GoodRx Injunction Order.pdf

The United States of America filed a complaint against GoodRx Holdings, Inc. for deceptive and unfair acts or practices in disclosing health and personal information to third parties, failing to limit third-party use of health information, misrepresenting compliance with the Digital Advertising Alliance principles, and misrepresenting that consumer's health information was protected under HIPAA. The complaint also charges GoodRx with violating the Health Breach Notification Rule by failing to notify individuals and the Commission of a breach of security of unsecured PHR identifiable health information. GoodRx neither admits nor denies the allegations, except as stated in the stipulated order, and waives any claim under the Equal Access to Justice Act. The parties agree to the entry of a stipulated order for permanent injunction, civil penalty judgment, and other relief, which resolves all allegations in the complaint.