HEALTH LAW SUPPLEMENT Autumn 2023

Simple Practice changes its terms and conditions. Simple Practice, a cloud -based electronic health records and practice management system used by many psychotherapists – the company claims 178,000 + customers – announced in August 2023 that it was changing the terms and conditions of its contract with therapists. Changes were made to a provision entitled “License to User User Data” that caused concern to some customers about HIPAA compliance and about possible feeding of protected health information (PHI) into artificial intelligence, Simple Practice clearly stated that the license granted to it by its clients in the new terms and conditions, which includes a license to uploaded PHI, would not violate HIPAA, Concern arose however, because the provision appeared to customers not to differentiate between terms for medical records containing PHI with its strict privacy requirements, and public-facing services with less stringent requirements. In an attempt to reassure its clients, Simple Practice then extended the time for customers to accept the new conditions and wrote, “We do not sell our customers’ or your clients’ PHI or Personally Identifiable Information. We do not access PHI outside of HIPAA guidelines. We do not keep PHI after termination of customers’ accounts. We do not provide AI with access to customer or client data. We do not record telehealth sessions.” I see no reason to disbelieve them. For most of our clients, that assurance settled the issue.

BetterHelp and HIPAA compliance. Perhaps our clients who were concerned about Simple Practice had become sensitized by the news in March of this year that BetterHelp, which characterizes itself as “the world’s largest therapy platform,” – it had revenues $721 million in 2021- had been fined $7.8 million by the US Federal Trade Commission. On its website the platform made representations such as, “Rest assured -any information provided in this questionnaire will stay private between you and your counselor.” Despite its privacy promises, however, the platform: uploaded users email addresses and disclosed users’ therapy history to Facebook (BetterHelp and Facebook have had an extensive relationship: BetterHelp spent approximately $20 million on its Facebook advertising and in 2021 was generating about100,000 new customers a year through Facebook; revealed to Snapchat email addresses of former users (apparently to target them for ads to resume treatment); and disclosed visitors’ email addresses to Criteo and Pinterest. Note that the FTC penalized BetterHelp not because of any HIPAA violations – BetterHelp is not a “covered entity” governed by HIPAA – but because it made misrepresentations in its advertising. On the wake of the FTC penalty, BetterHelp now faces multiple class action lawsuits by law firms representing users of the platform.

And a class action lawsuit against Headway too. In August 2023, a class action lawsuit was filed in California against TherapyMatch Inc, with a business name of Headway. The suit alleges that that business corporation, which operates a digital platform to assist prospective mental healthcare patients find a practitioner who accepts their insurance, tracked users’ interactions using Google Analytics Code as the users navigated the corporation’s website. Google then purportedly used the information provided, such as the mental health issue for which the user was seeking a therapist and the location of the prospective patient, to deliver advertisements to the user. The class action lawsuit is based on California law, its Invasion of Privacy, Confidentiality of Medical Information, and Consumer Privacy Acts. The suit is not based on HIPAA violations, but its allegations include that TherapyMatch/Headway violated HIPAA privacy regulations as well. It is unclear to me what, if any, connection the defendant and lawsuit have with New York practitioners who contract with the New York professional corporation that operates under the trade name of “Headway” in New York State; the legal name of that entity is New York Behavioral Health Services, P.C. Any connection should become clearer with time as legal discovery occurs.
.

INFORMATION IN THIS NEWSLETTER IS NOT LEGAL ADVICE FOR ANY PARTICULAR CLIENT OR SITUATION. CONSULT WITH AN ATTORNEY INDIVIDUALLY FOR LEGAL ADVICE REGARDING THE SPECIFIC ASPECTS OF YOUR SITUATION.

Categories