeeds. The proposed order (“Proposed Order”) additionally units out in depth necessities to ban BetterHelp from disclosing well being info for promoting and misrepresenting its info sharing practices. The GoodRx and BetterHelp enforcement actions look like half of a bigger effort by the FTC to watch the practices of internet sites, apps, and linked gadgets that seize shopper’s delicate well being info.

The Grievance

In keeping with the , BetterHelp affords on-line counseling companies by matching customers with BetterHelp therapists and facilitating counseling through BetterHelp’s varied web sites and apps. BetterHelp additionally affords specialised variations of its counseling companies for folks of the Christian religion, members of the LGBTQ group, and youngsters. To enroll in BetterHelp’s companies, customers should fill out a questionnaire that asks delicate psychological well being questions, corresponding to whether or not they have skilled melancholy or suicidal ideas, have beforehand been in counseling, or take any medicines. Shoppers additionally present their title, e-mail tackle, delivery date, and different private info. In its on the enforcement motion, FTC suggests that customers are “pushed’ to supply this info by “repeatedly displaying them privateness misrepresentations and nudging them with unavoidable prompts to enroll in its counseling service.” Shoppers are then matched with a BetterHelp counselor and pay between $60 and $90 per week for counseling.

The Grievance alleges that in recognition of the quantity of delicate well being info customers present, BetterHelp “repeatedly promised” to maintain this info “non-public and use it just for non-advertising functions corresponding to to facilitate customers’ remedy.” Nonetheless, over a interval of seven years from 2013 by way of 2020, BetterHelp purportedly “regularly broke these privateness guarantees, monetizing customers’ well being info to focus on them and others with commercials” for BetterHelp’s companies. For instance, BetterHelp allegedly shared its customers’ e-mail addresses and the very fact they had been in counseling with Fb, which in flip recognized related customers and focused them with BetterHelp commercials. BetterHelp additionally allegedly shared its customers’ info with different third-party promoting platforms, corresponding to Pinterest, Snapchat, and Criteo. These promoting efforts reportedly introduced in “tens of hundreds of latest paying customers, and tens of millions of {dollars} in income” to BetterHelp. BetterHelp additionally allowed these third-party corporations to make use of BetterHelp customers’ info for their very own analysis and product improvement, additional proof that BetterHelp didn’t contractually restrict how third events might use customers’ well being info.

The Grievance additionally alleges that BetterHelp “didn’t make use of cheap measures to safeguard the well being info it collected from customers.” BetterHelp is accused of not coaching its workers on the way to correctly defend person info when utilizing it for promoting functions and never overseeing its workers’s use of person info.

The Proposed Order

The imposes a $7.8 million superb on BetterHelp, to be paid right into a fund, to refund customers who signed up and paid for BetterHelp’s counseling companies between August 1, 2017, and December 31, 2020. The FTC reviews that that is the primary enforcement motion searching for to return funds to customers whose well being info was compromised. Along with the financial penalty, the Proposed Order prohibits BetterHelp from sharing customers’ “individually identifiable info regarding the previous, current, or future bodily or psychological well being or situation(s)” with third-parties for promoting or re-targeting earlier customers. Additional, the Proposed Order requires BetterHelp to:

• Receive customers’ affirmative categorical consent earlier than disclosing private info to third-parties for any objective;
• Set up, implement, and preserve a complete privateness program that features sturdy safeguards to guard shopper info;
• Direct third events to delete the patron well being info and different private info that BetterHelp revealed to them; and
• Restrict how lengthy BetterHelp retains private and well being info in accordance to an information retention schedule. 

Takeaways

Digital well being corporations and different corporations that function web sites, apps, or linked gadgets that seize shopper’s delicate well being info ought to take heed of the FTC’s enforcement actions in opposition to each BetterHelp and GoodRx. As evidenced by the BetterHelp enforcement motion, corporations should safeguard person info and never endeavor to leverage this info for promoting alternatives in violation of guarantees made to customers. The BetterHelp enforcement motion additionally underscores the necessity for acceptable person notification mechanisms to acquire person consent earlier than disclosing their info to 3rd events. Additional, corporations ought to recall from the GoodRx enforcement motion that even corporations that aren’t topic to the necessities of the Well being Insurance coverage Portability and Accountability Act might nonetheless be topic to the HBNR. Whereas the FTC didn’t allege violations of the HBNR by BetterHelp, additional enforcement motion might nonetheless be looming.

The BetterHelp enforcement motion is particularly noteworthy as it’s the first time the FTC has endeavored to redress shopper accidents for these whose delicate well being info was inappropriately used and disclosed. That is the FTC’s second “first” within the space of well being info enforcement within the span of only one month, so corporations must be looking out for extra to come back.

For extra info or recommendation relating to this enforcement motion or knowledge privateness points on the whole, please contact the skilled(s) listed beneath or your common Crowell & Moring contact.