Whistleblower Calls for Action Against 22 Digital Health Providers After FTC Busts Monument Inc.

Whistleblower Calls for Action Against 22 Digital Health Providers After FTC Busts Monument Inc.

What You Should Know: 

Whistleblower Aid, a non-profit organization supporting whistleblowers, is urging the Federal Trade Commission (FTC) to take action against 22 additional digital health providers following the recent FTC case against Monument Inc. This action banned Monument Inc. from sharing user data with third-party advertisers, a violation of patient privacy.

– This case highlights the importance of protecting patient data in the digital health industry. Whistleblower Aid’s call to action urges the FTC to enforce existing regulations and ensure that vulnerable individuals seeking addiction treatment can do so without fear of privacy violations.

Monument Inc.’s Data Sharing Exposed

The call for further investigation stems from the work of Dr. Jonathan Stoltman, a whistleblower represented by Whistleblower Aid and a former employee of the FTC. Dr. Stoltman’s findings, corroborated by the Opioid Policy Institute, revealed that Monument Inc. shared sensitive data from over 84,000 opioid addiction patients with advertising platforms like Meta (formerly Facebook) and Google. This data sharing occurred between 2020 and 2022, despite promises of confidentiality.

Addiction Patients Vulnerable

Whistleblower Aid emphasizes the potential harm to patients. Sharing private medical information with third parties like Google and Facebook without consent is a violation of federal law, specifically Section 5 of the FTC Act and the Opioid Addiction Recovery Fraud Prevention Act of 2018. The potential consequences for patients are life-altering.  Exposure of sensitive health data can negatively impact housing, employment, and broader human rights.

Potential Consequences for Other Providers

The ramifications for these 22 providers could mirror those imposed on Monument Inc.:

  • Ban on sharing patient data with advertisers
  • Data deletion
  • Requirement for patient consent before sharing data
  • Financial penalties
  • A $2.5 million penalty