The Federal Trade Commission has proposed restricting a mental telehealth service firm from sharing consumer data and requiring it to pay a $7 million penalty to settle allegations that the firm used online tracking tools to unlawfully disclose sensitive health information to third-party advertisers without the patients' consent.
The FTC also alleges the firm failed to honor its easy cancellation promises to consumers.
The FTC's proposed order against Cerebral, filed in federal court by the Department of Justice on Monday, seeks to restrict how the company can use or disclose sensitive consumer data and calls for the company to pay more than $7 million in penalties, including $5.1 million to partially refund consumers affected by the company's deceptive cancellation practices.
The proposed order must be approved by the U.S. District Court for the Southern District of Florida before it can go into effect.
The FTC's action against Cerebral follows a data breach the company reported to the U.S. Department of Health and Human Services in March 2023 as affecting nearly 3.2 million individuals.
The incident involved the company's use of website tracking tools to share sensitive patient information with third parties including Facebook, Google and TikTok - without the individuals' consent.
The proposed order against Cerebral follows several similar FTC actions against other firms in several other health data privacy cases over the last year or two, including those involving the use of online trackers.
The FTC has taken enforcement actions against at least two other telehealth providers - BetterHelp and GoodRx - plus mobile fertility app vendor Premom in cases involving those companies' use of tracking tools that shared consumer's sensitive health and personal information with third-party analytics and social media firms without individuals' consent.
The FTC alleged those companies' use of online trackers amounted to unfair acts or practices in violation of Section 5 of the FTC Act.
In the enforcement actions against GoodRx and Premom, the FTC also alleged the companies had violated the FTC's health data breach notification rule.
Earlier this month, the FTC finalized an order prohibiting data broker X-Mode and its successor Outlogic from sharing or selling any sensitive location data.
The action settled allegations that the company sold precise location data that could be used to track people's visits to sensitive locations such as medical and reproductive health clinics and places of worship.
This Cyber News was published on www.bankinfosecurity.com. Publication date: Tue, 16 Apr 2024 17:13:03 +0000