Volume 6 | Issue 4
Inside This Issue
Match Day Dell Med Graduating Students 2023 See pg. 10
INDEX Mental Health...................... pg.3 Oncology Research......... pg.4 Healthy Heart....................... pg.6 Hospital News...................... pg.8
St David’s First Living Kidney Donor the New Online Registry See pg. 12
April Edition 2023
FTC Targets Disclosure of Health Data to Advertisers
By Iliana Peters, J.D. Colin Black, J.D. Polsinelli, PC
I
n a recent proposed order, the Federal Trade Commission (“FTC”) limits the ability of an online mental health services provider from sharing individuals’ health data, including information about mental health, for marketing and advertising purposes. In addition to requiring the provider to pay $7.8 million, the FTC alleges that the provider shared information with a number of third-party companies for marketing and advertising, including Meta’s Facebook, Snapchat, Pinterest, and Criteo. In its complaint, the FTC cited the sharing of information without consent from the individual subject of the information through manual and automated means, which included individuals’ email addresses, IP address, and other persistent identifiers. The FTC also placed specific emphasis on the use of web beacons, which presumptively refers in part to the Meta Pixel, a tracking technology provided by Meta that permits the collection of “events” that occur on a web page. These events can include one of over fifteen “universal” events, but can also be customized to track custom events and activities. The initial complaint cited eight counts, including unfair privacy practices, disclosure of health information for advertising and third parties’ own uses, the failure to disclose
the use of health information for advertising, and misrepresenting the privacy of information shared with the provider. However, in all cases, the causes of action include the failure to secure adequate consent before sharing information, failing to provide limitations on the use of the disclosed
information, including individually identifiable health information, through the use of marketing and tracking technologies. For example, in December 2022, the agency primarily tasked with HIPAA enforcement, Department of Health and Human Services, Office for Civil Rights (“HHS OCR”), published guidance for HIPAA covered entities and their business associates that prohibited regulated entities from using tracking technologies in a manner that would permit an impermissible disclosure of HIPAA protected health information (“PHI”) to tracking technology vendors or any other violations of the HIPAA rules. In that guidance, HHS OCR expressly provided that entities and activities outside the scope of HIPAA may still be subject to regulatory oversight and intervention by the FTC and other regulators where sensitive information is shared beyond the scope of authorization. Finally, we understand that the State Attorneys General continue to exercise their jurisdiction in these matters, as well.
...F TC a l leges t hat
t h e p r ov i d e r s h a r e d information with a number of third-party companies for marketing and advertising, including Meta’s Facebook, Snapchat, Pinterest, and Criteo. information, and misrepresenting in its online privacy policies how the provider would use and share sensitive information. With this proposed settlement with the provider, the FTC indicates a pattern of heightened attention from federal government agencies with jurisdiction to the disclosure of sensitive
see Health Data ...page 14
PERMIT# NO PERMIT 11491 AUSTIN TXTX HOUSTON PRSRT STD US POSTAGE PAID