BetterHelp, Inc.; Analysis of Proposed Consent Order To Aid Public Comment, 15717-15720 [2023-05139]

Download as PDF Federal Register / Vol. 88, No. 49 / Tuesday, March 14, 2023 / Notices MUST register in advance to attend this meeting. Date: March 15, 2023. Time: 10:00 a.m. ET. Status: Open. Reports Chair Executive Director Grants Financial Action and Discussion Items Approval of Minutes November 16, 2022 Quarterly Meeting Minutes Future ASC Public Hearings 60-Day Paperwork Reduction Act Notice for the Appraiser Survey Project How To Attend and Observe an ASC Meeting The meeting will be open to the public via live webcast only. Visit the agency’s homepage (www.asc.gov) and access the provided registration link in the News and Events section. The meeting space is intended to accommodate public attendees. However, if the space will not accommodate all requests, the ASC may refuse attendance on that reasonable basis. The use of any video or audio tape recording device, photographing device, or any other electronic or mechanical device designed for similar purposes is prohibited at ASC Meetings. James R. Park, Executive Director. Agreement Name: HMM/ONE PSX Space Charter Agreement. Parties: Hyundai Merchant Marine Co., Ltd.; Ocean Network Express, Pte. Ltd Filing Party: Joshua Stein, Cozen O’Connor. Synopsis: The Agreement authorizes HMM to charter space to ONE on HMM’s service in the trade between ports in the Republic of Korea and China on the one hand and ports on the U.S. Pacific Coast on the other hand. Proposed Effective Date: 3/3/2023. Location: https://www2.fmc.gov/ FMC.Agreements.Web/Public/ AgreementHistory/77502. Agreement No.: 201401. Agreement Name: WHL/HLAG Vessel Sharing Agreement. Parties: Hapag Lloyd AG; Wan Hai Lines Ltd and Wan Hai Lines (Singapore) Pte Ltd. Filing Party: Wayne Rohde, Cozen O’Connor. Synopsis: The Agreement authorizes the parties to share vessels in the trades between ports on the Atlantic Coast of the United States on the one hand and ports in China, Taiwan, Vietnam, Singapore, and Sri Lanka on the other hand. Proposed Effective Date: 3/3/2023. Location: https://www2.fmc.gov/ FMC.Agreements.Web/Public/ AgreementHistory/77503. [FR Doc. 2023–05211 Filed 3–13–23; 8:45 am] Dated: March 9, 2023. JoAnne O’Bryant, Program Analyst. BILLING CODE 6700–01–P [FR Doc. 2023–05186 Filed 3–13–23; 8:45 am] BILLING CODE 6730–02–P FEDERAL MARITIME COMMISSION FEDERAL MINE SAFETY AND HEALTH REVIEW COMMISSION ddrumheller on DSK120RN23PROD with NOTICES1 Notice of Agreements Filed The Commission hereby gives notice of filing of the following agreements under the Shipping Act of 1984. Interested parties may submit comments, relevant information, or documents regarding the agreements to the Secretary by email at Secretary@ fmc.gov, or by mail, Federal Maritime Commission, 800 North Capitol Street, Washington, DC 20573. Comments will be most helpful to the Commission if received within 12 days of the date this notice appears in the Federal Register, and the Commission requests that comments be submitted within 7 days on agreements that request expedited review. Copies of agreements are available through the Commission’s website (www.fmc.gov) or by contacting the Office of Agreements at (202)–523– 5793 or tradeanalysis@fmc.gov. Agreement No.: 201400. VerDate Sep<11>2014 21:09 Mar 13, 2023 Jkt 259001 Sunshine Act Meeting Notice 10 a.m., Tuesday, March 21, 2023. PLACE: The Richard V. Backley Hearing Room, Room 511, 1331 Pennsylvania Avenue NW, Suite 504 North, Washington, DC 20004 (enter from F Street entrance). STATUS: Open. MATTERS TO BE CONSIDERED: The Commission will consider and act upon the following in open session: Secretary of Labor on behalf of Smitherman v. Warrior Met Coal Mining LLC, Docket No. SE 2021–0153. (Issues include whether a miner was terminated in violation of section 105(c) of the Mine Act because the operator believed he was involved in making a safety complaint.) TIME AND DATE: PO 00000 Frm 00079 Fmt 4703 Sfmt 4703 15717 Any person attending this meeting who requires special accessibility features and/or auxiliary aids, such as sign language interpreters, must inform the Commission in advance of those needs. Subject to 29 CFR 2706.150(a)(3) and 2706.160(d). CONTACT PERSON FOR MORE INFO: Emogene Johnson (202) 434–9935/(202) 708–9300 for TDD Relay/1–800–877– 8339 for toll free. Phone Number for Listening to Meeting: 1-(866) 236–7472 Passcode: 678–100. (Authority: 5 U.S.C. 552b) Dated: March 10, 2023. Sarah L. Stewart, Deputy General Counsel. [FR Doc. 2023–05299 Filed 3–10–23; 11:15 am] BILLING CODE 6735–01–P FEDERAL TRADE COMMISSION [File No. 202 3169] BetterHelp, Inc.; Analysis of Proposed Consent Order To Aid Public Comment Federal Trade Commission. Proposed consent agreement; request for comment. AGENCY: ACTION: The consent agreement in this matter settles alleged violations of federal law prohibiting unfair or deceptive acts or practices. The attached Analysis of Proposed Consent Order to Aid Public Comment describes both the allegations in the complaint and the terms of the consent order—embodied in the consent agreement—that would settle these allegations. DATES: Comments must be received on or before April 13, 2023. ADDRESSES: Interested parties may file comments online or on paper by following the instructions in the Request for Comment part of the SUPPLEMENTARY INFORMATION section below. Please write ‘‘BetterHelp, Inc.; File No. 202 3169’’ on your comment and file your comment online at https:// www.regulations.gov by following the instructions on the web-based form. If you prefer to file your comment on paper, please mail your comment to the following address: Federal Trade Commission, Office of the Secretary, 600 Pennsylvania Avenue NW, Suite CC–5610 (Annex P), Washington, DC 20580. SUMMARY: FOR FURTHER INFORMATION CONTACT: Miles Plant (202–326–2526), Bureau of Consumer Protection, Federal Trade Commission, 600 Pennsylvania Avenue NW, Washington, DC 20580. E:\FR\FM\14MRN1.SGM 14MRN1 15718 Federal Register / Vol. 88, No. 49 / Tuesday, March 14, 2023 / Notices Pursuant to section 6(f) of the Federal Trade Commission Act, 15 U.S.C. 46(f), and FTC Rule § 2.34, 16 CFR 2.34, notice is hereby given that the above-captioned consent agreement containing a consent order to cease and desist, having been filed with and accepted, subject to final approval, by the Commission, has been placed on the public record for a period of 30 days. The following Analysis to Aid Public Comment describes the terms of the consent agreement and the allegations in the complaint. An electronic copy of the full text of the consent agreement package can be obtained at https://www.ftc.gov/newsevents/commission-actions. You can file a comment online or on paper. For the Commission to consider your comment, we must receive it on or before April 13, 2023. Write ‘‘BetterHelp, Inc.; File No. 202 3169’’ on your comment. Your comment— including your name and your state— will be placed on the public record of this proceeding, including, to the extent practicable, on the https:// www.regulations.gov website. Because of heightened security screening, postal mail addressed to the Commission will be subject to delay. We strongly encourage you to submit your comments online through the https:// www.regulations.gov website. If you prefer to file your comment on paper, write ‘‘BetterHelp, Inc.; File No. 202 3169’’ on your comment and on the envelope, and mail your comment to the following address: Federal Trade Commission, Office of the Secretary, 600 Pennsylvania Avenue NW, Suite CC–5610 (Annex P), Washington, DC 20580. Because your comment will be placed on the publicly accessible website at https://www.regulations.gov, you are solely responsible for making sure your comment does not include any sensitive or confidential information. In particular, your comment should not include sensitive personal information, such as your or anyone else’s Social Security number; date of birth; driver’s license number or other state identification number, or foreign country equivalent; passport number; financial account number; or credit or debit card number. You are also solely responsible for making sure your comment does not include sensitive health information, such as medical records or other individually identifiable health information. In addition, your comment should not include any ‘‘trade secret or any commercial or financial information which . . . is privileged or confidential’’—as provided by section ddrumheller on DSK120RN23PROD with NOTICES1 SUPPLEMENTARY INFORMATION: VerDate Sep<11>2014 21:09 Mar 13, 2023 Jkt 259001 6(f) of the FTC Act, 15 U.S.C. 46(f), and FTC Rule § 4.10(a)(2), 16 CFR 4.10(a)(2)—including competitively sensitive information such as costs, sales statistics, inventories, formulas, patterns, devices, manufacturing processes, or customer names. Comments containing material for which confidential treatment is requested must be filed in paper form, must be clearly labeled ‘‘Confidential,’’ and must comply with FTC Rule § 4.9(c). In particular, the written request for confidential treatment that accompanies the comment must include the factual and legal basis for the request and must identify the specific portions of the comment to be withheld from the public record. See FTC Rule § 4.9(c). Your comment will be kept confidential only if the General Counsel grants your request in accordance with the law and the public interest. Once your comment has been posted on the https://www.regulations.gov website—as legally required by FTC Rule § 4.9(b)— we cannot redact or remove your comment from that website, unless you submit a confidentiality request that meets the requirements for such treatment under FTC Rule § 4.9(c), and the General Counsel grants that request. Visit the FTC website at https:// www.ftc.gov to read this document and the news release describing the proposed settlement. The FTC Act and other laws the Commission administers permit the collection of public comments to consider and use in this proceeding, as appropriate. The Commission will consider all timely and responsive public comments it receives on or before April 13, 2023. For information on the Commission’s privacy policy, including routine uses permitted by the Privacy Act, see https://www.ftc.gov/site-information/ privacy-policy. Analysis of Proposed Consent Order To Aid Public Comment The Federal Trade Commission (the ‘‘Commission’’) has accepted, subject to final approval, an agreement containing a consent order from BetterHelp, Inc. (‘‘Respondent’’ or ‘‘BetterHelp’’). The proposed consent order (‘‘Proposed Order’’) has been placed on the public record for thirty (30) days for receipt of comments from interested persons. Comments received during this period will become part of the public record. After thirty (30) days, the Commission will again review the agreement, along with any comments received, and will decide whether it should withdraw from the agreement and take appropriate action or make final the Proposed Order. PO 00000 Frm 00080 Fmt 4703 Sfmt 4703 BetterHelp is an online mental health counseling service that matches consumers with one of BetterHelp’s over 25,000 contracted licensed therapists. Through BetterHelp’s websites and apps, consumers can communicate with therapists via video conferencing, text messaging, live chat, and audio calls. BetterHelp has offered this service under several names, including BetterHelp Counseling, Faithful Counseling, Pride Counseling, ReGain, Terappeuta, iCounseling, and MyTherapist. To sign up for BetterHelp’s counseling service, a consumer must complete an online intake questionnaire containing detailed questions about the consumer’s mental health status and history (the ‘‘Intake Questionnaire’’). Following completion of the Intake Questionnaire, the consumer can create an account by providing their name or nickname, email address, phone number, and emergency contact information. As consumers progressed through the Intake Questionnaire, BetterHelp represented that the consumers’ information ‘‘will stay private between you and your counselor.’’ Similarly, when a consumer completed the Intake Questionnaire and signed up for an account to use Faithful Counseling, Pride Counseling, or Teen Counseling, BetterHelp represented that the consumer’s email address would be ‘‘kept strictly private’’ and ‘‘never shared, sold or disclosed to anyone.’’ BetterHelp made additional privacy guarantees in its privacy policies—first implicitly and then explicitly—of limited use and limited disclosure of consumers’ email addresses, IP addresses, and health information. Despite representing to consumers that BetterHelp would keep consumers’ information private and only use their information for non-advertising purposes, BetterHelp used and disclosed information obtained from consumers through the Intake Questionnaire and sign-up process for advertising. Additionally, BetterHelp prominently displayed a seal—in close proximity to several other seals provided by third parties—that attested to BetterHelp’s purported compliance with the Health Insurance Portability and Accountability Act of 1996 (‘‘HIPAA’’), a statute that sets forth privacy and information security protections for health information. In addition, BetterHelp represented to consumers that it was in fact ‘‘HIPAA certified,’’ with its customer service representatives informing consumers that ‘‘[y]ou will also be able to see our HIPAA certification at the bottom of’’ E:\FR\FM\14MRN1.SGM 14MRN1 Federal Register / Vol. 88, No. 49 / Tuesday, March 14, 2023 / Notices ddrumheller on DSK120RN23PROD with NOTICES1 our web pages. However, no government agency or other third party had reviewed BetterHelp’s information practices for compliance with HIPAA, let alone determined that the practices met the requirements of HIPAA. The Commission’s proposed eightcount complaint alleges that BetterHelp violated section 5(a) of the Federal Trade Commission Act by: (1) unfairly failing to employ reasonable measures to protect consumers’ health information in connection with the collection, use, and disclosure of that information (Count I); (2) unfairly failing to obtain consumers’ affirmative express consent prior to collecting, using, and disclosing consumers’ health information (Count II); (3) failing to disclose that it shared consumers’ health information with third parties for BetterHelp’s advertising purposes and the recipient third parties’ own business purposes, and failing to disclose that BetterHelp used consumers’ health information to target the consumers and others with advertisements (Counts III and IV); (4) misrepresenting that it would not disclose consumers’ health information to third parties for advertising and the recipient third parties’ own business purposes, that it would not use such information for advertising or advertising-related purposes, and that it would not share such information with anyone except each consumer’s licensed therapist (Counts V–VII); and (5) misrepresenting that a governmental agency or third party had reviewed BetterHelp’s practices and determined that such practices met the requirements of HIPAA (Count VIII). Summary of Proposed Order With BetterHelp The Proposed Order contains provisions designed to prevent BetterHelp from engaging in the same or similar acts or practices in the future. Part I of the Proposed Order prohibits BetterHelp from sharing individually identifiable information relating to the past, present, or future physical or mental health or condition(s) of a consumer with any third party (i.e., any party other than BetterHelp, its service providers, therapists or counselors employed by or contracted with BetterHelp, certain employee benefit programs, and entities using consumers’ information for other very limited purposes) for advertising. Part I also prohibits BetterHelp from sharing consumers’ personal information more generally with Third Parties for the purpose of re-targeting (i.e., sharing personal information of consumers who have previously engaged with VerDate Sep<11>2014 21:09 Mar 13, 2023 Jkt 259001 BetterHelp, such as by visiting one of its websites or using one of its apps, to send advertisements to those consumers). Part II of the Proposed Order requires that, before it can share a consumers’ personal information with a third party for any purpose that is not prohibited under part I, BetterHelp must obtain that consumer’s affirmative express consent, which includes informing the consumer of the information to be disclosed, the third parties that will receive the information, and how the information will be used. Part III of the Proposed Order prohibits BetterHelp from misrepresenting: (1) the extent to which it collects, maintains, uses, discloses, deletes, or permits or denies access to any Covered Information, or the extent to which it protects the privacy, security, availability, confidentiality, or integrity of Covered Information; (2) the purposes for which BetterHelp or any entity to whom it discloses or permits access to Covered Information collects, maintains, uses, discloses, or permits access to such information; (3) the extent to which a consumer can maintain privacy and anonymity when visiting or using BetterHelp’s online properties; (4) the extent to which consumers may exercise control over BetterHelp’s collection of, maintenance of, use of, deletion of, disclosure of, or permission of access to Covered Information; (5) the extent to which BetterHelp is a member of, adheres to, complies with, is certified by, is endorsed by, or otherwise participates in any privacy, security or any other compliance program sponsored by a government or any self-regulatory or standard-setting organization; and (6) the extent to which BetterHelp is covered by HIPAA, and the extent that its privacy and information practices are in compliance with HIPAA requirements. Part IV of the Proposed Order requires BetterHelp to identify to the Commission which third parties received consumers’ personal information from BetterHelp without their consent and what personal information each such third party received. Part IV also requires that BetterHelp then ask those third parties to delete such personal information. Part V of the Proposed Order requires that BetterHelp provide notice to consumers who created an account with BetterHelp prior to January 1, 2021, that BetterHelp may have used and disclosed their personal information for advertising. Part VI requires BetterHelp to establish and implement, and thereafter maintain, a comprehensive privacy program that protects the PO 00000 Frm 00081 Fmt 4703 Sfmt 4703 15719 privacy, security, availability, confidentiality, and integrity of consumers’ Covered Information (as defined in the Proposed Order). Part VII of the Proposed Order requires BetterHelp to obtain initial and biennial privacy assessments by an independent, third-party professional (‘‘Assessor’’) for 20 years, and part VIII requires BetterHelp to cooperate with the Assessor in connection with the assessments required by part VII. Part IX of the Proposed Order requires that a BetterHelp executive certify the company’s compliance with the Proposed Order. Part X of the Proposed Order requires BetterHelp to notify the Commission following the discovery of a violation of parts I, II, or III of the Proposed Order. Part XI of the Proposed Order requires BetterHelp to pay $7,800,000 in monetary relief for consumer redress, and part XII describes the procedures and legal rights related to that payment. Part XIII of the Proposed Order requires BetterHelp to provide information to, and pay for, an independent redress administrator (‘‘Administrator’’) selected by the Commission, which will be responsible for administration of consumer redress. Parts XIV through XVII of the Proposed Order are reporting and compliance provisions, which include recordkeeping requirements and provisions requiring BetterHelp to provide information or documents necessary for the Commission to monitor compliance. Part XVIII states that the Proposed Order will remain in effect for twenty (20) years, with certain exceptions. The purpose of this analysis is to aid public comment on the Proposed Order. It is not intended to constitute an official interpretation of the complaint or Proposed Order, or to modify in any way the Proposed Order’s terms. By direction of the Commission. April J. Tabor, Secretary. Concurring Statement of Commissioner Christine S. Wilson Today the Commission announces a consent agreement with BetterHelp resolving allegations that it failed to protect consumers’ health information and failed to disclose or misrepresented its marketing practices. I support the allegations in the proposed complaint and the relief in the negotiated consent. The complaint explains that BetterHelp provides an online counseling service that matches users with the respondent’s therapists and facilitates counseling via its websites E:\FR\FM\14MRN1.SGM 14MRN1 15720 Federal Register / Vol. 88, No. 49 / Tuesday, March 14, 2023 / Notices ddrumheller on DSK120RN23PROD with NOTICES1 and apps. Millions of consumers have used the service and provided BetterHelp with sensitive personal information regarding their health status and history, in addition to their name, email address, and IP address. Contrary to its repeated representations to keep this information private, the complaint explains that BetterHelp monetized consumers’ health information to target them and others with advertisements. To this end, Respondent provided sensitive consumer health information to third-party advertising platforms including Facebook, Pinterest, Snapchat, and Criteo. I agree that this alleged conduct violates Section 5 of the FTC Act. Notably, the complaint does not include an allegation that BetterHelp violated the Health Breach Notification Rule (HBNR or Rule). I support this careful approach to the application of the Rule, particularly given the FTC Policy Statement on Breaches by Health Apps and Other Connected Devices (Policy Statement). The Commission, in a 3–2 party-line vote, issued this Policy Statement in September 2021.1 I dissented 2 because the Policy Statement included a novel expansion of the application of the Rule that contradicted earlier business guidance 3 and was issued during the pendency of the ongoing HBNR rulemaking proceeding.4 One could argue that BetterHelp would fall within the ambit of the HBNR because it offers a health platform and app, particularly under the expansive view espoused in the Policy Statement. I am pleased to see that the Commission has not taken this approach.5 1 FTC Policy Statement on Breaches by Health Apps and Other Connected Devices (Sept. 15, 2021), https://www.ftc.gov/news-events/eventscalendar/open-commission-meeting-september-152021. 2 Dissenting Statement of Commissioner Christine S. Wilson, Policy Statement on Breaches by Health Apps and Other Connected Devices (Sept. 15 2021), https://www.ftc.gov/system/files/documents/ public_statements/1596356/wilson_health_apps_ policy_statement_dissent_combined_final.pdf. 3 See Exhibit A, Dissenting Statement of Commissioner Christine S. Wilson, Policy Statement on Breaches by Health Apps and Other Connected Devices (Sept. 15, 2021) (prior Commission business guidance on the HBNR), https://www.ftc.gov/system/files/documents/ public_statements/1596356/wilson_health_apps_ policy_statement_dissent_combined_final.pdf. 4 Health Breach Notification Rule, Request for Public Comment, 85 FR 31085 (May 22, 2020). 5 This is especially appropriate because, according to the complaint, BetterHelp’s violative conduct ceased in December 2020, before the issuance of the Policy Statement. I recently supported the application of the Rule to the conduct in the GoodRx matter because the alleged conduct at issue there fell squarely within the scope of the HBNR as drafted. See Concurring Statement of Commissioner Christine S. Wilson, GoodRx (Feb. VerDate Sep<11>2014 21:09 Mar 13, 2023 Jkt 259001 The information BetterHelp collects from consumers and provides to therapists on its platform does not constitute a personal health record of identifiable health information under the Rule because it does not include records that ‘‘can be drawn from multiple sources,’’ as required by the existing formulation of the Rule.6 A consumer provides his or her information to BetterHelp but the company does not pull additional health information from another source or vendor. For this reason, foregoing an HBNR count is appropriate. I note further that I support the imposition of monetary relief in this matter. BetterHelp told consumers: ‘‘Rest assured—your health information will stay private between you and your counselor’’ but, as alleged, shared this highly sensitive information with third parties for the purpose of monetizing it. I am comfortable that this conduct falls within our authority to seek relief under Section 19 of the FTC Act. I commend the staff on the successful resolution of this matter. [FR Doc. 2023–05139 Filed 3–13–23; 8:45 am] BILLING CODE 6750–01–P [Notice–ID–2023–03; Docket No. 2023–0002; Sequence No. 9] Privacy Act of 1974; Notice of a Modified System of Records Office of the Chief Information Officer, General Services Administration (GSA). ACTION: Notice of a modified system of records. AGENCY: GSA proposes to modify a system of records subject to the Privacy Act of 1974. GSA is modifying the notice to update the system name to ‘‘Office of the Chief Financial Officer’s (OCFO) Imaging/Workflow Solution’’. It is a subsystem within the Ancillary Corporate Applications (ACA) at GSA. OCFO’s Imaging/Workflow Solution allows users in the Payroll Services Branch, Accounts Payable and customer agencies to annotate metadata to scanned images, and search and view documents (i.e., invoices, payroll, property records, deeds, transfers) that have been scanned/stored. SUMMARY: 3, 2023), https://www.ftc.gov/legal-library/browse/ cases-proceedings/public-statements/goodrxconcurring-statement-commissioner-christinewilson. 6 See 16 CFR 318.2(d); 42 U.S.C. 1320d(6). Frm 00082 Fmt 4703 GSA proposes to modify a system of records subject to the Privacy Act of 1974, 5 U.S.C. 552a. Office of the Chief Financial Officer’s (OCFO) Imaging/ Workflow Solution (previously named ImageNow), is the subsystem within the Ancillary Corporate Applications (ACA) at GSA. Please refer to the SORN link below: https://www.federalregister.gov/ documents/2009/08/10/E9-19102/ privacy-act-of-1974-notice-of-newsystem-of-records. SUPPLEMENTARY INFORMATION: GENERAL SERVICES ADMINISTRATION PO 00000 Submit comments on or before April 13, 2023. The new and/or significantly modified routine uses will be applicable on April 13, 2023. ADDRESSES: Submit comments by any of the following methods: • Regulations.gov: https:// www.regulations.gov. Search for Notice– ID–2023–03, Rescindment of a System of Records Notice. Select the link ‘‘Comment Now’’ that corresponds with ‘‘Notice–ID–2023–03, Rescindment of a System of Records Notice.’’ Follow the instructions provided on the screen. Please include your name, company name (if any), and ‘‘Notice–ID–2023–03, Rescindment of a System of Records Notice’’ on your attached document. • By email to the GSA Privacy Act Officer: gsa.privacyact@gsa.gov. • By mail to: Privacy Office (IDE), GSA, 1800 F Street NW, Washington, DC 20405. FOR FURTHER INFORMATION CONTACT: Call or email Richard Speidel, the GSA Chief Privacy Officer (Office of the Deputy Chief Information Officer): telephone 202–969–5830; email gsa.privacyact@ gsa.gov. DATES: Sfmt 4703 SYSTEM NAME AND NUMBER: OCFO Imaging/Workflow Solution GSA/PPFM–12. SECURITY CLASSIFICATION: Unclassified. SYSTEM LOCATION: The system is maintained in Kansas City, MO, in the Financial Administrative Systems Division (BDT). SYSTEM MANAGER: Director, Financial and Payroll Services Division, OCFO, GSA (BCE), 1500 E Bannister Road, Kansas City, MO 66085. AUTHORITY FOR MAINTENANCE OF THE SYSTEM: 5 U.S.C. Part III, Subparts D and E, 26 U.S.C. Chapter 24 and 2501, and Executive Order 9397, and the Chief Financial Officers (CFO) Act of 1990 (Pub. L. 101–576) as amended (Chapter 9 of Title 31 of the U.S. Code (2009)). E:\FR\FM\14MRN1.SGM 14MRN1

Agencies

[Federal Register Volume 88, Number 49 (Tuesday, March 14, 2023)]
[Notices]
[Pages 15717-15720]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2023-05139]


=======================================================================
-----------------------------------------------------------------------

FEDERAL TRADE COMMISSION

[File No. 202 3169]


BetterHelp, Inc.; Analysis of Proposed Consent Order To Aid 
Public Comment

AGENCY: Federal Trade Commission.

ACTION: Proposed consent agreement; request for comment.

-----------------------------------------------------------------------

SUMMARY: The consent agreement in this matter settles alleged 
violations of federal law prohibiting unfair or deceptive acts or 
practices. The attached Analysis of Proposed Consent Order to Aid 
Public Comment describes both the allegations in the complaint and the 
terms of the consent order--embodied in the consent agreement--that 
would settle these allegations.

DATES: Comments must be received on or before April 13, 2023.

ADDRESSES: Interested parties may file comments online or on paper by 
following the instructions in the Request for Comment part of the 
SUPPLEMENTARY INFORMATION section below. Please write ``BetterHelp, 
Inc.; File No. 202 3169'' on your comment and file your comment online 
at https://www.regulations.gov by following the instructions on the 
web-based form. If you prefer to file your comment on paper, please 
mail your comment to the following address: Federal Trade Commission, 
Office of the Secretary, 600 Pennsylvania Avenue NW, Suite CC-5610 
(Annex P), Washington, DC 20580.

FOR FURTHER INFORMATION CONTACT: Miles Plant (202-326-2526), Bureau of 
Consumer Protection, Federal Trade Commission, 600 Pennsylvania Avenue 
NW, Washington, DC 20580.

[[Page 15718]]


SUPPLEMENTARY INFORMATION: Pursuant to section 6(f) of the Federal 
Trade Commission Act, 15 U.S.C. 46(f), and FTC Rule Sec.  2.34, 16 CFR 
2.34, notice is hereby given that the above-captioned consent agreement 
containing a consent order to cease and desist, having been filed with 
and accepted, subject to final approval, by the Commission, has been 
placed on the public record for a period of 30 days. The following 
Analysis to Aid Public Comment describes the terms of the consent 
agreement and the allegations in the complaint. An electronic copy of 
the full text of the consent agreement package can be obtained at 
https://www.ftc.gov/news-events/commission-actions.
    You can file a comment online or on paper. For the Commission to 
consider your comment, we must receive it on or before April 13, 2023. 
Write ``BetterHelp, Inc.; File No. 202 3169'' on your comment. Your 
comment--including your name and your state--will be placed on the 
public record of this proceeding, including, to the extent practicable, 
on the https://www.regulations.gov website.
    Because of heightened security screening, postal mail addressed to 
the Commission will be subject to delay. We strongly encourage you to 
submit your comments online through the https://www.regulations.gov 
website. If you prefer to file your comment on paper, write 
``BetterHelp, Inc.; File No. 202 3169'' on your comment and on the 
envelope, and mail your comment to the following address: Federal Trade 
Commission, Office of the Secretary, 600 Pennsylvania Avenue NW, Suite 
CC-5610 (Annex P), Washington, DC 20580.
    Because your comment will be placed on the publicly accessible 
website at https://www.regulations.gov, you are solely responsible for 
making sure your comment does not include any sensitive or confidential 
information. In particular, your comment should not include sensitive 
personal information, such as your or anyone else's Social Security 
number; date of birth; driver's license number or other state 
identification number, or foreign country equivalent; passport number; 
financial account number; or credit or debit card number. You are also 
solely responsible for making sure your comment does not include 
sensitive health information, such as medical records or other 
individually identifiable health information. In addition, your comment 
should not include any ``trade secret or any commercial or financial 
information which . . . is privileged or confidential''--as provided by 
section 6(f) of the FTC Act, 15 U.S.C. 46(f), and FTC Rule Sec.  
4.10(a)(2), 16 CFR 4.10(a)(2)--including competitively sensitive 
information such as costs, sales statistics, inventories, formulas, 
patterns, devices, manufacturing processes, or customer names.
    Comments containing material for which confidential treatment is 
requested must be filed in paper form, must be clearly labeled 
``Confidential,'' and must comply with FTC Rule Sec.  4.9(c). In 
particular, the written request for confidential treatment that 
accompanies the comment must include the factual and legal basis for 
the request and must identify the specific portions of the comment to 
be withheld from the public record. See FTC Rule Sec.  4.9(c). Your 
comment will be kept confidential only if the General Counsel grants 
your request in accordance with the law and the public interest. Once 
your comment has been posted on the https://www.regulations.gov 
website--as legally required by FTC Rule Sec.  4.9(b)--we cannot redact 
or remove your comment from that website, unless you submit a 
confidentiality request that meets the requirements for such treatment 
under FTC Rule Sec.  4.9(c), and the General Counsel grants that 
request.
    Visit the FTC website at https://www.ftc.gov to read this document 
and the news release describing the proposed settlement. The FTC Act 
and other laws the Commission administers permit the collection of 
public comments to consider and use in this proceeding, as appropriate. 
The Commission will consider all timely and responsive public comments 
it receives on or before April 13, 2023. For information on the 
Commission's privacy policy, including routine uses permitted by the 
Privacy Act, see https://www.ftc.gov/site-information/privacy-policy.

Analysis of Proposed Consent Order To Aid Public Comment

    The Federal Trade Commission (the ``Commission'') has accepted, 
subject to final approval, an agreement containing a consent order from 
BetterHelp, Inc. (``Respondent'' or ``BetterHelp''). The proposed 
consent order (``Proposed Order'') has been placed on the public record 
for thirty (30) days for receipt of comments from interested persons. 
Comments received during this period will become part of the public 
record. After thirty (30) days, the Commission will again review the 
agreement, along with any comments received, and will decide whether it 
should withdraw from the agreement and take appropriate action or make 
final the Proposed Order.
    BetterHelp is an online mental health counseling service that 
matches consumers with one of BetterHelp's over 25,000 contracted 
licensed therapists. Through BetterHelp's websites and apps, consumers 
can communicate with therapists via video conferencing, text messaging, 
live chat, and audio calls. BetterHelp has offered this service under 
several names, including BetterHelp Counseling, Faithful Counseling, 
Pride Counseling, ReGain, Terappeuta, iCounseling, and MyTherapist.
    To sign up for BetterHelp's counseling service, a consumer must 
complete an online intake questionnaire containing detailed questions 
about the consumer's mental health status and history (the ``Intake 
Questionnaire''). Following completion of the Intake Questionnaire, the 
consumer can create an account by providing their name or nickname, 
email address, phone number, and emergency contact information.
    As consumers progressed through the Intake Questionnaire, 
BetterHelp represented that the consumers' information ``will stay 
private between you and your counselor.'' Similarly, when a consumer 
completed the Intake Questionnaire and signed up for an account to use 
Faithful Counseling, Pride Counseling, or Teen Counseling, BetterHelp 
represented that the consumer's email address would be ``kept strictly 
private'' and ``never shared, sold or disclosed to anyone.'' BetterHelp 
made additional privacy guarantees in its privacy policies--first 
implicitly and then explicitly--of limited use and limited disclosure 
of consumers' email addresses, IP addresses, and health information. 
Despite representing to consumers that BetterHelp would keep consumers' 
information private and only use their information for non-advertising 
purposes, BetterHelp used and disclosed information obtained from 
consumers through the Intake Questionnaire and sign-up process for 
advertising.
    Additionally, BetterHelp prominently displayed a seal--in close 
proximity to several other seals provided by third parties--that 
attested to BetterHelp's purported compliance with the Health Insurance 
Portability and Accountability Act of 1996 (``HIPAA''), a statute that 
sets forth privacy and information security protections for health 
information. In addition, BetterHelp represented to consumers that it 
was in fact ``HIPAA certified,'' with its customer service 
representatives informing consumers that ``[y]ou will also be able to 
see our HIPAA certification at the bottom of''

[[Page 15719]]

our web pages. However, no government agency or other third party had 
reviewed BetterHelp's information practices for compliance with HIPAA, 
let alone determined that the practices met the requirements of HIPAA.
    The Commission's proposed eight-count complaint alleges that 
BetterHelp violated section 5(a) of the Federal Trade Commission Act 
by: (1) unfairly failing to employ reasonable measures to protect 
consumers' health information in connection with the collection, use, 
and disclosure of that information (Count I); (2) unfairly failing to 
obtain consumers' affirmative express consent prior to collecting, 
using, and disclosing consumers' health information (Count II); (3) 
failing to disclose that it shared consumers' health information with 
third parties for BetterHelp's advertising purposes and the recipient 
third parties' own business purposes, and failing to disclose that 
BetterHelp used consumers' health information to target the consumers 
and others with advertisements (Counts III and IV); (4) misrepresenting 
that it would not disclose consumers' health information to third 
parties for advertising and the recipient third parties' own business 
purposes, that it would not use such information for advertising or 
advertising-related purposes, and that it would not share such 
information with anyone except each consumer's licensed therapist 
(Counts V-VII); and (5) misrepresenting that a governmental agency or 
third party had reviewed BetterHelp's practices and determined that 
such practices met the requirements of HIPAA (Count VIII).

Summary of Proposed Order With BetterHelp

    The Proposed Order contains provisions designed to prevent 
BetterHelp from engaging in the same or similar acts or practices in 
the future. Part I of the Proposed Order prohibits BetterHelp from 
sharing individually identifiable information relating to the past, 
present, or future physical or mental health or condition(s) of a 
consumer with any third party (i.e., any party other than BetterHelp, 
its service providers, therapists or counselors employed by or 
contracted with BetterHelp, certain employee benefit programs, and 
entities using consumers' information for other very limited purposes) 
for advertising. Part I also prohibits BetterHelp from sharing 
consumers' personal information more generally with Third Parties for 
the purpose of re-targeting (i.e., sharing personal information of 
consumers who have previously engaged with BetterHelp, such as by 
visiting one of its websites or using one of its apps, to send 
advertisements to those consumers). Part II of the Proposed Order 
requires that, before it can share a consumers' personal information 
with a third party for any purpose that is not prohibited under part I, 
BetterHelp must obtain that consumer's affirmative express consent, 
which includes informing the consumer of the information to be 
disclosed, the third parties that will receive the information, and how 
the information will be used.
    Part III of the Proposed Order prohibits BetterHelp from 
misrepresenting: (1) the extent to which it collects, maintains, uses, 
discloses, deletes, or permits or denies access to any Covered 
Information, or the extent to which it protects the privacy, security, 
availability, confidentiality, or integrity of Covered Information; (2) 
the purposes for which BetterHelp or any entity to whom it discloses or 
permits access to Covered Information collects, maintains, uses, 
discloses, or permits access to such information; (3) the extent to 
which a consumer can maintain privacy and anonymity when visiting or 
using BetterHelp's online properties; (4) the extent to which consumers 
may exercise control over BetterHelp's collection of, maintenance of, 
use of, deletion of, disclosure of, or permission of access to Covered 
Information; (5) the extent to which BetterHelp is a member of, adheres 
to, complies with, is certified by, is endorsed by, or otherwise 
participates in any privacy, security or any other compliance program 
sponsored by a government or any self-regulatory or standard-setting 
organization; and (6) the extent to which BetterHelp is covered by 
HIPAA, and the extent that its privacy and information practices are in 
compliance with HIPAA requirements.
    Part IV of the Proposed Order requires BetterHelp to identify to 
the Commission which third parties received consumers' personal 
information from BetterHelp without their consent and what personal 
information each such third party received. Part IV also requires that 
BetterHelp then ask those third parties to delete such personal 
information.
    Part V of the Proposed Order requires that BetterHelp provide 
notice to consumers who created an account with BetterHelp prior to 
January 1, 2021, that BetterHelp may have used and disclosed their 
personal information for advertising. Part VI requires BetterHelp to 
establish and implement, and thereafter maintain, a comprehensive 
privacy program that protects the privacy, security, availability, 
confidentiality, and integrity of consumers' Covered Information (as 
defined in the Proposed Order).
    Part VII of the Proposed Order requires BetterHelp to obtain 
initial and biennial privacy assessments by an independent, third-party 
professional (``Assessor'') for 20 years, and part VIII requires 
BetterHelp to cooperate with the Assessor in connection with the 
assessments required by part VII. Part IX of the Proposed Order 
requires that a BetterHelp executive certify the company's compliance 
with the Proposed Order. Part X of the Proposed Order requires 
BetterHelp to notify the Commission following the discovery of a 
violation of parts I, II, or III of the Proposed Order.
    Part XI of the Proposed Order requires BetterHelp to pay $7,800,000 
in monetary relief for consumer redress, and part XII describes the 
procedures and legal rights related to that payment. Part XIII of the 
Proposed Order requires BetterHelp to provide information to, and pay 
for, an independent redress administrator (``Administrator'') selected 
by the Commission, which will be responsible for administration of 
consumer redress.
    Parts XIV through XVII of the Proposed Order are reporting and 
compliance provisions, which include recordkeeping requirements and 
provisions requiring BetterHelp to provide information or documents 
necessary for the Commission to monitor compliance. Part XVIII states 
that the Proposed Order will remain in effect for twenty (20) years, 
with certain exceptions.
    The purpose of this analysis is to aid public comment on the 
Proposed Order. It is not intended to constitute an official 
interpretation of the complaint or Proposed Order, or to modify in any 
way the Proposed Order's terms.

    By direction of the Commission.
April J. Tabor,
Secretary.

Concurring Statement of Commissioner Christine S. Wilson

    Today the Commission announces a consent agreement with BetterHelp 
resolving allegations that it failed to protect consumers' health 
information and failed to disclose or misrepresented its marketing 
practices. I support the allegations in the proposed complaint and the 
relief in the negotiated consent.
    The complaint explains that BetterHelp provides an online 
counseling service that matches users with the respondent's therapists 
and facilitates counseling via its websites

[[Page 15720]]

and apps. Millions of consumers have used the service and provided 
BetterHelp with sensitive personal information regarding their health 
status and history, in addition to their name, email address, and IP 
address. Contrary to its repeated representations to keep this 
information private, the complaint explains that BetterHelp monetized 
consumers' health information to target them and others with 
advertisements. To this end, Respondent provided sensitive consumer 
health information to third-party advertising platforms including 
Facebook, Pinterest, Snapchat, and Criteo. I agree that this alleged 
conduct violates Section 5 of the FTC Act.
    Notably, the complaint does not include an allegation that 
BetterHelp violated the Health Breach Notification Rule (HBNR or Rule). 
I support this careful approach to the application of the Rule, 
particularly given the FTC Policy Statement on Breaches by Health Apps 
and Other Connected Devices (Policy Statement). The Commission, in a 3-
2 party-line vote, issued this Policy Statement in September 2021.\1\ I 
dissented \2\ because the Policy Statement included a novel expansion 
of the application of the Rule that contradicted earlier business 
guidance \3\ and was issued during the pendency of the ongoing HBNR 
rulemaking proceeding.\4\
---------------------------------------------------------------------------

    \1\ FTC Policy Statement on Breaches by Health Apps and Other 
Connected Devices (Sept. 15, 2021), https://www.ftc.gov/news-events/events-calendar/open-commission-meeting-september-15-2021.
    \2\ Dissenting Statement of Commissioner Christine S. Wilson, 
Policy Statement on Breaches by Health Apps and Other Connected 
Devices (Sept. 15 2021), https://www.ftc.gov/system/files/documents/public_statements/1596356/wilson_health_apps_policy_statement_dissent_combined_final.pdf.
    \3\ See Exhibit A, Dissenting Statement of Commissioner 
Christine S. Wilson, Policy Statement on Breaches by Health Apps and 
Other Connected Devices (Sept. 15, 2021) (prior Commission business 
guidance on the HBNR), https://www.ftc.gov/system/files/documents/public_statements/1596356/wilson_health_apps_policy_statement_dissent_combined_final.pdf.
    \4\ Health Breach Notification Rule, Request for Public Comment, 
85 FR 31085 (May 22, 2020).
---------------------------------------------------------------------------

    One could argue that BetterHelp would fall within the ambit of the 
HBNR because it offers a health platform and app, particularly under 
the expansive view espoused in the Policy Statement. I am pleased to 
see that the Commission has not taken this approach.\5\
---------------------------------------------------------------------------

    \5\ This is especially appropriate because, according to the 
complaint, BetterHelp's violative conduct ceased in December 2020, 
before the issuance of the Policy Statement. I recently supported 
the application of the Rule to the conduct in the GoodRx matter 
because the alleged conduct at issue there fell squarely within the 
scope of the HBNR as drafted. See Concurring Statement of 
Commissioner Christine S. Wilson, GoodRx (Feb. 3, 2023), https://www.ftc.gov/legal-library/browse/cases-proceedings/public-statements/goodrx-concurring-statement-commissioner-christine-wilson.
---------------------------------------------------------------------------

    The information BetterHelp collects from consumers and provides to 
therapists on its platform does not constitute a personal health record 
of identifiable health information under the Rule because it does not 
include records that ``can be drawn from multiple sources,'' as 
required by the existing formulation of the Rule.\6\ A consumer 
provides his or her information to BetterHelp but the company does not 
pull additional health information from another source or vendor. For 
this reason, foregoing an HBNR count is appropriate.
---------------------------------------------------------------------------

    \6\ See 16 CFR 318.2(d); 42 U.S.C. 1320d(6).
---------------------------------------------------------------------------

    I note further that I support the imposition of monetary relief in 
this matter. BetterHelp told consumers: ``Rest assured--your health 
information will stay private between you and your counselor'' but, as 
alleged, shared this highly sensitive information with third parties 
for the purpose of monetizing it. I am comfortable that this conduct 
falls within our authority to seek relief under Section 19 of the FTC 
Act. I commend the staff on the successful resolution of this matter.

[FR Doc. 2023-05139 Filed 3-13-23; 8:45 am]
BILLING CODE 6750-01-P
This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.