FTC Settles with Billing Company over Deceptive Data Practices

The Federal Trade Commission has reached a settlement with an Atlanta-based billing company and its former CEO after they misled thousands of consumers who signed up for an online billing portal. The FTC charged that the company used the portal to obtain detailed medical information about consumers from pharmacies, medical labs and insurance companies.

According to a pair of FTC complaints, PaymentsMD, LLC and former CEO Michael C. Hughes altered the registration process for the portal—where consumers could view their billing history—to include permission for the company and its partners to contact healthcare providers to obtain their medical information. The information requested included the prescriptions, procedures, medical diagnoses, lab tests performed and the results of tests, among other information.

Thankfully, in all but one case, the healthcare companies contacted for data refused to comply with the requests, given that they included requests for information about minors as well for individuals who were not customers of the companies that were contacted.  

“Consumers’ health information is as sensitive as it gets,” said Jessica Rich, director of the FTC’s Bureau of Consumer Protection. “Using deceptive tactics to gain consumers’ ‘permission’ to collect their full health history is contrary to the most basic privacy principles.”

Under the terms of the settlement with the FTC, PaymentsMD and Hughes must destroy any information collected related to the Patient Health Report service. They also are banned from deceiving consumers about the way they collect and use information, including how information they collect might be shared with or collected from a third party, and they must obtain consumers’ affirmative express consent before collecting health information about a consumer from a third party.