Practice Fusion Settles FTC Charges Alleging It Misled Consumers Over Privacy of Medical Information

The company solicited doctor reviews without clearly indicating the reviews would be made public

Practice Fusion Settles FTC Charges Alleging It Misled Consumers Over Privacy of Medical Information
Image: Pixabay
June 8, 2016

Practice Fusion has agreed to settle charges levied by the Federal Trade Commission (FTC) over the misleading of its customers.

According to the agency, the cloud-based electronic health record company deceived consumers by soliciting reviews for their doctors without clearly indicating that the reviews would be made public. This practice resulted in patients' revealing sensitive personal and medical information.

"Practice Fusion's actions led consumers to share incredibly sensitive health information without realizing it would be made public," said Jessica Rich, in a written statement. Rich is the Director of the FTC's Bureau of Consumer Protection. "Companies that collect personal health information must be clear about how they will use it – especially before posting such information publicly on the Internet."

According to the FTC's complaint, Practice Fusion made plans to launch a public-facing healthcare provider directory in 2013. In order to be able to populate the directory with patient reviews, Practice Fusion began sending emails in April 2012 to patients of healthcare providers utilizing Practice Fusion's electronic health records service. The emails appeared to be from the patients' doctors and asked consumers to rate their provider.

The messages contained a survey with a text box where patients could enter any information they wished within a set character limit. Because patients likely thought the information was only shared with their provider, many of them included in the text box their full name or phone number along with personal health information inquiries. This information was then used in public posts by Practice Fusion.

The FTC's settlement prohibits Practice Fusion from making deceptive statements about the privacy of information it collects from consumers. The company will be required to clearly and conspicuously disclose any intention to make personal information public and must obtain consumers' affirmative consent. In addition, the settlement ensures that Practice Fusion cannot publicly display the reviews it collected from consumers during the time period covered by the complaint.