GoodRx, an online platform that provides users with coupons for significant price cuts on prescription drugs, sends patient data, including the names of prescriptions, pharmacies and other personal details to more than 20 other internet-based companies, according to Consumer Reports.
Companies including Google, Facebook and a marketing company called Braze receive the names of prescriptions GoodRx users are researching, pharmacies where prescriptions are being filled and ID numbers used to track the behavior of specific consumers. The data could contain information people would rather keep private, according to Consumer Reports.
HIPAA rules that protect private patient information don't apply to GoodRx or many other websites and apps that provide health and pharmaceutical information, according to Consumer Reports.
GoodRx executives told Consumer Reports it doesn't sell or share users' health data with other companies to support targeted ads.
Braze told Consumer Reports the data it receives isn't shared broadly and is used to help GoodRx target its own users with information.
GoodRx said its agreement with Braze stipulates that personal health information must be handled in a HIPAA compliant environment and that Braze must secure the confidentiality of the data GoodRx provides.
Branch, another company that receives information from GoodRx, told Consumer Reports it only uses the data to make sure links in GoodRx's mobile app work.
Both Google and Facebook told Consumer Reports it doesn't use prescription information for targeted ads.
A Facebook spokesperson told Consumer Reports: "We don’t want websites sharing people’s personal health information with us—it’s a violation of our policies. After an initial review, we think GoodRx’s use of our business tools requires a deeper investigation, and we’re reaching out to the company."
GoodRx users told Consumer Reports they were surprised their information was being shared for any purpose. However, they said they will likely continue using GoodRx because they need it to afford their prescriptions.
"GoodRx takes our users’ privacy seriously. We designed our service so that consumers can find information and savings without having to provide any personal information. We do not sell patient health data, and we strive to go above and beyond both legal requirements and consumer expectations when it comes to protecting consumer data," GoodRx said in a statement.
The company added that it is instituting new policies to better protect patient data in response to the Consumer Reports article, including allowing all users to delete their data from the app.
Read the full article here.