[Federal Register Volume 88, Number 49 (Tuesday, March 14, 2023)]
[Notices]
[Pages 15717-15720]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2023-05139]


=======================================================================
-----------------------------------------------------------------------

FEDERAL TRADE COMMISSION

[File No. 202 3169]


BetterHelp, Inc.; Analysis of Proposed Consent Order To Aid 
Public Comment

AGENCY: Federal Trade Commission.

ACTION: Proposed consent agreement; request for comment.

-----------------------------------------------------------------------

SUMMARY: The consent agreement in this matter settles alleged 
violations of federal law prohibiting unfair or deceptive acts or 
practices. The attached Analysis of Proposed Consent Order to Aid 
Public Comment describes both the allegations in the complaint and the 
terms of the consent order--embodied in the consent agreement--that 
would settle these allegations.

DATES: Comments must be received on or before April 13, 2023.

ADDRESSES: Interested parties may file comments online or on paper by 
following the instructions in the Request for Comment part of the 
SUPPLEMENTARY INFORMATION section below. Please write ``BetterHelp, 
Inc.; File No. 202 3169'' on your comment and file your comment online 
at https://www.regulations.gov by following the instructions on the 
web-based form. If you prefer to file your comment on paper, please 
mail your comment to the following address: Federal Trade Commission, 
Office of the Secretary, 600 Pennsylvania Avenue NW, Suite CC-5610 
(Annex P), Washington, DC 20580.

FOR FURTHER INFORMATION CONTACT: Miles Plant (202-326-2526), Bureau of 
Consumer Protection, Federal Trade Commission, 600 Pennsylvania Avenue 
NW, Washington, DC 20580.

[[Page 15718]]


SUPPLEMENTARY INFORMATION: Pursuant to section 6(f) of the Federal 
Trade Commission Act, 15 U.S.C. 46(f), and FTC Rule Sec.  2.34, 16 CFR 
2.34, notice is hereby given that the above-captioned consent agreement 
containing a consent order to cease and desist, having been filed with 
and accepted, subject to final approval, by the Commission, has been 
placed on the public record for a period of 30 days. The following 
Analysis to Aid Public Comment describes the terms of the consent 
agreement and the allegations in the complaint. An electronic copy of 
the full text of the consent agreement package can be obtained at 
https://www.ftc.gov/news-events/commission-actions.
    You can file a comment online or on paper. For the Commission to 
consider your comment, we must receive it on or before April 13, 2023. 
Write ``BetterHelp, Inc.; File No. 202 3169'' on your comment. Your 
comment--including your name and your state--will be placed on the 
public record of this proceeding, including, to the extent practicable, 
on the https://www.regulations.gov website.
    Because of heightened security screening, postal mail addressed to 
the Commission will be subject to delay. We strongly encourage you to 
submit your comments online through the https://www.regulations.gov 
website. If you prefer to file your comment on paper, write 
``BetterHelp, Inc.; File No. 202 3169'' on your comment and on the 
envelope, and mail your comment to the following address: Federal Trade 
Commission, Office of the Secretary, 600 Pennsylvania Avenue NW, Suite 
CC-5610 (Annex P), Washington, DC 20580.
    Because your comment will be placed on the publicly accessible 
website at https://www.regulations.gov, you are solely responsible for 
making sure your comment does not include any sensitive or confidential 
information. In particular, your comment should not include sensitive 
personal information, such as your or anyone else's Social Security 
number; date of birth; driver's license number or other state 
identification number, or foreign country equivalent; passport number; 
financial account number; or credit or debit card number. You are also 
solely responsible for making sure your comment does not include 
sensitive health information, such as medical records or other 
individually identifiable health information. In addition, your comment 
should not include any ``trade secret or any commercial or financial 
information which . . . is privileged or confidential''--as provided by 
section 6(f) of the FTC Act, 15 U.S.C. 46(f), and FTC Rule Sec.  
4.10(a)(2), 16 CFR 4.10(a)(2)--including competitively sensitive 
information such as costs, sales statistics, inventories, formulas, 
patterns, devices, manufacturing processes, or customer names.
    Comments containing material for which confidential treatment is 
requested must be filed in paper form, must be clearly labeled 
``Confidential,'' and must comply with FTC Rule Sec.  4.9(c). In 
particular, the written request for confidential treatment that 
accompanies the comment must include the factual and legal basis for 
the request and must identify the specific portions of the comment to 
be withheld from the public record. See FTC Rule Sec.  4.9(c). Your 
comment will be kept confidential only if the General Counsel grants 
your request in accordance with the law and the public interest. Once 
your comment has been posted on the https://www.regulations.gov 
website--as legally required by FTC Rule Sec.  4.9(b)--we cannot redact 
or remove your comment from that website, unless you submit a 
confidentiality request that meets the requirements for such treatment 
under FTC Rule Sec.  4.9(c), and the General Counsel grants that 
request.
    Visit the FTC website at http://www.ftc.gov to read this document 
and the news release describing the proposed settlement. The FTC Act 
and other laws the Commission administers permit the collection of 
public comments to consider and use in this proceeding, as appropriate. 
The Commission will consider all timely and responsive public comments 
it receives on or before April 13, 2023. For information on the 
Commission's privacy policy, including routine uses permitted by the 
Privacy Act, see https://www.ftc.gov/site-information/privacy-policy.

Analysis of Proposed Consent Order To Aid Public Comment

    The Federal Trade Commission (the ``Commission'') has accepted, 
subject to final approval, an agreement containing a consent order from 
BetterHelp, Inc. (``Respondent'' or ``BetterHelp''). The proposed 
consent order (``Proposed Order'') has been placed on the public record 
for thirty (30) days for receipt of comments from interested persons. 
Comments received during this period will become part of the public 
record. After thirty (30) days, the Commission will again review the 
agreement, along with any comments received, and will decide whether it 
should withdraw from the agreement and take appropriate action or make 
final the Proposed Order.
    BetterHelp is an online mental health counseling service that 
matches consumers with one of BetterHelp's over 25,000 contracted 
licensed therapists. Through BetterHelp's websites and apps, consumers 
can communicate with therapists via video conferencing, text messaging, 
live chat, and audio calls. BetterHelp has offered this service under 
several names, including BetterHelp Counseling, Faithful Counseling, 
Pride Counseling, ReGain, Terappeuta, iCounseling, and MyTherapist.
    To sign up for BetterHelp's counseling service, a consumer must 
complete an online intake questionnaire containing detailed questions 
about the consumer's mental health status and history (the ``Intake 
Questionnaire''). Following completion of the Intake Questionnaire, the 
consumer can create an account by providing their name or nickname, 
email address, phone number, and emergency contact information.
    As consumers progressed through the Intake Questionnaire, 
BetterHelp represented that the consumers' information ``will stay 
private between you and your counselor.'' Similarly, when a consumer 
completed the Intake Questionnaire and signed up for an account to use 
Faithful Counseling, Pride Counseling, or Teen Counseling, BetterHelp 
represented that the consumer's email address would be ``kept strictly 
private'' and ``never shared, sold or disclosed to anyone.'' BetterHelp 
made additional privacy guarantees in its privacy policies--first 
implicitly and then explicitly--of limited use and limited disclosure 
of consumers' email addresses, IP addresses, and health information. 
Despite representing to consumers that BetterHelp would keep consumers' 
information private and only use their information for non-advertising 
purposes, BetterHelp used and disclosed information obtained from 
consumers through the Intake Questionnaire and sign-up process for 
advertising.
    Additionally, BetterHelp prominently displayed a seal--in close 
proximity to several other seals provided by third parties--that 
attested to BetterHelp's purported compliance with the Health Insurance 
Portability and Accountability Act of 1996 (``HIPAA''), a statute that 
sets forth privacy and information security protections for health 
information. In addition, BetterHelp represented to consumers that it 
was in fact ``HIPAA certified,'' with its customer service 
representatives informing consumers that ``[y]ou will also be able to 
see our HIPAA certification at the bottom of''

[[Page 15719]]

our web pages. However, no government agency or other third party had 
reviewed BetterHelp's information practices for compliance with HIPAA, 
let alone determined that the practices met the requirements of HIPAA.
    The Commission's proposed eight-count complaint alleges that 
BetterHelp violated section 5(a) of the Federal Trade Commission Act 
by: (1) unfairly failing to employ reasonable measures to protect 
consumers' health information in connection with the collection, use, 
and disclosure of that information (Count I); (2) unfairly failing to 
obtain consumers' affirmative express consent prior to collecting, 
using, and disclosing consumers' health information (Count II); (3) 
failing to disclose that it shared consumers' health information with 
third parties for BetterHelp's advertising purposes and the recipient 
third parties' own business purposes, and failing to disclose that 
BetterHelp used consumers' health information to target the consumers 
and others with advertisements (Counts III and IV); (4) misrepresenting 
that it would not disclose consumers' health information to third 
parties for advertising and the recipient third parties' own business 
purposes, that it would not use such information for advertising or 
advertising-related purposes, and that it would not share such 
information with anyone except each consumer's licensed therapist 
(Counts V-VII); and (5) misrepresenting that a governmental agency or 
third party had reviewed BetterHelp's practices and determined that 
such practices met the requirements of HIPAA (Count VIII).

Summary of Proposed Order With BetterHelp

    The Proposed Order contains provisions designed to prevent 
BetterHelp from engaging in the same or similar acts or practices in 
the future. Part I of the Proposed Order prohibits BetterHelp from 
sharing individually identifiable information relating to the past, 
present, or future physical or mental health or condition(s) of a 
consumer with any third party (i.e., any party other than BetterHelp, 
its service providers, therapists or counselors employed by or 
contracted with BetterHelp, certain employee benefit programs, and 
entities using consumers' information for other very limited purposes) 
for advertising. Part I also prohibits BetterHelp from sharing 
consumers' personal information more generally with Third Parties for 
the purpose of re-targeting (i.e., sharing personal information of 
consumers who have previously engaged with BetterHelp, such as by 
visiting one of its websites or using one of its apps, to send 
advertisements to those consumers). Part II of the Proposed Order 
requires that, before it can share a consumers' personal information 
with a third party for any purpose that is not prohibited under part I, 
BetterHelp must obtain that consumer's affirmative express consent, 
which includes informing the consumer of the information to be 
disclosed, the third parties that will receive the information, and how 
the information will be used.
    Part III of the Proposed Order prohibits BetterHelp from 
misrepresenting: (1) the extent to which it collects, maintains, uses, 
discloses, deletes, or permits or denies access to any Covered 
Information, or the extent to which it protects the privacy, security, 
availability, confidentiality, or integrity of Covered Information; (2) 
the purposes for which BetterHelp or any entity to whom it discloses or 
permits access to Covered Information collects, maintains, uses, 
discloses, or permits access to such information; (3) the extent to 
which a consumer can maintain privacy and anonymity when visiting or 
using BetterHelp's online properties; (4) the extent to which consumers 
may exercise control over BetterHelp's collection of, maintenance of, 
use of, deletion of, disclosure of, or permission of access to Covered 
Information; (5) the extent to which BetterHelp is a member of, adheres 
to, complies with, is certified by, is endorsed by, or otherwise 
participates in any privacy, security or any other compliance program 
sponsored by a government or any self-regulatory or standard-setting 
organization; and (6) the extent to which BetterHelp is covered by 
HIPAA, and the extent that its privacy and information practices are in 
compliance with HIPAA requirements.
    Part IV of the Proposed Order requires BetterHelp to identify to 
the Commission which third parties received consumers' personal 
information from BetterHelp without their consent and what personal 
information each such third party received. Part IV also requires that 
BetterHelp then ask those third parties to delete such personal 
information.
    Part V of the Proposed Order requires that BetterHelp provide 
notice to consumers who created an account with BetterHelp prior to 
January 1, 2021, that BetterHelp may have used and disclosed their 
personal information for advertising. Part VI requires BetterHelp to 
establish and implement, and thereafter maintain, a comprehensive 
privacy program that protects the privacy, security, availability, 
confidentiality, and integrity of consumers' Covered Information (as 
defined in the Proposed Order).
    Part VII of the Proposed Order requires BetterHelp to obtain 
initial and biennial privacy assessments by an independent, third-party 
professional (``Assessor'') for 20 years, and part VIII requires 
BetterHelp to cooperate with the Assessor in connection with the 
assessments required by part VII. Part IX of the Proposed Order 
requires that a BetterHelp executive certify the company's compliance 
with the Proposed Order. Part X of the Proposed Order requires 
BetterHelp to notify the Commission following the discovery of a 
violation of parts I, II, or III of the Proposed Order.
    Part XI of the Proposed Order requires BetterHelp to pay $7,800,000 
in monetary relief for consumer redress, and part XII describes the 
procedures and legal rights related to that payment. Part XIII of the 
Proposed Order requires BetterHelp to provide information to, and pay 
for, an independent redress administrator (``Administrator'') selected 
by the Commission, which will be responsible for administration of 
consumer redress.
    Parts XIV through XVII of the Proposed Order are reporting and 
compliance provisions, which include recordkeeping requirements and 
provisions requiring BetterHelp to provide information or documents 
necessary for the Commission to monitor compliance. Part XVIII states 
that the Proposed Order will remain in effect for twenty (20) years, 
with certain exceptions.
    The purpose of this analysis is to aid public comment on the 
Proposed Order. It is not intended to constitute an official 
interpretation of the complaint or Proposed Order, or to modify in any 
way the Proposed Order's terms.

    By direction of the Commission.
April J. Tabor,
Secretary.

Concurring Statement of Commissioner Christine S. Wilson

    Today the Commission announces a consent agreement with BetterHelp 
resolving allegations that it failed to protect consumers' health 
information and failed to disclose or misrepresented its marketing 
practices. I support the allegations in the proposed complaint and the 
relief in the negotiated consent.
    The complaint explains that BetterHelp provides an online 
counseling service that matches users with the respondent's therapists 
and facilitates counseling via its websites

[[Page 15720]]

and apps. Millions of consumers have used the service and provided 
BetterHelp with sensitive personal information regarding their health 
status and history, in addition to their name, email address, and IP 
address. Contrary to its repeated representations to keep this 
information private, the complaint explains that BetterHelp monetized 
consumers' health information to target them and others with 
advertisements. To this end, Respondent provided sensitive consumer 
health information to third-party advertising platforms including 
Facebook, Pinterest, Snapchat, and Criteo. I agree that this alleged 
conduct violates Section 5 of the FTC Act.
    Notably, the complaint does not include an allegation that 
BetterHelp violated the Health Breach Notification Rule (HBNR or Rule). 
I support this careful approach to the application of the Rule, 
particularly given the FTC Policy Statement on Breaches by Health Apps 
and Other Connected Devices (Policy Statement). The Commission, in a 3-
2 party-line vote, issued this Policy Statement in September 2021.\1\ I 
dissented \2\ because the Policy Statement included a novel expansion 
of the application of the Rule that contradicted earlier business 
guidance \3\ and was issued during the pendency of the ongoing HBNR 
rulemaking proceeding.\4\
---------------------------------------------------------------------------

    \1\ FTC Policy Statement on Breaches by Health Apps and Other 
Connected Devices (Sept. 15, 2021), https://www.ftc.gov/news-events/events-calendar/open-commission-meeting-september-15-2021.
    \2\ Dissenting Statement of Commissioner Christine S. Wilson, 
Policy Statement on Breaches by Health Apps and Other Connected 
Devices (Sept. 15 2021), https://www.ftc.gov/system/files/documents/public_statements/1596356/wilson_health_apps_policy_statement_dissent_combined_final.pdf.
    \3\ See Exhibit A, Dissenting Statement of Commissioner 
Christine S. Wilson, Policy Statement on Breaches by Health Apps and 
Other Connected Devices (Sept. 15, 2021) (prior Commission business 
guidance on the HBNR), https://www.ftc.gov/system/files/documents/public_statements/1596356/wilson_health_apps_policy_statement_dissent_combined_final.pdf.
    \4\ Health Breach Notification Rule, Request for Public Comment, 
85 FR 31085 (May 22, 2020).
---------------------------------------------------------------------------

    One could argue that BetterHelp would fall within the ambit of the 
HBNR because it offers a health platform and app, particularly under 
the expansive view espoused in the Policy Statement. I am pleased to 
see that the Commission has not taken this approach.\5\
---------------------------------------------------------------------------

    \5\ This is especially appropriate because, according to the 
complaint, BetterHelp's violative conduct ceased in December 2020, 
before the issuance of the Policy Statement. I recently supported 
the application of the Rule to the conduct in the GoodRx matter 
because the alleged conduct at issue there fell squarely within the 
scope of the HBNR as drafted. See Concurring Statement of 
Commissioner Christine S. Wilson, GoodRx (Feb. 3, 2023), https://www.ftc.gov/legal-library/browse/cases-proceedings/public-statements/goodrx-concurring-statement-commissioner-christine-wilson.
---------------------------------------------------------------------------

    The information BetterHelp collects from consumers and provides to 
therapists on its platform does not constitute a personal health record 
of identifiable health information under the Rule because it does not 
include records that ``can be drawn from multiple sources,'' as 
required by the existing formulation of the Rule.\6\ A consumer 
provides his or her information to BetterHelp but the company does not 
pull additional health information from another source or vendor. For 
this reason, foregoing an HBNR count is appropriate.
---------------------------------------------------------------------------

    \6\ See 16 CFR 318.2(d); 42 U.S.C. 1320d(6).
---------------------------------------------------------------------------

    I note further that I support the imposition of monetary relief in 
this matter. BetterHelp told consumers: ``Rest assured--your health 
information will stay private between you and your counselor'' but, as 
alleged, shared this highly sensitive information with third parties 
for the purpose of monetizing it. I am comfortable that this conduct 
falls within our authority to seek relief under Section 19 of the FTC 
Act. I commend the staff on the successful resolution of this matter.

[FR Doc. 2023-05139 Filed 3-13-23; 8:45 am]
BILLING CODE 6750-01-P