Practice Fusion settles with FTC over health data disclosures
In settlement agreement, company notes changes in practices, does not admit wrongdoing.
Electronic health record vendor Practice Fusion has agreed to settle Federal Trade Commission charges it misled consumers by soliciting reviews for physicians using its EHR.
The FTC contends the company did so without properly disclosing that the feedback would be publicly posted on the Internet, resulting in the disclosure of patients’ sensitive personal and medical information.
In response to the settlement agreement, the company reports that its practices have changed and it does not admit to wrongdoing. No fine was levied.
The FTC said its charges are based on how the EHR vendor operated a treatment satisfaction survey feature from April 2012 to April 2013. The agency complaint alleges that Practice Fusion began sending emails in April 2012 to patients of healthcare providers utilizing its EHR service; the emails appeared to be sent on behalf of the patients’ doctors, asking them to rate their provider. The information gathered then was used for a public-facing provider directory posted online in 2013.
“Practice Fusion’s actions led consumers to share incredibly sensitive health information without realizing it would be made public,” said Jessica Rich, director of the FTC’s Bureau of Consumer Protection. “Companies that collect personal health information must be clear about how they will use it—especially before posting such information publicly on the Internet.”
Because patients mistakenly believed the information would only be shared with their provider, the FTC says some patients responded to Practice Fusion’s email solicitation by including inquiries about personal health information. For example, one consumer asked for information on dosing for a Xanax prescription, while another included a request for help with a depressed child, the federal agency noted.
As part of the FTC settlement, Practice Fusion is prohibited from making deceptive statements about the privacy or confidentiality of the information it collects from consumers. And before making any consumer information publicly available, the company must clearly and conspicuously disclose the expected use for information and obtain consumer consent for that use.
In a written statement, Practice Fusion responded to the FTC’s June 8 announcement about the settlement.
“The proposed consent agreement is not related to our core businesses, nor how we have operated the survey feature since April 2013,” stated the company. “It does not represent an admission of wrongdoing by Practice Fusion, and there are no monetary damages imposed on Practice Fusion. The complaint associated with the consent agreement does not allege that anything that we are currently doing is problematic.”
The vendor added that it is “committed to providing small, independent physician practices sophisticated, easy-to-use healthcare technology to help them modernize their practices and better treat their patients.”
The FTC contends the company did so without properly disclosing that the feedback would be publicly posted on the Internet, resulting in the disclosure of patients’ sensitive personal and medical information.
In response to the settlement agreement, the company reports that its practices have changed and it does not admit to wrongdoing. No fine was levied.
The FTC said its charges are based on how the EHR vendor operated a treatment satisfaction survey feature from April 2012 to April 2013. The agency complaint alleges that Practice Fusion began sending emails in April 2012 to patients of healthcare providers utilizing its EHR service; the emails appeared to be sent on behalf of the patients’ doctors, asking them to rate their provider. The information gathered then was used for a public-facing provider directory posted online in 2013.“Practice Fusion’s actions led consumers to share incredibly sensitive health information without realizing it would be made public,” said Jessica Rich, director of the FTC’s Bureau of Consumer Protection. “Companies that collect personal health information must be clear about how they will use it—especially before posting such information publicly on the Internet.”
Because patients mistakenly believed the information would only be shared with their provider, the FTC says some patients responded to Practice Fusion’s email solicitation by including inquiries about personal health information. For example, one consumer asked for information on dosing for a Xanax prescription, while another included a request for help with a depressed child, the federal agency noted.
As part of the FTC settlement, Practice Fusion is prohibited from making deceptive statements about the privacy or confidentiality of the information it collects from consumers. And before making any consumer information publicly available, the company must clearly and conspicuously disclose the expected use for information and obtain consumer consent for that use.
In a written statement, Practice Fusion responded to the FTC’s June 8 announcement about the settlement.
“The proposed consent agreement is not related to our core businesses, nor how we have operated the survey feature since April 2013,” stated the company. “It does not represent an admission of wrongdoing by Practice Fusion, and there are no monetary damages imposed on Practice Fusion. The complaint associated with the consent agreement does not allege that anything that we are currently doing is problematic.”
The vendor added that it is “committed to providing small, independent physician practices sophisticated, easy-to-use healthcare technology to help them modernize their practices and better treat their patients.”
More for you
Loading data for hdm_tax_topic #reducing-cost...