Policy Observatory

An online service allowing consumers to pay their medical bills failed to adequately inform them that it would also try to collect highly detailed medical information from their pharmacies, medical labs and insurance companies, the U.S. Federal Trade Commission said.

The FTC has reached a proposed settlement with PaymentsMD, an Atlanta health billing company, and former CEO Michael Hughes requiring the company to destroy any medical information it collected related to its separate online medical records service, Patient Health Report, the agency said Wednesday.

PaymentsMD “deceptively” used the sign-up process for its billing service to seek customers’ consent to obtain detailed medical information, the FTC said in a press release.

U.S. businesses that collect personal data would be required to describe their privacy and security practices and give consumers control over their personal information under a proposed privacy bill of rights released Friday by President Barack Obama’s administration.

The proposal would also require companies and nonprofit groups to collect and retain only the personal data they need to operate.

However, the proposal allows industry groups to submit their own codes of conduct to the Federal Trade Commission and shields companies that follow those codes from FTC enforcement actions.

Four U.S. senators have resurrected legislation that would allow consumers to see and correct personal information held by data brokers and tell those businesses to stop sharing or selling it for marketing purposes.

The Data Broker Accountability and Transparency Act, introduced by four Democratic senators Thursday, also would require the U.S. Federal Trade Commission to craft rules for a centralized website for consumers to view a list of data brokers covered by the bill.

Data brokers collect personal information about consumers, often without their knowledge, and resell it to other businesses.