FTC Fines Mental Health Startup Cerebral $7 Million for Major Privacy Violations

FTC Fines Mental Health Startup Cerebral $7 Million for Major Privacy Violations

April 16, 2024 at 05:15AM

The U.S. FTC fined mental telehealth company Cerebral over $7 million for privacy breaches, including sharing sensitive personal health data with third parties for advertising. Cerebral must cease data sharing, implement privacy and security measures, and inform users of the FTC order. Similar actions have been taken against other healthcare providers for unauthorized data sharing.

Key Takeaways from the Meeting Notes:
– The U.S. Federal Trade Commission (FTC) has fined the mental telehealth company Cerebral over $7 million for violating privacy and advertising regulations.
– Cerebral and its former CEO were accused of repeatedly breaking privacy promises to consumers and providing users’ sensitive personal health information to third parties for advertising purposes.
– The company failed to honor its easy cancellation policies and misled consumers about its data-sharing practices.
– The company shared sensitive information of nearly 3.2 million consumers with third parties such as LinkedIn, Snapchat, and TikTok.
– Cerebral was also accused of failing to enforce adequate security measures, allowing former employees to access users’ medical records and sending promotional postcards revealing patients’ diagnosis and treatment.
– The FTC has barred Cerebral from using or disclosing consumers’ personal and health information to third-parties for marketing, and has mandated the implementation of a comprehensive privacy and data security program.
– Monument, an alcohol addiction treatment firm, was also prohibited by the FTC from disclosing health information to third-party platforms without users’ permission.
– The FTC has issued similar enforcement actions against healthcare service providers for sharing users’ data with third-party firms without consent and has warned Amazon against using patient data for marketing purposes.

This summary captures the significant details and implications of the meeting notes related to the privacy breach and regulatory compliance within the healthcare and telehealth industry.

Full Article