Practice Fusion, Inc.

Text (OCR of the scan at left; may contain errors)

IN THE MATTER OF PRACTICE FUSION, INC.

CONSENT ORDER, ETC. IN REGARD TO ALLEGED VIOLATIONS OF SECTION 5 OF THE FEDERAL TRADE COMMISSION ACT Docket No. C-4591; File No. 142 3039 Complaint, August 15, 2016 – Decision, August 15, 2016 This consent order addresses Practice Fusion, Inc.’s solicition of patients to take surveys to rate and review their provider. The complaint alleges that Practice Fusion violated Section 5(a) of the Federal Trade Commission Act from April 2012 through April 2013 by failing to adequately disclose that survey responses would be made publicly available on Patient Fusion’s healthcare provider review website. The consent order requires Practice Fusion, prior to making any consumer’s covered information publicly available, to (A) clearly and conspicuously disclose to the consumer, separate and apart from “privacy policy,” “terms of use” page, or similar document, that such information is being made publicly available; and (B) obtain the consumer’s affirmative express consent. The order also prohibits Practice Fusion from displaying any healthcare provider review information obtained from consumers between April 5, 2012 and April 8, 2013. Participants For the Commission: Allison Lefrak, Kristin Madigan, Ryan Mehm, and Jennifer Nagle.

For the Respondents: Joseph Molosky, Lydia Parnes, and Seth Silber, Wilson Sonsini Goodrich & Rosati, PC; Timothy Muris, Kirkland & Ellis LLP.

COMPLAINT The Federal Trade Commission, having reason to believe that Practice Fusion, Inc. (“Respondent”) has violated the provisions of the Federal Trade Commission Act, and it appearing to the Commission that this proceeding is in the public interest, alleges: 1. Respondent Practice Fusion, Inc. (“Practice Fusion” or “Respondent”) is a Delaware corporation with its principal office or place of business at 650 Townsend Street, Suite 500, San Francisco, California 94103.

VOLUME 162 Complaint 2. The acts and practices of Respondent as alleged in this complaint have been in or affecting commerce, as “commerce” is defined in Section 4 of the Federal Trade Commission Act. RESPONDENT’S BUSINESS PRACTICES 3. Since 2007, Respondent has provided services for healthcare providers. Its core service is a cloud-based electronic health record (“EHR”) that allows healthcare providers in the ambulatory/out-patient setting to store and utilize health information.

4. In 2009, Respondent launched the Patient Fusion website, www.patientfusion.com (“Patient Fusion”), with an online portal that allows patients, who have been granted access by their healthcare providers, to view, download, and transmit to other providers their health information and send and receive secure messages directly to and from their providers. Respondent planned to launch a public-facing healthcare provider directory portion of the Patient Fusion website in 2013. The directory would allow current and prospective patients to search for providers by specialty or in a specific geographic area, read patient reviews of providers, and request appointments with providers through the website.

5. In order to populate the Patient Fusion website with provider reviews, starting in April 2012, Respondent emailed healthcare providers’ patients post-visit satisfaction surveys seeking reviews of the providers’ service. Practice Fusion described these surveys as a tool to “help improve your service in the future,” (as depicted below). The emails asked the patient to “please let us know how your visit went,” with a closing stating “Thank you, [Healthcare Provider’s Name]” at the end of the email. A disclosure at the bottom stated that the “email was sent to you by Patient Fusion®, a tool Doctor [Healthcare Provider’s Name] uses to deliver the highest quality of care to patients.” The email also indicated that it was “Sent on behalf of Doctor [Healthcare Provider’s Name]’s office” by Practice Fusion. PRACTICE FUSION, INC. 399 Complaint How was your visit? Thank you for making an appointment with your provider, Doctor Imadoc. To help improve your service in the future, please let us know how your visit went.

How would you rate your provider overall? Thank you, powered by Doctor Imadoc “4p patient fusion This email was sent to you by Patient Fusion®, a tool Doctor Imadoc uses to deliver the highest quality of care to patients. Piease do not reply to this message, it will not reach the medical office. © 2012 Practice Fusion | unsubscibe | privacy statement > Sent on behalf of Doctor Imadoc’s office by: Practice Fusion, Inc. 420 Tayior Street San Francisco, CA, 94102, USA 6. A link at the bottom of the email labeled “privacy statement” took the consumer to Practice Fusion’s Privacy Policy. The Privacy Policy included a section titled “Surveys, questionnaires, and polls.” Until April 8, 2013, Respondent did not indicate in this section or elsewhere in its privacy policy that it would publicly post reviews by patients of their providers. 7. Consumers who clicked on the stars in the email message were taken to the survey form, which among other things included a free text box at the bottom of the page prompting consumers to “Please leave a review for your provider:” (as depicted below). In light grey type just above the text box, the survey form indicated, “For your protection, do not include any personal information.” Below the free text box was a pre-checked box next to the phrase “Keep this review anonymous.” Leaving this box checked did not anonymize anything a consumer wrote in the free text box, including a consumer’s identifying information. Instead, the “Keep this review anonymous” selection only affected whether a review was posted on the Patient Fusion website under the handle “Anonymous” or under a patient’s first name. A button at the bottom of the survey enabled the consumer to “Submit my feedback.”

VOLUME 162 Complaint How was your visit? dp patient fusion”

Your overall rating for Francis Toan: ®© ®& & & ® How would you rate the following:

Bedside manner Clarity & Communication Po Br oe > > iy re & > > YD Scheduling an appointment How long did you have to wait for your appointment? a f I Z r under 10min 10-20min 20-30min 34-40min aver 40min Was your medical concern addressed? Would you recommend your provider to your family or friends? Pre [ ve Please leave a review for your provider: o protection, do not include any personal information | Check Spelling | M Keep this review anonymous Cl agree to the terms of the Patient Authorization Submit my feedback 8. Consumers were required to check the box next to the phrase, “I agree to the terms of the Patient Authorization,” in order to submit their feedback, but were not required to view the Patient Authorization. Consumers who clicked through to the Patient Authorization would have seen the following statements: “T authorize my provider and Practice Fusion, Inc. to publish my review on the Practice Fusion website .... The purpose of publishing my review is to make it available to patients and prospective patients of my provider, and other members of the public.” The Patient Authorization also stated that information PRACTICE FUSION, INC. 401 Complaint submitted by the consumer would not be protected under the Health Insurance Portability and Accountability Act, or HIPAA. 9. Since survey information was collected for a full year before the Patient Fusion website went live, consumers who visited Respondent’s website would not have found any posted reviews, so they would not have any historical or contextual reference to alert them to the fact that their feedback would be publicly posted rather than provided to their physician, mental health specialist, or other healthcare provider for his or her sole use.

10. In April 2013, Practice Fusion publicly launched the healthcare provider directory portion of the www.patientfusion.com website. At that time, Practice Fusion posted approximately 613,000 reviews it had collected from consumers during the previous year. At the same time, Respondent revised its email communications to consumers soliciting survey responses to indicate that reviews they submitted “may be publicly visible on Patient Fusion to help patients find doctors in the area.” Respondent also revised the section on “Surveys and Ratings” in the Patient Fusion privacy policy to state for the first time that survey responses would be made public: “From time to time we ask users to submit surveys or ratings to assist healthcare providers and others in improving their operations or to assist other users in making informed choices. The content of such surveys or ratings, therefore, should be presumed public.”

11. Based on the highly sensitive content of some consumers’ survey responses, combined with identifying information, they likely believed the communication was private. Consumers submitted hundreds of survey responses where they disclosed identifying information such as their full name or phone number combined with a sensitive health condition, medications taken, medical procedures performed, or treatments received. Examples of responses publicly posted include:

a. “Dr [healthcare provider name intentionally redacted by FTC staff], My Xanax prescription that I received on Monday was for 1 tablet a day but usually it's for 2 VOLUME 162 Complaint tablets a day. I have not taken it to the pharmacy yet. Can I pick up a new one, or can I get a prescription called into a pharmacy? Thanks, [patient name intentionally redacted by FTC staff]” Date: May 21, 2012 (Xanax (alprazolam) is a medication typically prescribed to treat anxiety disorders, panic disorders, and anxiety caused by depression.) b. “I was pleased with Dr. [healthcare provider name intentionally redacted by FTC staff]’s information on getting a facelift. I will call if I have further questions. Thank you, [patient name intentionally redacted by FTC staff]” Date: May 5, 2012 c. “I called today and left a message regarding my daughter and no one has returned my call. I think she is depressed and has stated several times this week that she wishes she was dead. Could someone please call me [phone number intentionally redacted by FTC staff]” Date: September 27, 2012 d. “The cefuroxime axetil does not seem to be doing anything for me. I did a little research and I think I have a yeast infection called candida. Not sure what to do about it yet. I guess I will first try to change my diet. Medication? [patient name intentionally redacted by FTC staff]” Date: June 9, 2012 e. “My left foot was so much better after the wart was removed from under the callus! There may be one growing on the right foot…….we’ll see! My feet always feel so much better when leaving the office. [patient name intentionally redacted by FTC staff]” Date: July 12, 2012 f. “I would like to make an appointment for my back pain and possible shingles. Can you please call me @[phone number intentionally redacted by FTC staff] Thank you! [patient name intentionally redacted by FTC staff]” Date: December 31, 2012 PRACTICE FUSION, INC. 403 Complaint g. “I HAVE NO INFECTION [healthcare provider name intentionally redacted by FTC staff] EVERYTHING WENT FINE AFTER MY VISIT, SO IT’S A GO FOR MY CHEMO DAY…..THANKS HOPEFULLY I WILL SEE YOU TOMARROW AT METHODIST HOSPITAL…..THANKS… [patient name intentionally redacted by FTC staff]” Date: March 15, 12. An October 21, 2013 article in Forbes Technology Blog highlighted the sensitive nature of some of the information posted on the Patient Fusion website (available at http://www.forbes.com/sites/kashmirhill/2013/10/21/practicefusion-patient-privacy-explicit-reviews/). 13. In November 2013, Respondent for the first time implemented automated procedures to identify reviews where consumers had entered personal information in the open text fields in the survey. Respondent did not post reviews that contained such personal information; Respondent also used this process to take down reviews containing personal information that had already been posted on the website. 14. Communications between healthcare providers and Practice Fusion indicate that some healthcare providers were surprised that feedback they received was also posted publicly. Others were surprised that patients were being asked for feedback in the first place.

PRACTICE FUSION’S DECEPTIVE FAILURE TO DISCLOSE 15. As described in Paragraphs 5-9, from April 5, 2012 through April 8, 2013, Respondent represented, directly or indirectly, expressly or by implication, that responses to a healthcare provider satisfaction survey would be communicated to the consumer’s healthcare provider.

16. Respondent failed to disclose adequately that, if consumers provided responses to the satisfaction survey, Respondent would also publish the responses on its public VOLUME 162 Decision and Order healthcare provider review website, as described in Paragraphs 10-14. This fact would be material to consumers in deciding whether or how to respond to the survey, including, for example, what type of information to include in their responses. 17. Respondent’s failure to disclose adequately the material information described in Paragraph 16, in light of the representation set forth in Paragraph 15, is a deceptive act or practice.

VIOLATIONS OF SECTION 5 18. The acts and practices of Respondent as alleged in this complaint constitute deceptive acts or practices in or affecting commerce in violation of Section 5(a) of the Federal Trade Commission Act.

THEREFORE, the Federal Trade Commission this fifteenth day of August, 2016, has issued this complaint against Respondent.

By the Commission.

DECISION AND ORDER The Federal Trade Commission (“Commission” or “FTC”), having initiated an investigation of certain acts and practices of the Respondent named in the caption hereof, and the Respondent having been furnished thereafter with a copy of a draft complaint that the Bureau of Consumer Protection proposed to present to the Commission for its consideration and which, if issued by the Commission, would charge Respondent with violations of the Federal Trade Commission Act (“FTC Act”), 15 U.S.C. § 45 et seq.;

PRACTICE FUSION, INC. 405 Decision and Order The Respondent, its attorney, and counsel for the Commission having thereafter executed an Agreement Containing Consent Order (“Consent Agreement”), which includes: a statement by Respondent that it neither admits nor denies any of the allegations in the draft complaint, except as specifically stated in the Consent Agreement, and, only for purposes of this action, admits the facts necessary to establish jurisdiction; and waivers and other provisions as required by the Commission’s Rules; and The Commission having thereafter considered the matter and having determined that it had reason to believe that the Respondent has violated the FTC Act, and that a complaint should issue stating its charges in that respect, and having thereupon accepted the executed Consent Agreement and placed such agreement on the public record for a period of thirty (30) days for the receipt and consideration of public comments, and having duly considered the comments filed by an interested person, now in further conformity with the procedure prescribed in Commission Rule 2.34, 16 C.F.R. § 2.34, the Commission hereby issues its Complaint, makes the following jurisdictional findings, and enters the following Order:

1. Respondent Practice Fusion, Inc. (“Practice Fusion”) is a Delaware corporation with its principal office or place of business at 650 Townsend Street, Suite 500, San Francisco, CA 94103.

2. The Federal Trade Commission has jurisdiction of the subject matter of this proceeding and of the Respondent, and the proceeding is in the public interest.

ORDER Definitions For purposes of this Order, the following definitions apply: A. “Covered information” means the following information obtained from an individual consumer: (a) a first and last name; (b) a physical address (c) an VOLUME 162 Decision and Order email address or other online contact information, such as an instant messaging user identifier or a screen name; (d) a telephone number; (e) a Social Security number; (f) a driver’s license or other governmentissued identification number; (g) a financial institution account number; (h) credit or debit card information; (i) a persistent identifier, such as a customer number held in a “cookie,” a static Internet Protocol (“IP”) address, a mobile device ID, or processor serial number that is combined with other available data that identifies an individual consumer; (j) health information, including demographic data, that relates to the individual’s past, present, or future physical or mental health or condition, the provision of healthcare to the individual, or the past, present, or future payment for the provision of healthcare to the individual, and that identifies the individual or for which there is a reasonable basis to believe it can be used to identify the individual; or (k) any other information that is individually identifiable. B. “Healthcare provider review information” means feedback gathered by Respondent from consumers on Respondent’s own behalf or on behalf of Respondent’s healthcare provider customers regarding healthcare services provided by said healthcare provider customers (or their agents, contractors, or assigns) in response to the healthcare satisfaction survey that Respondent emailed to consumers from either Practice Fusion or Patient Fusion domains from April 5, 2012 through April 8, 2013. “Healthcare provider review information” does not include information recorded or documented by one of Respondent’s healthcare provider customers (or their agents, contractors, or assigns) utilizing the services of Respondent. C. “Publicly available” means widely disseminated to the general public through a broadly accessible medium, such as wide dissemination on the Internet or in other printed, audio, visual, or digital media. PRACTICE FUSION, INC. 407 Decision and Order D. “Respondent” means Practice Fusion, Inc. and its successors and assigns.

E. “Commerce” means as defined in Section 4 of the Federal Trade Commission Act, 15 U.S.C. § 44. F. “Clearly and conspicuously” means that a required disclosure is difficult to miss (i.e., easily noticeable) and easily understandable by ordinary consumers, including in all of the following ways: 1. In any communication that is solely visual or solely audible, the disclosure must be made through the same means through which the communication is presented. In any communication made through both visual and audible means, such as a television advertisement, the disclosure must be presented simultaneously in both the visual and audible portions of the communication even if the representation requiring the disclosure is made in only one means. 2. A visual disclosure, by its size, contrast, location, the length of time it appears, and other characteristics, must stand out from any accompanying text or other visual elements so that it is easily noticed, read, and understood. 3. An audible disclosure, including by telephone or streaming video, must be delivered in a volume, speed, and cadence sufficient for ordinary consumers to easily hear and understand it. 4. In any communication using an interactive electronic medium, such as the Internet or software, the disclosure must be unavoidable. 5. The disclosure must use diction and syntax understandable to ordinary consumers and must appear in each language in which the representation that requires the disclosure appears. VOLUME 162 Decision and Order 6. The disclosure must comply with these requirements in each medium through which it is received, including all electronic devices and faceto-face communications.

7. The disclosure must not be contradicted or mitigated by, or inconsistent with, anything else in the communication.

8. When the representation or sales practice targets a specific audience, such as children, the elderly, or the terminally ill, “ordinary consumers” includes reasonable members of that group.

Provisions I. Prohibition against Misrepresentations IT IS ORDERED that Respondent and Respondent’s officers, agents, employees, and attorneys, and all other persons in active concert or participation with any of them, who receive actual notice of this Order, whether acting directly or indirectly, in connection with any product or service must not misrepresent in any manner, expressly or by implication: A. the extent to which Respondent uses, maintains, and protects the privacy and confidentiality of any covered information, including: the extent to which covered information shall be made publicly available, including by posting on the Internet.

II. Notice and Affirmative Express Consent Provision IT IS FURTHER ORDERED that Respondent and Respondent’s officers, agents, employees, and attorneys, and all other persons in active concert or participation with any of them, who receive notice of this Order, whether acting directly or indirectly, prior to making any consumer’s covered information publicly available, including by posting on the Internet, must: PRACTICE FUSION, INC. 409 Decision and Order A. clearly and conspicuously disclose to the consumer, separate and apart from “privacy policy,” “terms of use” page, or similar document, that such information is being made publicly available, including by posting on the Internet; and B. obtain the consumer’s affirmative express consent. III. Disposition of Healthcare Provider Review Information IT IS FURTHER ORDERED that Respondent and its officers, agents, representatives, and employees, directly or through any corporation, subsidiary, division, website, or other device or affiliate owned or controlled by Respondent, in or affecting commerce, must not publicly display any healthcare provider review information, and must not maintain any healthcare provider review information, except for review and retrieval by its healthcare provider customers, or their respective agents, contractors, assigns, or as permitted to comply with applicable law, regulation, or legal process. Within sixty (60) days after the effective date of the Order, Respondent must provide a written statement to the Commission, sworn under penalty of perjury, confirming the foregoing. IV. Acknowledgements of the Order IT IS FURTHER ORDERED that Respondent obtain acknowledgments of receipt of this Order: A. Respondent, within 10 days after the effective date of this Order, must submit to the Commission an acknowledgment of receipt of this Order sworn under penalty of perjury.

B. Respondent must deliver a copy of this Order to: (1) all principals, officers, directors, and LLC managers and members; (2) all employees, agents, and representatives having direct supervisory responsibilities over the conduct related to the subject matter of the Order; and (3) any business entity resulting from any change in structure as set forth in VOLUME 162 Decision and Order the Provision titled Compliance Reports and Notices. Delivery must occur within 10 days after the effective date of this Order for current personnel. For all others, delivery must occur before they assume their responsibilities.

C. From each individual or entity to which Respondent delivered a copy of this Order, Respondent must obtain, within 30 days, a signed and dated acknowledgment of receipt of this Order. V. Compliance Reports and Notices IT IS FURTHER ORDERED that Respondent make timely submissions to the Commission:

A. Ninety (90) days after the effective date of this Order, Respondent must submit a compliance report, sworn under penalty of perjury, in which:

1. Respondent must: (a) identify the primary physical, postal, and email address and telephone number, as designated points of contact, which representatives of the Commission, may use to communicate with Respondent; (b) identify all of that Respondent’s businesses by all of their names, telephone numbers, and physical, postal, email, and Internet addresses; (c) describe the activities of each business, including the goods and services offered, the means of advertising, marketing, and sales, and the extent to which covered information is made publicly available; (d) describe in detail whether and how Respondent is in compliance with each Provision of this Order, including a discussion of all of the changes the Respondent made to comply with the Order; and (e) provide a copy of each Acknowledgments of the Order obtained pursuant to this Order, unless previously submitted to the Commission.

PRACTICE FUSION, INC. 411 Decision and Order B. Respondent must submit a compliance notice, sworn under penalty of perjury, within 14 days of any change in the following:

1. (a) any designated point of contact; or (b) the structure of any entity that Respondent has any ownership interest in or controls directly or indirectly that may affect compliance obligations arising under this Order, including: creation, merger, sale, or dissolution of the entity or any subsidiary, parent, or affiliate that engages in any acts or practices subject to this Order. C. Respondent must submit notice of the filing of any bankruptcy petition, insolvency proceeding, or similar proceeding by or against such Respondent within 14 days of its filing.

D. Any submission to the Commission required by this Order to be sworn under penalty of perjury must be true and accurate and comply with 28 U.S.C. § 1746, such as by concluding: “I declare under penalty of perjury under the laws of the United States of America that the foregoing is true and correct. Executed on: _____” and supplying the date, signatory’s full name, title (if applicable), and signature.

E. Unless otherwise directed by a Commission representative in writing, all submissions to the Commission pursuant to this Order must be emailed to [email protected] or sent by overnight courier (not the U.S. Postal Service) to: Associate Director for Enforcement, Bureau of Consumer Protection, Federal Trade Commission, 600 Pennsylvania Avenue NW, Washington, DC 20580. The subject line must begin: In re Practice Fusion, Inc. VOLUME 162 Decision and Order VI. Recordkeeping IT IS FURTHER ORDERED that Respondent must create certain records and retain each such record for 5 years. Specifically, Respondent must create and retain the following records:

A. accounting records showing the revenues from all goods or services sold, the costs incurred in generating those revenues, and resulting net profit or loss; B. personnel records showing, for each person providing services in relation to any aspect of the Order, whether as an employee or otherwise, that person’s: name; addresses; telephone numbers; job title or position; dates of service; and (if applicable) the reason for termination;

C. copies or records of all consumer complaints concerning the subject matter of the Order, whether received directly or indirectly, such as through a third party, and any response;

D. all records necessary to demonstrate full compliance with each provision of this Order, including all submissions to the Commission;

E. all forms, websites, and other methods used by Respondent to obtain feedback from consumers on Respondent’s own behalf or on behalf of Respondent’s healthcare provider customers regarding healthcare services provided by said healthcare provider customer (or their agents, contractors, or assigns); F. a copy of each widely disseminated representation by Respondent that describes the extent to which Respondent maintains or protects the privacy and confidentiality of any covered information, including any representation concerning a change in any website or other service controlled by Respondent that relates PRACTICE FUSION, INC. 413 Decision and Order to the privacy and confidentiality of covered information; and G. for 5 years from the date created or received, all records, whether prepared by or on behalf of Respondent, that tend to show any lack of compliance by Respondent with this Order.

VII. Compliance Monitoring IT IS FURTHER ORDERED that, for the purpose of monitoring Respondent’s compliance with this Order: A. Within 10 days of receipt of a written request from a representative of the Commission, Respondent must: submit additional compliance reports or other requested information, which must be sworn under penalty of perjury, and produce records for inspection and copying.

B. For matters concerning this Order, representatives of the Commission are authorized to communicate directly with Respondent. Respondent must permit representatives of the Commission to interview anyone affiliated with any Respondent who has agreed to such an interview. The interviewee may have counsel present.

C. The Commission may use all other lawful means, including posing through its representatives as consumers, suppliers, or other individuals or entities, to Respondent or any individual or entity affiliated with Respondent, without the necessity of identification or prior notice. Nothing in this Order limits the Commission’s lawful use of compulsory process, pursuant to Sections 9 and 20 of the FTC Act, 15 U.S.C. §§ 49, 57b-1.

VOLUME 162 Decision and Order VIII. Order Effective Dates IT IS FURTHER ORDERED that this Order is final and effective upon the date of its publication on the Commission’s website (ftc.gov) as a final order. This Order will terminate on August 15, 2036, or 20 years from the most recent date that the United States or the Commission files a complaint (with or without an accompanying settlement) in federal court alleging any violation of this Order, whichever comes later; provided, however, that the filing of such a complaint will not affect the duration of:

A. Any Provision in this Order that terminates in less than 20 years;

B. This Order’s application to any Respondent that is not named as a defendant in such complaint; and C. This Order if such complaint is filed after the Order has terminated pursuant to this Provision. If such complaint is dismissed or a federal court rules that the Respondent did not violate any provision of the Order, and the dismissal or ruling is either not appealed or upheld on appeal, then the Order will terminate according to this Provision as though the complaint had never been filed, except that the Order will not terminate between the date such complaint is filed and the later of the deadline for appealing such dismissal or ruling and the date such dismissal or ruling is upheld on appeal.

By the Commission.

PRACTICE FUSION, INC. 415 Analysis to Aid Public Comment ANALYSIS OF CONSENT ORDER TO AID PUBLIC COMMENT The Federal Trade Commission (“Commission”) has accepted, subject to final approval, an agreement containing a consent order from Practice Fusion, Inc. (“Practice Fusion”). The proposed consent order has been placed on the public record for thirty (30) days for receipt of comments by interested persons. Comments received during this period will become part of the public record. After thirty (30) days, the Commission will again review the agreement and the comments received, and will decide whether it should withdraw from the agreement or make final the agreement’s proposed order.

Since 2007, Practice Fusion has provided services for healthcare providers. Since 2007, its core service has been a cloud-based electronic health record (“EHR”) that allows healthcare providers in the ambulatory/out-patient setting to store and utilize health information. In 2009, Practice Fusion launched the Patient Fusion website, www.patientfusion.com (“Patient Fusion”), with an online portal that allows patients, who have been granted access by their healthcare providers, to view, download, and transmit to other providers their health information and send and receive secure messages directly to their providers. Practice Fusion planned to launch a public-facing healthcare provider directory portion of the Patient Fusion website in 2013. The directory would, among other things, allow current and prospective patients to read patient reviews of providers. To populate this website with reviews, starting on April 5, 2012, Practice Fusion sent emails to the patients of its healthcare provider clients soliciting those patients to take surveys to rate and review their provider. The email – and the survey itself – suggested that the health care provider was directly seeking the survey responses to improve the consumer’s experience on future visits. Neither the email nor the survey clearly indicated that the reviews would be posted publicly. Practice Fusion solicited reviews for a full year – collecting information from over 600,000 patients during that time – before launching the review service on April 8, 2013, at which time all of the reviews previously VOLUME 162 Analysis to Aid Public Comment collected were posted publicly on the Internet. Many of the reviews contained highly sensitive information, combined with identifying information, indicating that many patients likely thought they were communicating directly with their doctors, and did not intend for their feedback to be posted publicly. The Commission’s proposed complaint alleges that Practice Fusion violated Section 5(a) of the Federal Trade Commission Act from April 2012 through April 2013 by failing to adequately disclose that survey responses would be made publicly available on Patient Fusion’s healthcare provider review website. This fact, according to the proposed complaint, would be material to consumers in deciding whether or how to respond to the survey. The Commission’s complaint alleges that Practice Fusion’s failure to adequately disclose this material information is a deceptive act or practice in violation of Section 5. The proposed order contains provisions designed to prevent Practice Fusion from engaging in the same or similar acts or practices in the future. Part I of the proposed order prohibits Practice Fusion from misrepresenting the extent to which it uses, maintains, and protects the privacy and confidentiality of any covered information, including the extent to which covered information is made publicly available. Part II of the proposed order requires Practice Fusion, prior to making any consumer’s covered information publicly available, to (A) clearly and conspicuously disclose to the consumer, separate and apart from “privacy policy,” “terms of use” page, or similar document, that such information is being made publicly available; and (B) obtain the consumer’s affirmative express consent. Part III of the proposed order prohibits Practice Fusion from displaying any healthcare provider review information obtained from consumers between April 5, 2012 and April 8, 2013. Part III of the proposed order also prohibits Practice Fusion from maintaining such information, except for review and retrieval by its healthcare provider customers, or their respective agents, contractors, assigns, or as permitted to comply with applicable law, regulation, or legal process.

PRACTICE FUSION, INC. 417 Analysis to Aid Public Comment Parts IV through VIII of the proposed order are reporting and compliance provisions. Part IV requires acknowledgment of the order and dissemination of the order now and in the future to persons with supervisory responsibilities relating to the subject matter of the order. Part V ensures notification to the FTC of changes in corporate status and mandates that Practice Fusion submit an initial compliance report to the FTC. Part VI requires Practice Fusion to retain documents relating to its compliance with the order for a five-year period. Part VII mandates that Practice Fusion make available to the FTC information or subsequent compliance reports, as requested. Part VIII is a provision “sunsetting” the order after twenty (20) years, with certain exceptions.

The purpose of this analysis is to aid public comment on the proposed order. It is not intended to constitute an official interpretation of the complaint or proposed order, or to modify in any way the proposed order’s terms.

VOLUME 162 Complaint