Cybersecurity Policy Report, FTC to Settle Privacy Complaint Against Telehealth Firm, (Apr 16, 2024)

By Tony Foley

The Federal Trade Commission has reached a proposed settlement with telehealth provider Cerebral, Inc., that would restrict the company’s use or disclosure of sensitive consumer data and require it to provide consumers with a simple way to cancel services, the commission announced yesterday.

The settlement would end an FTC probe into allegations that Cerebral failed to secure and protect sensitive health data.

According to an FTC news release, Cerebral provides online mental health care and related services on a “negative option” basis, meaning that consumers are charged automatically unless they cancel. Consumers signing up with Cerebral provide detailed personal data, including home and e-mail addresses, birthdates, medical and prescription histories, payment account or driver’s license numbers, and information about their treatment and insurance plans, among other items.

In its complaint, the FTC alleged that Cerebral and its former chief executive officer repeatedly broke privacy promises to consumers and misled them about its cancellation policies. Specifically, the FTC maintained that Cerebral failed to clearly disclose that it shared consumers’ sensitive data with third parties for advertising and buried disclaimers about its data-sharing practices in dense privacy policies.

In fact, the FTC said, the company claimed in many instances that it would not share users’ data for marketing purposes without obtaining consumers’ consent. The FTC contended that these practices originated under the direction of the former CEO and continued after his tenure. As a result, the complaint said, Cerebral provided the sensitive information of nearly 3.2 million consumers to third parties like LinkedIn, Snapchat, and TikTok through the use of tracking tools on its websites or apps.

The complaint further alleged that Cerebral failed to deploy adequate safeguards for the sensitive data collected from consumers and engaged in sloppy security practices, including careless marketing, allowing former employees to access user data, using insecure access methods, and failing to implement adequate security policies and training. The FTC also contended that Cerebral and its CEO violated the Restore Online Shoppers’ Confidence Act (ROSCA) by failing to disclose all material terms of its cancellation policy.

Under the proposed order, Cerebral would pay nearly $5.1 million, which will be used to provide partial refunds to consumers impacted by its deceptive cancellation policies, as well as a $10 million civil penalty that is slated to be reduced to $2 million due to the company’s inability to pay the full amount. In addition, the proposed order would do the following:

1. Permanently ban Cerebral from using or disclosing personal and health information to third parties for most marketing or advertising purposes and generally require the company to obtain consent before such a disclosure;

2. Prohibit Cerebral from misrepresenting its privacy and security practices;

3. Require the company to implement a comprehensive privacy and data security program meeting specified requirements;

4. Require Cerebral to post a notice on its website alerting users to the allegations in the complaint and the steps it had taken to comply with the proposed order;

5. Require the company to maintain a data retention schedule and to delete most consumer data not used for treatment, payment, or health care operations unless consumers consent to the retention, as well as providing a clear mechanism for consumers to request deletion; and

6. Prohibit the company from misrepresenting its cancellation policies or practices and require it to provide consumers with an easy way to cancel.

The proposed order was filed in U.S. District Court for the Southern District of Florida by the Department of Justice and must be approved by the court before going into effect. The press release notes that the proposed order applies only to Cerebral; the company’s former CEO has not agreed to a settlement, and the charges against him will be decided by the court.

This is the second action in less than a week from the FTC against an online treatment provider for disclosures of personal health data to a third party for advertising purposes, coming on the heels of its proposed order against alcohol addiction treatment services Monument, Inc. (CPR, Apr. 12).

News: FederalLegislation LitigationEnforcement DataPrivacy DataSecurity