Michael C. Hughes

Text (OCR of the scan at left; may contain errors)

IN THE MATTER OF MICHAEL C. HUGHES CONSENT ORDER, ETC. IN REGARD TO ALLEGED VIOLATION OF SEC. 5(A) OF THE FEDERAL TRADE COMMISSION ACT Docket No. C-4502; File No. 132 3088 Complaint, January 9, 2015 – Decision, January 9, 2015 This consent order addresses deceptive acts and practices regarding the collection of consumers’ sensitive health information from third parties. The respondent, Michael C. Hughes, served as CEO of a company that operated a website that enabled consumers to pay their medical bills. The complaint alleges Mr. Hughes misled thousands of consumers who signed up for the online billing portal by failing to adequately inform consumers that the company would use their information to obtain access to highly detailed medical information from pharmacies, medical labs and insurance companies. The consent order requires Mr. Hughes to destroy any collected information. In addition, Mr. Hughes is banned from deceiving consumers about the way information is collected and used, including how such information might be shared with or collected from a third party. Further, Mr. Hughes must obtain consumers’ affirmative express consent before collecting health information about a consumer from a third party. The Commission entered a similar order against Mr. Hughes’ company, Payments MD, LLC. See 159 F.T.C. 241. Participants For the Commission: Jacquelie Connor, David Lincicum, and Kevin Moriarty.

For the Respondent: Lisa J. Sotto, Hunton & Williams LLP. COMPLAINT The Federal Trade Commission, having reason to believe that Michael C. Hughes (“Respondent”), individually, through his direction, control, and ownership of Paymentsmd, LLC (“Paymentsmd”) has violated the provisions of the Federal Trade Commission Act, and it appearing to the Commission that this proceeding is in the public interest, alleges: 1. Respondent Michael C. Hughes was the Chief Executive Officer, sole employee, and part owner of Paymentsmd, a Georgia limited liability company, until July 2014. Individually MICHAEL C. HUGHES 61 Complaint or in concert with others, he controlled or had the authority to control, or participated in the acts and practices alleged in this complaint. He resides in Atlanta, Georgia. 2. The acts and practices of respondent as alleged in this complaint have been in or affecting commerce, as “commerce” is defined in Section 4 of the Federal Trade Commission Act. PAYMENTSMD’S BUSINESS PRACTICES 3. From August 2008 to July 2014, respondent, through his direction and control of Paymentsmd, has provided billing services to medical providers. Medical providers that have contracted with Paymentsmd direct their patients to the Paymentsmd website, where consumers are able to enter their invoice number and credit card information to pay their medical bills.

4. In December 2011, respondent, through his direction and control of Paymentsmd, launched a free “Patient Portal” product that provided consumers with a place to view their billing history. Unlike the bill-payment service, which enables consumers only to make a one-time payment, the billing history service of the Patient Portal enables consumers to access and view records of the consumers’ past and upcoming payment obligations for any medical providers that use PaymentsMD’s billing services. The Patient Portal service enabled consumers to pay their bills and to view their balance, payments made, adjustments taken, and information for other service dates.

5. In June 2012, Paymentsmd entered into an agreement with Metis Health LLC (“Metis Health”) to develop an entirely new service called Patient Health Report, a fee-based service that would enable consumers to access, review, and manage their consolidated health records through a Patient Portal account. Paymentsmd and Metis Health agreed to split the profits. Both companies participated in developing the disclosures and authorizations for the service, and how and when this information would be presented to consumers during the Patient Portal registration process.

MICHAEL C. HUGHES 62 Complaint 6. As described further below, in order to populate the Patient Health Report, respondent, through his direction and control of Paymentsmd, tried to obtain the sensitive health information of consumers registering for the Patient Portal from health insurance plans, pharmacies, and a medical testing lab, without appropriate authorization from those consumers. Indeed, many consumers registering for the Patient Portal had no idea that Paymentsmd, under respondent’s direction and control, would seek to collect their sensitive health information from third parties for use in the Patient Health Report service. THE PATIENT PORTAL INTERFACE FAILED TO DISCLOSE THAT PAYMENTSMD WOULD COLLECT CONSUMERS’ SENSITIVE HEALTH INFORMATION FOR THE PATIENT HEALTH REPORT 7. PaymentsMD’s home page described the Patient Portal as a medical billing related service. It stated that “At Paymentsmd, we can help you navigate through the maze of medical billing, reimbursement and payment processes. We also make it easy for you to maintain current information about your insurance coverage and to make payments over the Internet, at your convenience.” In order to register for the Patient Portal, a consumer could click on a button labeled “Patient Portal Login.” (Exhibit A).

MICHAEL C. HUGHES 63 Complaint 8. Consumers could then either enter their login credentials or click on a link that stated “Don’t have an account? Create one now.” (See Exhibit B).

MICHAEL C. HUGHES 64 Complaint Consumers that followed the link would then be taken to the Payment Portal registration page, which appeared as follows. (Exhibit C).

The registration page stated that registering for the Payment Portal service would “allow you to: View your original balance; View any payments made; View any adjustments taken; View your current balance; View information for other service dates.” At no point in this process was it stated that Paymentsmd, under respondent’s direction and control, would be seeking consumers’ sensitive health information from third parties for use in a Patient Health Report service.

9. Consumers who clicked the “Submit” button were taken to a “Patient Portal Account Authorization” page, which required four authorizations. The page presented the authorizations in four boxes that showed only six lines of text at a time. (Exhibit D). MICHAEL C. HUGHES 65 Complaint Under each text box was a check box that consumers could select in order to proceed with the registration process. Alternatively, consumers could select a single box at the top of the page, which would populate all four boxes to indicate that each of the four was authorized. Although consumers who scrolled through the second and fourth boxes would have seen a statement that “[H]health records related to your treatment . . . may be used or disclosed pursuant to this Authorization,” the site design simultaneously made it hard to read the authorizations in their entirety, and easy to skip over them by clicking a single check box that preceded all of the authorizations.

MICHAEL C. HUGHES 66 Complaint 10. Consumers would reasonably believe that all four authorizations were to be used to provide the Patient Portal billing services for which they were registering. In fact, two of the four purported authorizations were used to collect sensitive health information from third parties for use with the Patient Health Report service.

11. Although PaymentsMD’s home page and login page included links that allowed consumers to “click here to learn more” about the Patient Health Report service (see Exhibit A), these links conveyed that the Patient Health Report was a separate service from the Patient Portal. At no point in registering for the Patient Portal would it have been clear to consumers that they were purportedly giving Paymentsmd permission to obtain their sensitive health information from third parties for use in the Patient Health Report service.

RESPONDENT, THROUGH HIS OWNERSHIP AND CONTROL OF PAYMENTSMD, SOUGHT CONSUMERS’ SENSITIVE HEALTH INFORMATION WITHOUT THEIR KNOWLEDGE OR CONSENT 12. Respondent, through his direction and control of Paymentsmd, requested sensitive health information from a large number of health plans, pharmacies, and a medical lab about everyone who registered for the Patient Portal. These requests used consumers’ name, birth date, address, and sex. The information requested was as follows:

a. Pharmacies: Medication dispensed, dispense date, instructions, prescription number, prescribing physician, quantity dispensed, refill ability, co-pay amount, amount payable as co-insurance or deductible, and amount paid by health plan.

b. Health plans: Medical information (procedures, diagnoses, dates of service, medical providers, co-pay amount, amount payable for co-insurance or deductible, and the amount paid by health plan); prescription information (medications dispensed, dispense dates, prescription number, prescribing MICHAEL C. HUGHES 67 Complaint physician, quantity dispensed, refill ability, co-pay amount, amount payable as coinsurance or deductible, and the amount paid by health plan); and lab information (test performed, date, laboratory, physician, co-pay, amount payable as co-insurance or deductible, and amount paid by health plan). c. Laboratory: Lab test performed, date, laboratory, test results, normal range for test values, ordering physician, co-pay, amount payable as co-insurance or deductible, and the amount paid by health plan. 13. Metis Health sent requests to health plans that were identified using PaymentsMD’s billing records. For the pharmacies, Metis Health sent requests to all major commercial pharmacies with locations near the consumers’ home address, notwithstanding that neither Paymentsmd nor Metis Health had any reason to believe that the consumer had used any of those pharmacies.

14. Metis Health sent approximately 5,500 requests for consumers’ health information to 31 different companies. One company fulfilled the requests. The others, concerned about the validity of the requests – which in some cases related to minors or consumers who were not in fact a customer of the company receiving the request – refused to fulfill the requests. PAYMENTMD’S SUBSEQUENT COMMUNICATIONS TO CONSUMERS GENERATED NUMEROUS COMPLAINTS 15. Initially, Paymentsmd did not inform consumers that Metis Health was attempting to collect their sensitive health information. When Paymentsmd, under respondent’s direction and control, began informing consumers, via an email sent a day after users registered for Patient Portal, numerous consumers filed complaints with Paymentsmd regarding the collection of their sensitive health information. The common themes of the complaints were that consumers did not want their information collected, and that they had only registered for the Patient Portal to track their bills. Paymentsmd ultimately did not sell any Patient Health Reports.

MICHAEL C. HUGHES 68 Complaint DECEPTIVE OMISSION (Count 1) 16. As described in Paragraphs 3-15, respondent, through his direction and control of Paymentsmd, represented, directly or indirectly, expressly or by implication, that consumers registering for the free Patient Portal billing service could access and review their medical payment history.

17. Respondent, through his direction and control of Paymentsmd, failed to disclose adequately that, if consumers registered for the free Patient Portal billing service, Paymentsmd would also engage in a comprehensive collection from third parties of consumers’ sensitive health information for the Patient Health Report service.

18. This fact would be material to consumers in deciding whether to register for the Patient Portal. Respondent’s failure to disclose adequately this fact, in light of the representations made, is a deceptive act or practice.

DECEPTIVE REPRESENTATION (Count 2) 19. As described in Paragraphs 3-15, respondent, through his direction and control of Paymentsmd, represented, directly or indirectly, expressly or by implication, that the authorizations were to be used exclusively to provide the free Patient Portal billing history service for which consumers were registering. 20. In fact, the authorizations were not used exclusively to provide the free Patient Portal billing history service for which consumers were registering. Instead, all of the authorizations were also used by Paymentsmd, under respondent’s direction and control, to attempt to collect sensitive health information for use with the Patient Health report service, and two were only used for this purpose. Therefore, this representation is false or misleading. VIOLATIONS OF SECTION 5 MICHAEL C. HUGHES 69 Complaint 21. The acts and practices of respondent as alleged in this complaint constitute deceptive acts or practices in or affecting commerce in violation of Section 5(a) of the Federal Trade Commission Act, 15 U.S.C. § 45(a).

THEREFORE, the Federal Trade Commission this ninth day of January, 2015, has issued this complaint against respondent. By the Commission.

MICHAEL C. HUGHES 70 Complaint EXHIBIT A _ ain 2. FAR Pn Di | + Sime = oan me + Peeve [Anton sens imeem Fema 1 Ie O&O Psp) Payments Snort prORENES PATNNT FORE, MITTPERY SONSEWENTS cOMICT¥D A leading provider of healthcare billing & payment services PATIENT PORTAL PROVIDERS = aD ie] jee) Fee oe ere — = Le ee MICHAEL C. HUGHES Complaint EXHIBIT B 2" .S PRO PP nneet “i Comet + hee ee ee P. PAYMENTS vw Welcome to the Paymentsmd « .

Patient Portal I A2OWT eR PROWEERE FATUNT PORTAL RT NDT SEWREVENTE CONTACT UR <0 © enon: goers ree | MICHAEL C. HUGHES Complaint EXHIBIT C —y —] <=) ace f manent @ f ry MICHAEL C. HUGHES Complaint EXHIBIT D P. PAYMENTS ROUT UE PROVIOERS PATIENT PORTAL WHY PD? NEWBEVENTS CONTACT UB Patient Portal Account Authorization oS Pret CIVAGREE By chee E-Segn Consent. Medica Recors ‘poomicet Ageenen Precio at ormaton mem rie. ||] Doameve2-reorh | > Ramet. i eda + FT novcache |Arainve Onaga) Pn FS whe Listen [Troverstsro Wada GB oterk-oeweaissen.| © Corts Sh cre. | i Doamentd Ma. | Pave | Con] rs alia alsa mae MICHAEL C. HUGHES 74 Decision and Order DECISION AND ORDER The Federal Trade Commission (“Commission” or “FTC”), having initiated an investigation of certain acts and practices of the respondent named in the caption hereof, and the respondent having been furnished thereafter with a copy of a draft complaint that the Bureau of Consumer Protection proposed to present to the Commission for its consideration and which, if issued by the Commission, would charge respondent with violations of the Federal Trade Commission Act (“FTC Act”), 15 U.S.C. § 45 et seq.;

The respondent, his attorney, and counsel for the Commission having thereafter executed an Agreement Containing Consent Order (“Consent Agreement”), which includes: a statement by respondent that he neither admits nor denies any of the allegations in the draft complaint, except as specifically stated in the Consent Agreement, and, only for purposes of this action, admits the facts necessary to establish jurisdiction; and waivers and other provisions as required by the Commission’s Rules; and The Commission having thereafter considered the matter and having determined that it had reason to believe that the respondent has violated the FTC Act, and that a complaint should issue stating its charges in that respect, and having thereupon accepted the executed consent agreement and placed such agreement on the public record for a period of thirty (30) days for the receipt and consideration of public comments, now in further conformity with the procedure prescribed in Commission Rule 2.34, 16 C.F.R. § 2.34, the Commission hereby issues its complaint, makes the following jurisdictional findings, and enters the following Order:

1. Respondent Michael C. Hughes was the CEO and partial owner of Paymentsmd, LLC from approximately August 2008 to July 2014. Individually, or in concert with others, he formulated, directed, controlled, or participated in the policies, acts, or practices of the company. He resides in Atlanta, Georgia.

MICHAEL C. HUGHES 75 Decision and Order 2. The Federal Trade Commission has jurisdiction of the subject matter of this proceeding and of the respondent, and the proceeding is in the public interest. ORDER DEFINITIONS For purposes of this Order, the following definitions shall apply:

1. “Covered information” shall mean information from or about an individual consumer, including but not limited to (a) a first and last name; (b) a home or other physical address, including street name and name of city or town; (c) an email address or other online contact information, such as an instant messaging user identifier or a screen name; (d) a telephone number; (e) a Social Security number; (f) a driver’s license or other state-issued identification number; (g) a financial institution account number; (h) an insurance account number or other insurance information; (i) credit or debit card information; (j) credit report information; (k) a persistent identifier, such as a customer number held in a “cookie,” a static Internet Protocol (“IP”) address, a mobile device ID, or processor serial number; and (l) health information, as defined below. 2. “Health information” shall mean information about an individual consumer’s health or medical care, including but not limited to (a) an insurance account number or other insurance information; (b) prescription information; (c) medical records; (d) information concerning the consumer’s diagnoses or treatments; and (e) medical or health related purchases. 3. Unless otherwise specified, “respondent” shall mean Michael C. Hughes, individually.

4. “Commerce” shall mean as defined in Section 4 of the Federal Trade Commission Act, 15 U.S.C. § 44. MICHAEL C. HUGHES 76 Decision and Order 5. “Clear(ly) and prominent(ly)” shall mean: a. In textual communications (e.g., printed publications or words displayed on the screen of a computer or mobile device), the required disclosures are of a type, size, and location sufficiently noticeable for an ordinary consumer to read and comprehend them, in print that contrasts highly with the background on which they appear; b. In communications disseminated orally or through audible means (e.g., radio or streaming audio), the required disclosures are delivered in a volume and cadence sufficient for an ordinary consumer to hear and comprehend them;

c. In communications disseminated through video means (e.g., television or streaming video), the required disclosures are in writing in a form consistent with subparagraph (a) of this definition and shall appear on the screen for a duration sufficient for an ordinary consumer to read and comprehend them, and in the same language as the predominant language that is used in the communication;

d. In communications made through interactive media, such as the Internet, online services, and software, the required disclosures are unavoidable and presented in a form consistent with subparagraph (a) of this definition, in addition to any audio or video presentation of them; and e. In all instances, the required disclosures: (1) are presented in an understandable language and syntax, and (2) include nothing contrary to, inconsistent with, or in mitigation of any statement contained within the disclosure or within any document linked to or referenced therein. MICHAEL C. HUGHES 77 Decision and Order I.

IT IS ORDERED that respondent, directly or through any corporation, subsidiary, division, website, or other device or affiliate owned or controlled by respondent, in or affecting commerce, shall not misrepresent, in any manner, expressly or by implication, the extent to which respondent uses, maintains, and protects the privacy, confidentiality, security, or integrity of covered information collected from or about consumers, including but not limited to:

A. Services for which consumers are being enrolled in as part of any sign-up process;

B. The extent to which respondent will share covered information with, or seek covered information from, third parties; and C. The purpose(s) for which covered information collected from third parties will be used. II.

IT IS FURTHER ORDERED that respondent, directly or through any corporation, subsidiary, division, website, or other device or affiliate owned or controlled by respondent, in or affecting commerce, in connection with the online advertising, marketing, promotion, offering for sale, sale, or dissemination of any service, shall:

A. Separate and apart from any final “end user license agreement,” “privacy policy,” “terms of use” page, or similar document, clearly and prominently disclose to consumers the practices regarding the collection, use, storage, disclosure or sharing of health information prior to seeking authorization to collect health information from a third party; and B. Obtain affirmative express consent from consumers prior to collecting health information from a third party.

MICHAEL C. HUGHES 78 Decision and Order III.

IT IS FURTHER ORDERED that respondent, directly or through any corporation, subsidiary, division, website, or other device or affiliate owned or controlled by respondent, in or affecting commerce, shall not use or collect any covered information pursuant to any authorization obtained from consumers registering for the Patient Portal, or permit any third party to use or maintain any such covered information in respondent’s custody or control. Within sixty (60) days after the date of service of the order, respondent shall permanently delete or destroy any and all covered information in respondent’s possession or control that was collected pursuant to such authorization and shall provide a written statement to the Commission, sworn under penalty of perjury, confirming that all such information has been deleted or destroyed or that respondent does not possess or control such information. Provided that, if respondent is prohibited from deleting or destroying such information by law, regulation, or court order, respondent shall provide a written statement to the Commission, sworn under penalty of perjury, identifying any information that has not been deleted or destroyed and the specific law, regulation, or court order that prohibits respondent from deleting or destroying such information. Unless otherwise directed by a representative of the Commission, all statements required by this Part shall be sent by overnight courier (not the U.S. Postal Service) to the Associate Director of Enforcement, Bureau of Consumer Protection, Federal Trade Commission, 600 Pennsylvania Avenue NW, Washington, DC 20580, with the subject line In the Matter of Michael C. Hughes, LLC, FTC File No. C-4502. Provided, however, that, in lieu of overnight courier, notices may be sent by first-class mail, but only if an electronic version of such notices is contemporaneously sent to the Commission at [email protected]. IV.

IT IS FURTHER ORDERED that respondent shall maintain and upon request make available to the Federal Trade Commission for inspection and copying, for a period of five (5) years from the date of preparation or dissemination, whichever is MICHAEL C. HUGHES 79 Decision and Order later, a print or electronic copy of all documents relating to compliance with this order, including but not limited to: A. statements disseminated to consumers that describe the extent to which respondent maintains and protects the privacy, security and confidentiality of any covered information, including, but not limited to, any statement related to a change in any website or service controlled by respondent that relates to the privacy, security, and confidentiality of covered information, with all materials relied upon in making or disseminating such statements;

B. all consumer complaints directed to respondent, or forwarded to respondent by a third party, that relate to the conduct prohibited by this order, and any responses to such complaints; and C. all forms, websites, and other methods used to obtain affirmative express consent to collect health information from third parties; and any documents, whether prepared by or on behalf of respondent, that contradict, qualify, or call into question compliance with this order.

V.

IT IS FURTHER ORDERED that respondent, for any business that such respondent is the majority owner of or controls directly or indirectly, shall deliver a copy of this order to all current, and for five (5) years to all future subsidiaries, principals, officers, directors, and managers, and to all current, and for five (5) years to all future employees, agents, and representatives having responsibilities relating to the subject matter of this order. Respondent shall deliver this order to such current personnel within thirty (30) days after service of this order, and to such future personnel within thirty (30) days after the person assumes such position or responsibilities. Respondent must secure a signed and dated statement acknowledging receipt of this order, within thirty (30) days of delivery, from all persons receiving a copy of the order pursuant to this Part. MICHAEL C. HUGHES 80 Decision and Order VI.

IT IS FURTHER ORDERED that respondent, for five (5) years after entry of this order, shall notify the Commission of any changes to his current business or employment, or his affiliation with any new business or employment. Such notice shall include: the name and address of each business that respondent is affiliated with, employed by, creates or forms, incorporates, or performs services for; a detailed description of the nature of the business; and a detailed description of respondent’s duties and responsibilities in connection with the business or employment; and any changes in respondent’s name or use of any aliases or fictitious names, including “doing business as” names. All notices required by this Part shall be sent by overnight courier (not the U.S. Postal Service) to the Associate Director of Enforcement, Bureau of Consumer Protection, Federal Trade Commission, 600 Pennsylvania Avenue NW, Washington, D.C. 20580, with the subject line In the Matter of Michael C. Hughes, FTC File No. C-4502. Provided, however, that in lieu of overnight courier, notices may be sent by first-class mail, but only if an electronic version of any such notice is contemporaneously sent to the Commission at [email protected]. VII.

IT IS FURTHER ORDERED that respondent within sixty (60) days after the date of service of this order, shall file with the Commission a true and accurate report, in writing, setting forth in detail the manner and form of his compliance with this order. Within ten (10) days of receipt of written notice from a representative of the Commission, he shall submit an additional true and accurate written report.

VIII.

This order will terminate on January 9, 2035, or twenty (20) years from the most recent date that the United States or the Commission files a complaint (with or without an accompanying consent decree) in federal court alleging any violation of the MICHAEL C. HUGHES 81 Decision and Order order, whichever comes later; provided, however, that the filing of such a complaint will not affect the duration of: A. any Part in this order that terminates in fewer than twenty (20) years;

B. this order’s application to any respondent that is not named as a defendant in such complaint; and C. this order if such complaint is filed after the order has terminated pursuant to this Part.

Provided, further, that if such complaint is dismissed or a federal court rules that respondent did not violate any provision of the order, and the dismissal or ruling is either not appealed or upheld on appeal, then the order as to such respondent will terminate according to this Part as though the complaint had never been filed, except that the order will not terminate between the date such complaint is filed and the later of the deadline for appealing such dismissal or ruling and the date such dismissal or ruling is upheld on appeal.

By the Commission.

MICHAEL C. HUGHES 82 Analysis to Aid Public Comment ANALYSIS OF CONSENT ORDER TO AID PUBLIC COMMENT The Federal Trade Commission has accepted, subject to final approval, a consent order applicable to Michael C. Hughes (“Hughes”).

The proposed consent order has been placed on the public record for thirty (30) days for receipt of comments by interested persons. Comments received during this period will become part of the public record. After thirty (30) days, the Commission will again review the agreement and the comments received, and will decide whether it should withdraw from the agreement and take appropriate action or make final the agreement’s proposed order. Michael C. Hughes is the former Chief Executive Officer, sole employee, and part owner of Paymentsmd, LLC (“Paymentsmd”). PaymentsMD’s principal line of business is the delivery of electronic billing records and the collection of accounts receivable for medical providers. In December 2011, Paymentsmd launched a free “Patient Portal” product that enabled consumers to pay their bills and to view their balance, payments made, adjustments taken, and information for other service dates.

The Commission’s complaint alleges that Paymentsmd, under Hughes’ direction and control, deceived consumers regarding the collection of consumers’ sensitive health information from third parties. In June 2012, Paymentsmd entered into an agreement with Metis Health LLC (“Metis Health”) to develop an entirely new service called Patient Health Report, a fee-based service that would enable consumers to access, review, and manage their consolidated health records through a Patient Portal account. In order to populate the Patient Health Report, Paymentsmd, under Hughes’ direction and control, obtained consumers’ authorization to collect sensitive health information for one purpose – to track their medical bills – and then used that authority to attempt to collect a massive amount of sensitive health information, including treatment information, from third parties without consumers’ knowledge or consent. Based on such authorization, sensitive health MICHAEL C. HUGHES 83 Analysis to Aid Public Comment information about everyone who registered for the Patient Portal was then requested from a large number of health plans, pharmacies, and a medical lab.

a. The first count of the Commission’s complaint alleges that Hughes, through his direction and control of Paymentsmd, represented that consumers registering for their free Patient Portal billing service could access and review their medical payment history, but failed to disclose adequately that Paymentsmd would also engage in a comprehensive collection of consumers’ sensitive health information for a Patient Health Report. The second count alleges that Hughes, through his direction and control of Paymentsmd, deceptively represented that the consumers’ authorizations were to be used exclusively to provide the billing service.

b. The proposed order contains provisions designed to prevent Hughes from engaging in the future in practices similar to those alleged in the complaint. Part I prohibits Hughes or any entity he owns or controls from misrepresenting the extent to which he or any entity he owns or controls uses, maintains, and protects the privacy, confidentiality, and security of covered information collected from or about consumers, including but not limited to (1) the services for which consumers are being enrolled as part of any sign-up process; (2) the extent to which he will share covered information with, or seek covered information from, third parties; and (3) the purpose(s) for which covered information collected from third parties will be used. Part II requires Hughes or any entity he owns or controls to clearly and prominently disclose practices regarding the collection, use, storage, disclosure or sharing of health information prior to seeking authorization to collect health information from a third party, and to obtain affirmative express consent from consumers prior to collecting health information from a third party.

c. Part III prohibits Hughes or any entity he owns or controls from using, collecting, or permitting any third party to use or maintain any covered information pursuant to any MICHAEL C. HUGHES 84 Analysis to Aid Public Comment authorization obtained prior to the date of the order from consumers registering for the Patient Portal. Hughes also must, within sixty days, delete all covered information in his possession or control that was collected in relation to the Patient Health Report service.

Parts IV through VIII of the proposed order are reporting and compliance provisions. Part IV requires Hughes to retain documents relating to his compliance with the order. The order requires that Hughes retain all of the documents for a five-year period. Part V requires dissemination of the order for a period of five years to all current and future subsidiaries, principals, officers, directors, and managers, and to persons with responsibilities relating to the subject matter of the order for any business that Hughes is the majority owner of or controls directly or indirectly. Part VI ensures notification, for a period of five years, to the FTC of changes to Hughes’ current business or employment, or his affiliation with any new business or employment. Part VII mandates that Hughes submit a compliance report to the FTC within 60 days, and periodically thereafter as requested. Part VIII is a provision “sunsetting” the order after twenty (20) years, with certain exceptions. The purpose of this analysis is to facilitate public comment on the proposed order. It is not intended to constitute an official interpretation of the proposed complaint or order or to modify the order’s terms in any way.

BI-LO HOLDINGS, LLC 85 Complaint