Pharmacists are picky about how they describe their clients. The preferred term is “patient.” That elevates the practice of pill-counting and makes it all sound much more professional, confidential and patient-centered.
But increasingly, that patient-centering refers not so much to the careful, personal care accorded each customer but rather to the data-mining and selling that goes on behind the scenes.
Example? GoodRx, a discount pharmacy that has won an enviable reputation for providing essential pharmaceuticals at a hefty discount. But recent revelations point to a profitable business on the side — selling customers’ sensitive private health information to marketing and advertising concerns.
A recent federal court settlement provides that GoodRx will set up a $32 million fund to provide compensation to wronged patients who used the company’s websites and services before April 20, 2024.
Most customers won’t need receipts or prescription records to qualify. The settlement amounts will depend on how much money is left after expenses are deducted. The deadline for filing a claim is Dec. 29, 2026. More details are available here.
The settlement includes Criteo Corp., a third-party advertising company. Also named in the action as “Remaining Defendants” are Google and Meta. They have not settled and are apparently disputing the claims.
FTC action came first
The lawsuits that ended with the settlements grew out of a Federal Trade Commission case against GoodRx on Feb. 1, 2023.
The FTC said the companies GoodRx sold the data to used it to target patients with ads on social media and elsewhere.
“Digital health companies and mobile apps should not cash in on consumers' extremely sensitive and personally identifiable health information,” said Samuel Levine, then-Director of the FTC’s Bureau of Consumer Protection. “The FTC is serving notice that it will use all of its legal authority to protect American consumers’ sensitive data from misuse and illegal exploitation.”
It said GoodRx displayed a seal at the bottom of its telehealth services homepage falsely suggesting to consumers that it complied with the Health Insurance Portability and Accountability Act of 1996 (HIPAA), a law that sets forth privacy and information security protections for health data.
That case was settled for a $1.5 million civil penalty. A series of private class actions followed.