Health Data Sharing Crackdown by FTC

An online counseling company that promised not to share user information must disgorge nearly $8 million to users after disclosing their data for advertising purposes. The FTC has taken on health data protection in a big way in 2023, and this is the latest example. The counseling company (BetterHelp) is a telehealth mental health service that connects users to mental health professionals after the user completes a questionnaire about their mental health concerns. The company disclosed questionnaire information and contact information about users to several large social media and advertising companies.  

Why It Matters

The FTC is clearly focused this year on health data. It has taken action under HIPAA rules as well as under its general privacy enforcement powers. BetterHelp apparently violated its own privacy promises to users when it disclosed their information for advertising purposes; and worse yet, it apparently falsely denied sharing personal information after accusations in 2020. Any company with health data about consumers should remain aware that regulators and lawmakers see such data as being especially sensitive and deserving of protection; and all companies should remember that what they say in their privacy policy matters. If you intend to sell, share, or otherwise disclose user data -- of any kind -- be certain that your privacy policy or terms of use are up to date and clear about your practices.