I don't think many are surprised that GoodRX was sharing data (violating its own privacy policy) but come on, have some teeth. You'd think with HIPPA that we'd treat anything medical more seriously.
At the Federal level, the only broad general protections for medical data are (apparently) some FTC fine print. The fact that this exists at all means that medical data is treated more seriously than other forms of personal data, but as you can see that is a very low bar to clear (literally doesn't exist).
This is inaccurate in part.
HIPAA governs covered entities and business associates (BA) who work on behalf of a CE. Covered Entities are healthcare providers or insurance companies. CEs are required to have their BAs sign business associate agreement where they’re regulated under HIPAA.
GoodRx convinced patients to provide them their health information directly. Unless, they’ve signed a BAA with a CE, the FTC is the only government body with regulatory power here however I would imagine there’s a legal firm prepping a class action against GoodRx right now as well.
The class action is what will be expensive for them. The fact that they have been fined is what should make the action hopefully a slam dunk.
Sources:
- https://www.hhs.gov/hipaa/for-professionals/privacy/laws-reg...
- https://www.hhs.gov/hipaa/for-professionals/security/laws-re...
That smells like real money to me.
The total cost for the biggest healthcare breach was around $500 million give or take.
It seems unlikely that GoodRx was processing data that met that standard.
https://www.hhs.gov/hipaa/for-professionals/covered-entities...
There’s no wiggle room here unless the data has been de-identified (a high barrier). It wasn’t.
The standard you’re refering to is for e-PHI which is “individually identifiable health information.”
You’ll want to see the Privacy Rule for details but GoodRx shared email addresses, phone numbers and mobile identifiers according to the FTC complaint.
https://www.ftc.gov/system/files/ftc_gov/pdf/goodrx_complain...
> In truth and in fact, GoodRx is not a HIPAA-covered entity, and its privacy and information practices did not comply with HIPAA’s requirements.
Further, on page 25, they define them as a "vendor of personal health records" - which explicitly excludes covered entities (definition on page 19).
-----
This is consistent with my understanding of a covered entity. Without the "transactions for which HHS has adopted a standard", GoodRx is not a covered entity.
Further, even if they were a covered entity, it's possible for them to segment their HIPAA and non-HIPAA compliant business units. This is called a "hybrid entity".
----
Interestingly, the FTC is pinging them on for a misleading representation of being a covered entity. Since GoodRX was not a covered entity, they were not technically violating HIPAA.
I’m not saying that they are a CE only that if they were then the data is clearly PHI and had not been de-identified per the standard that you referenced previously.
> on page 25, they define them as a "vendor of personal health records"
So the FTC itself considers GoodRX an entity primarily focused on selling the health information of individuals.
Just in case anyone though it was something else.
It is claimed something like half the population can be uniquely identified just with DOB, gender, and zip code.
"A high barrier" is ambiguous - it could mean that it is high because it's difficult and expensive to comply with the legal standards - or it could mean it provides a high level of protection against uniquely identifying subjects.
I'm betting 100% of the former and 0% of the latter.
All of the major enterprise healthcare organizations have dedicated analysts who work solely on de-identifying datasets so that the data can be used for commercial purposes.
It's such a hard problem that it is not achievable except in very specific circumstances, such as if the data is just a single single datapoint or if the data is aggregated with a lot of other data, and the original individual datapoints are deleted.
In practice, whenever you hear anyone claim they've "anonymized" or "de-identified" your data, if you assume that's not true, you're much more likely to be right than wrong.
If that doesn't make them a CE, then somebody has some 'splaining to do.
Here is who qualifies as a CE:
https://www.hhs.gov/hipaa/for-professionals/covered-entities...
How does GoodRx fit into any of these categories? I don't see it.
It's possible some health care providers (think large hospitals) enforce HIPAA via contractual obligations without federal law directly requiring PBMs to be covered entities.
That would give a path for GoodRx to interact without being in violation of HIPAA.
Already filed:
https://www.classaction.org/news/class-action-alleges-goodrx...
If their 11M subscribers are each worth ~$500 that might be a little more of a deterrent.
I really wish the FTC did this more often.
If you’re marketing your service as privacy focused, you can just sell your customers data.
Plenty of services start out as free-speech/privacy focused, but change their tune once advertisers make demands.
That should be allowed. If you built your community by promising privacy, you shouldn’t be able to go back in that easily.
Lock in is a real thing. Abusing it is wrong.
Our legal system was also created during an age where there weren’t so damn many billionaires with a net worth greater than tens of millions of average taxpayers combined.