FTC Fines GoodRx $1.5M for Sharing Health Data With Facebook, Google

On Feb. 1 the Federal Trade Commission announced a proposed settlement with drug discount and telehealth provider GoodRx, in which the company must pay a $1.5 million civil penalty for violating the Health Breach Notification Rule (HBNR). The agreement between the FTC and GoodRx is pending approval by a federal court.

GoodRx is a free healthcare discount resource that helps consumers find pharmacies offering the least expensive options for prescriptions.

The FTC’s complaint stated that GoodRx violated the FTC Act by sharing sensitive personal health information with advertising companies and platforms and not reporting “unauthorized disclosures” as required by the HBNR.

“We do not agree with the FTC’s allegations and we admit no wrongdoing,” GoodRx stated in a press release. “Entering into the settlement allows us to avoid the time and expense of protracted litigation.”

The federal government’s order is the first-known action against a company for violating the HBNR, which requires personal health record vendors and other organizations to notify consumers if they have improperly shared unsecured information. The FTC also said GoodRx “misrepresented” its compliance with the Health Insurance Portability and Accountability (HIPAA) by placing a seal on its telehealth website. However, GoodRx says it removed the old seal from the site as part of its integration of the telehealth business, which it acquired in 2019.

The company says it has saved consumers about $45 billion in medical costs. It offers a prescription discount card as well as a price-comparison tool to save on medication. Patients can use the discount cards in addition to or instead of insurance. GoodRx also offers a telehealth service for $19 with a Gold membership and starting at $49 without a membership.