FTC Imposes Millions in Penalty on Two Substance Use Disorder Treatment Providers Over Website Disclosures

• April 24, 2024

• Adam Greene, JD, MPH , Davis Wright Tremaine LLP

After a record year of enforcement actions related to health data privacy in 2023, the Federal Trade Commission (FTC) continued this trend in April 2024 with proposed settlements with Monument, Inc. and Cerebral, Inc. These new cases are particularly noteworthy because the FTC imposed millions of dollars in penalties on substance use disorder treatment providers under the Opioid Addiction Recovery Fraud Prevention Act of 2018 (OARFPA). In contrast, the FTC does not typically have authority to impose civil money penalties under Section 5 of the FTC Act, its more traditional tool for enforcing privacy and security. Additionally, the FTC used Monument’s own independent Health Insurance Portability and Accountability Act of 1996 (HIPAA) assessments against the company as evidence that Monument’s claims of HIPAA compliance were deceptive, highlighting a danger of third-party assessments and the potential benefit of performing them at the direction of counsel to create a claim of privilege.

ARTICLE TAGS

• Health Information and Technology Practice Group
• Health Information