Ingenix, Inc.

Text (OCR of the scan at left; may contain errors)

IN THE MATTER OF INGENIX, INC.

CONSENT ORDER, ETC., IN REGARD TO ALLEGED VIOLATIONS OF SEC. 5 OF THE FEDERAL TRADE COMMISSION ACT Docket C-4214; File No. 062 3190 Complaint, February 6, 2008 – Decision, February 6, 2008 This consent order relates to the failure of Ingenix, Inc., to provide the Notice To Users of Consumer Reports: Obligations of Users Under the FCRA, as required by the Fair Credit Reporting Act. The respondent markets MedPoint, a data aggregation service that provides individual medical profiles to health and life insurance companies. The order requires Ingenix to provide the Notice To Users to any user or prospective user of any medical profile generated by MedPoint that constitutes a consumer report, or of any other consumer report. The order requires the respondent to maintain reasonable procedures to limit the furnishing of consumer reports to those with a permissible purpose; to follow reasonable procedures to assure maximum possible accuracy of the information concerning the individuals about whom the reports relate; to maintain reasonable procedures to ensure compliance with Section 611 of the Fair Credit Reporting Act; to conduct a reasonable reinvestigation in cases of disputed accuracy; and to comply with the Disposal of Consumer Report Information and Records Rule. The order also requires the respondent to maintain and upon request make available to the Commission documents demonstrating compliance with the requirements of the order. In addition, the respondent is required to distribute copies of the order to various principals, officers, directors, and managers, employees, agents, and representatives having decision-making responsibilities with respect to MedPoint or any other consumer report; to notify the Commission of any changes in corporate structure that might affect compliance with the order; and to file reports with the Commission detailing its compliance with the order. Participants For the Commission: Katherine Armstrong, Kathleen Benway, Rebecca E. Kuehn, Karen Leonard, and Joel Winston. For the Respondent: Skip Durocher, Dorsey and Whitney, LLP.

VOLUME 145 Complaint COMPLAINT The Federal Trade Commission, having reason to believe that Ingenix, Inc. (“respondent”), has violated provisions of the Fair Credit Reporting Act, 15 U.S.C. § 1681 et seq., and the Federal Trade Commission Act, 15 U.S.C. § 41 et seq., and it appearing to the Commission that this proceeding is in the public interest, alleges: 1. Respondent, a wholly owned subsidiary of Unitedhealth Group Incorporated, is a Delaware corporation with its principal office or place of business located at 12125 Technology Drive, Eden Prairie, Minnesota.

2. Since at least 2003, respondent has marketed MedPoint, a data aggregation service that provides individual medical profiles, including, but not limited to the prescription drug purchase histories of insurance applicants to health and life insurance companies. 3. Respondent has contractual relationships with insurance companies that use MedPoint for underwriting or claims review purposes. These insurance companies require applicants to sign a consent form, which authorizes the insurance company or its agents to access the consumer’s health and medical records, including prescription drug records.

4. Respondent has contractual relationships with Pharmacy Benefit Managers (“PBM”), which maintain records of individuals’ prescription drug histories. Respondent obtains an insurance applicant’s five-year prescription drug history from the PBMs and creates a prescription medical profile on the applicant for the insurance company. The medical profile generated by MedPoint includes, but is not limited to, prescription drugs, including dosage and number of refills filled by the insurance applicant for the previous five years. It also includes for each drug, the name and address of the dispensing pharmacy, as well as the name and address of the prescribing doctor, including specialty medical practice. The medical profile generated by MedPoint analyzes the individual’s prescription drug history, and provides, based on that analysis, INGENIX, INC. 73 Complaint potential medical conditions that may be present and predictive scores for the individual.

5. The medical profile generated by MedPoint is a consumer report as that term is defined in Section 603(d) of the Fair Credit Reporting Act, 15 U.S.C. § 1681a(d), because it bears on a consumer’s credit worthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living, which is used or expected to be used or collected in whole or in part for the purpose of serving as a factor in establishing a consumer’s eligibility for credit or insurance. 6. In providing medical profiles generated by MedPoint to insurers, respondent is now and has been a consumer reporting agency, as that term is defined in Section 603(f) of the Fair Credit Reporting Act, 15 U.S.C. § 1681a(f), because it regularly engages in the practice of assembling or evaluating consumer credit information or other information on consumers for the purpose of furnishing consumer reports to third parties for monetary fees, dues, or on a cooperative nonprofit basis. Respondent furnishes these consumer reports to third parties through the means or facilities of interstate commerce.

7. Section 607(d) of the Fair Credit Reporting Act, 15 U.S.C. § 1681e(d), requires that any consumer reporting agency provide, to any person to whom it provides a consumer report, a “Notice To Users of Consumer Reports: Obligations of Users Under the FCRA,” the required content of which is set forth in 16 CFR 698, Appendix H. Respondent has failed and continues to fail to provide this notice to insurance companies that purchase medical profiles generated by MedPoint.

8. By and through the practices described above, respondent has violated Section 607(d) of the Fair Credit Reporting Act, 15 U.S.C. §1681e(d).

VOLUME 145 Decision and Order 9. By its violation of Section 607(d) of the Fair Credit Reporting Act, and pursuant to Section 621(a) thereof, 15 U.S.C. § 1681s, respondent has engaged in unfair and deceptive acts and practices in or affecting commerce in violation of Section 5(a)(1) of the Federal Trade Commission Act, 15 U.S.C. § 45(a). THEREFORE, the Federal Trade Commission this sixth day of February, 2008, has issued this complaint against respondent. By the Commission.

DECISION AND ORDER The Federal Trade Commission having initiated an investigation of certain acts and practices of the Respondent named in the caption hereof, and the Respondent having been furnished thereafter with a copy of a draft Complaint that the Bureau of Consumer Protection proposed to present to the Commission for its consideration and which, if issued by the Commission, would charge the Respondent with violation of the Fair Credit Reporting Act, 15 U.S.C. §1681 et seq;

The Respondent, its attorney, and counsel for the Commission having thereafter executed an Agreement Containing Consent Order (“Consent Agreement”), an admission by the Respondent of all the jurisdictional facts set forth in the aforesaid draft Complaint, a statement that the signing of said Consent Agreement is for settlement purposes only and does not constitute an admission by Respondent that the law has been violated as alleged in such Complaint, or that the facts as alleged in such Complaint, other than jurisdictional facts, are true, and waivers and other provision as required by the Commission’s Rules; and INGENIX, INC. 75 Decision and Order The Commission having thereafter considered the matter and having determined that it has reason to believe that the Respondent has violated the said Act, and that a Complaint should issue stating its charges in that respect, and having thereupon accepted the executed Consent Agreement and placed such Consent Agreement on the public record for a period of thirty (30) days, and having duly considered the comments filed thereafter by interested persons pursuant to Section 2.34 of its Rules, now in further conformity with the procedure described in Section 2.34 of its Rules, the Commission hereby issues its Complaint, makes the following jurisdictional findings and enters the following order: 1. Respondent Ingenix, Inc. is a Delaware corporation with its office and principal place of business at 12125 Technology Drive, Eden Prairie, Minnesota.

2. The Federal Trade Commission has jurisdiction of the subject matter of this proceeding and of the Respondent, and the proceeding is in the public interest.

ORDER DEFINITIONS For purposes of this order, the following definitions apply: “Respondent” means Ingenix, Inc., a corporation, its successors and assigns, and its officers, agents, representatives and employees acting in such capacity on its behalf, directly or through any corporation, subsidiary, division or other device. “MedPoint” means respondent’s data aggregation service that provides individual medical profiles, including prescription drug purchase histories, to health and life insurance companies. “FCRA” means the Fair Credit Reporting Act, 15 U.S.C. § 1681 et seq., as the same from time to time may be amended or modified VOLUME 145 Decision and Order by statute or by regulations having the effect of statutory provisions. The terms “consumer,” “consumer report,” and “consumer reporting agency,” shall be defined as provided in Section 603(c), 603(d) and 603(f), respectively of the FCRA, 15 U.S.C. §§ 1681a(c), 1681a(d) and 1681a(f).

“Notice To Users” is the notice referred to in Section 607(d) of the Fair Credit Reporting Act, 15 U.S.C. §1681e(d), 16 CFR 698, Appendix H.

I.

IT IS ORDERED that respondent, directly or through any corporation, subsidiary, division, or other device, in connection with the dissemination of any medical profile generated by MedPoint that constitutes a consumer report, or any other consumer report to any user or prospective user of such consumer report, shall as provided by Section 607(d) of the Fair Credit Reporting Act, 15 U.S.C. § 1681e(d), provide to such users or prospective users a Notice to Users.

II.

IT IS FURTHER ORDERED that respondent, in connection with the compilation, creation, sale, or dissemination of any medical profile generated by MedPoint that constitutes a consumer report, or any other consumer report, shall:

A. Maintain or continue to maintain reasonable procedures to limit the furnishing of such consumer report to those only with a permissible purpose, as required by Section 607(a) of the Fair Credit Reporting Act, 15 U.S.C. §1681e(a); B. Follow or continue to follow reasonable procedures to assure maximum possible accuracy of the information concerning the individuals about whom the reports relates, as required INGENIX, INC. 77 Decision and Order by Section 607(b) of the Fair Credit Reporting Act, 15 U.S.C. § 1681e(b);

C. Maintain or continue to maintain reasonable procedures to ensure compliance with Section 611 of the Fair Credit Reporting Act, 15 U.S.C. § 1681i, “Procedures in case of disputed accuracy;”

D. Conduct or continue to conduct a reasonable reinvestigation in cases of disputed accuracy, as required by Section 611 of the Fair Credit Reporting Act, 15 U.S.C. § 1681i; and E. Comply or continue to comply with the Disposal of Consumer Report Information and Records Rule, 16 C.F.R. Part 682.

III.

IT IS FURTHER ORDERED that respondent shall, for five (5) years, maintain and upon request make available to the Federal Trade Commission for inspection and copying documents demonstrating compliance with the requirements of Parts I and II of this order.

IV.

IT IS FURTHER ORDERED that respondent shall deliver a copy of this order to all current and future principals, officers, and directors, and to all current and future managers, employees, agents, and representatives having decision-making responsibilities with respect to MedPoint or any other consumer report, and shall secure from each such person a signed and dated statement acknowledging receipt of the order. Respondent shall deliver this order to such current personnel within thirty (30) days after the date of service of this order, and to such future personnel within thirty (30) days after the person assumes such position or responsibilities. VOLUME 145 Decision and Order V.

IT IS FURTHER ORDERED that respondent and its successors and assigns shall notify the Commission at least thirty (30) days prior to any change in the corporation that may affect compliance obligations arising under this order, including but not limited to a dissolution, assignment, sale, merger, or other action that would result in the emergence of a successor corporation; the creation or dissolution of a subsidiary, parent, or affiliate that engages in any acts or practices subject to this order; the proposed filing of a bankruptcy petition; or a change in the corporate name or address. Provided, however, that, with respect to any proposed change in the corporation about which respondent learns less than thirty (30) days prior to the date such action is to take place, respondent shall notify the Commission as soon as it is practicable after obtaining such knowledge. All notices required by this Part shall be sent by certified mail to the Associate Director, Division of Enforcement, Bureau of Consumer Protection, Federal Trade Commission, 600 Pennsylvania Avenue, N.W., Washington, D.C. 20580.

VI.

IT IS FURTHER ORDERED that respondent shall within sixty (60) days after the date of service of this order, and at such other times as the Federal Trade Commission may require, file with the Commission a report, in writing, setting forth in detail the manner and form in which it has complied with this order. VII.

This order will terminate on February 6, 2028, or twenty (20) years from the most recent date that the United States or the Federal Trade Commission files a complaint (with or without an accompanying consent decree) in federal court alleging any violation of the order, whichever comes later; provided, however, that the filing of such a complaint will not affect the duration of: INGENIX, INC. 79 Analysis to Aid Public Comment A. Any Part in this order that terminates in less than twenty (20) years;

B. This order’s application to any respondent that is not named as a defendant in such complaint; and C. This order if such complaint is filed after the order has terminated pursuant to this Part.

Provided, further, that if such complaint is dismissed or a federal court rules that the respondent did not violate any provision of the order, and the dismissal or ruling is either not appealed or upheld on appeal, then the order will terminate according to this Part as though the complaint had never been filed, except that the order will not terminate between the date such complaint is filed and the later of the deadline for appealing such dismissal or ruling and the date such dismissal or ruling is upheld on appeal. By the Commission.

ANALYSIS OF CONSENT ORDER TO AID PUBLIC COMMENT The Federal Trade Commission has accepted, subject to final approval, an agreement containing a consent order from Ingenix, Inc. (“respondent” or “Ingenix”).

The proposed consent order has been placed on the public record for thirty (30) days for receipt of comments by interested persons. Comments received during this period will become part of the public record. After thirty (30) days, the Commission will again review the agreement and the comments received, and will decide whether it VOLUME 145 Analysis to Aid Public Comment should withdraw from the agreement or make final the agreement’s proposed order.

Ingenix markets MedPoint, a data aggregation service that provides individual medical profiles to health and life insurance companies. Insurance companies use MedPoint for underwriting or claims review purposes. The medical profile generated by MedPoint analyzes the individual’s prescription drug history, and provides, based on that analysis, potential medical conditions that may be present and predictive scores for the individual. The Commission’s complaint alleges that the medical profile generated for the MedPoint service is a consumer report and that respondent is a consumer reporting agency, as those terms are defined in Sections 603(d) and (f) of the Fair Credit Reporting Act, 15 U.S.C. §§1681a(d) and (f). The complaint alleges that the respondent’s failure to provide the “Notice To Users of Consumer Reports: Obligations of Users Under the FCRA” (“Notice to Users”), the required content of which is found in 16 CFR 698, Appendix H, is a violation of Section 607(d) of the Fair Credit Reporting Act, 15 U.S.C. §1681e(d).

The proposed consent order contains provisions designed to prevent respondent from engaging in similar acts and practices in the future.

Part I of the proposed order requires respondent to provide the Notice To Users to any user or prospective user of any medical profile generated by MedPoint that constitutes a consumer report, or of any other consumer report.

Part II.A. of the proposed order requires respondent to maintain or continue to maintain reasonable procedures to limit the furnishing of consumer reports to those with a permissible purpose, as required by Section 607(a) of the Fair Credit Reporting Act, 15 U.S.C. § 1681e(a).

INGENIX, INC. 81 Analysis to Aid Public Comment Part II.B. of the proposed order requires respondent to follow or continue to follow reasonable procedures to assure maximum possible accuracy of the information concerning the individuals about whom the reports relates, as required by Section 607(b) of the Fair Credit Reporting Act, 15 U.S.C. §1681e(b). Part II.C. of the proposed order requires respondent to maintain or continue to maintain reasonable procedures to ensure compliance with Section 611 of the Fair Credit Reporting Act, 15 U.S.C. § 1681i, “Procedure in case of disputed accuracy.” Part II.D. of the proposed order requires respondent to conduct or continue to conduct a reasonable reinvestigation in cases of disputed accuracy, as required by Section 611 of the Fair Credit Reporting Act, 15 U.S.C. §1681i.

Part II.E. of the proposed order requires respondent to comply or continue to comply with the Disposal of Consumer Report Information and Records Rule, 16 C.F.R. Part 682. Part III of the proposed order contains a document retention requirement. It requires respondent to maintain and upon request make available to the Commission for inspection and copying documents demonstrating compliance with the requirements of Parts I and II of the proposed order.

Part IV of the proposed order requires respondent to distribute copies of the order to various principals, officers, directors, and managers, employees, agents, and representatives having decisionmaking responsibilities with respect to MedPoint or any other consumer report.

Part V of the proposed order requires respondent to notify the Commission of any changes in corporate structure that might affect compliance with the order.

VOLUME 145 Analysis to Aid Public Comment Part VI of the proposed order requires respondent to file with the Commission one or more reports detailing its compliance with the order.

Part VII of the proposed order is a “sunset” provision, dictating the conditions under which the order will terminate twenty years from the date it is issued or twenty years after a complaint is filed in federal court, by either the United States or the FTC, alleging any violation of the order.

The purpose of this analysis is to facilitate public comment on the proposed order. It is not intended to constitute an official interpretation of the proposed order or to modify in any way its terms.

HERBS NUTRITION CORPORATION 83 Complaint