On May 17, the Federal Trade Commission (“FTC”) announced an enforcement action against Easy Healthcare Corporation (“Easy Healthcare”) alleging that it shared users’ sensitive personal information and health information with third parties contrary to its representations and without users’ affirmative express consent, in violation of Section 5 of the FTC Act.  It also alleges that Easy Healthcare failed to notify consumers of these unauthorized disclosures, in violation of the Health Breach Notification Rule (“HBNR”).  According to the proposed order, Easy Healthcare will pay a $100,000 civil penalty for violating the HBNR and, among other requirements, will be permanently prohibited from sharing users’ personal health data with third parties for advertising purposes.  The FTC also noted that Easy Healthcare will pay a total of $100,000 to Connecticut, the District of Columbia, and Oregon for violating their laws.

Complaint

According to the complaint filed by the Department of Justice (“DOJ”), Easy Healthcare’s fertility application, Premom Ovulation Tracker (“Premom”), allows users to upload, import, and track various personal and health information.  For example, according to the complaint, Premom allows users to add information about their periods or upload images of ovulation test strips. 

The FTC and DOJ allege that Easy Healthcare deceived users because it:

• Represented that it would not share health information without user consent, when in fact it shared health information with third parties.  The FTC alleged that Easy Healthcare shared health information when it recorded certain user-app interactions (“Custom App Events”), such as where a user logged her fertility, titled the interactions with descriptive names, like “Calendar/Report/LogFertility,” and shared the Custom App Event with AppsFlyer and Google.
• Represented that it shared only “non-identifiable data” with third-parties, when it actually shared identifiers, including non-resettable device identifiers and precise geolocation, with third-parties, including China-based entities.
• Represented that it would collect data only for its own analytics or advertising, when in fact it provided data to third parties, including China-based entities, that reserved the right to use data for third party advertising. 

The complaint also alleges that Easy Healthcare committed unfair acts or practices when it failed to implement reasonable privacy and data security measures and transferred users’ health information for advertising purposes without users’ knowledge and without obtaining users’ affirmative express consent. 

Finally, the complaint alleges that Easy Healthcare violated the HBNR by failing to notify users that it shared  users’ identifiable health information without authorization.  The complaint alleges that Easy Healthcare is a vendor of personal health records because the Premom app collects personal health record identifiable health information from multiple sources, including from users (e.g., an image of an ovulation test strip) and Bluetooth thermometers and other third-party apps (e.g. temperature and time stamps of recordings).  In addition, users can manage and control the personal health record identifiable health information in the app.

Proposed Order

The proposed order requires Easy Healthcare to pay $100,000 in civil penalties for violating the HBNR.  The order also permanently prohibits Easy Healthcare from sharing health information with third parties for advertising, and requires it obtain “affirmative express consent” before sharing health information with third parties for other purposes.

The order prohibits future misrepresentations and requires Easy Healthcare to notify individuals, the FTC, and the media for certain security incidents.  It also imposes a number of other requirements, including, among others, that Easy Healthcare notify consumers of the allegations and settlement; direct third parties to delete previously shared data; implement a privacy and information security program and retain information for “only as long as is reasonably necessary” for the purpose for which it was collected; and obtain biennial privacy and information security assessments.

The FTC also noted in its announcement that Easy Healthcare has agreed to pay $100,000 total to Connecticut, the District of Columbia, and Oregon for violating their laws.  Each of these states appear to have worked with the FTC on this matter.