Cerebral Telehealth Firm Slapped with $7M Fine for Privacy Breaches

FTC Cracks Down on Cerebral’s Data Privacy Practices and Cancellation Policies

The Federal Trade Commission (FTC) has taken action against Cerebral, a telehealth company, for its alleged mishandling of sensitive customer data and problematic cancellation policies. The FTC’s complaint asserts that Cerebral exposed the personal information of over 3.1 million individuals in the United States, including sensitive details such as:

• Home and email addresses
• Phone numbers
• Pharmacy and health insurance details
• Medical history

The incident has raised concerns about the telehealth industry’s data handling practices, prompting Washington state to introduce a new bipartisan privacy law that could bring about significant changes in the sector.

Penalties and Refunds

Once the Florida District Court approves the order, Cerebral will be required to pay $5.1 million in partial refunds to customers affected by its cancellation policies. Additionally, the company faces a $10 million fine, but due to its inability to pay the full amount, most of it will be suspended once Cerebral pays $2 million.

Data Privacy Program and Audits

As part of the settlement, Cerebral will be obligated to establish a comprehensive data privacy program and provide annual reports on its progress. The company will also be subject to audits every two years for the next 20 years to ensure compliance with the FTC’s requirements.

The FTC’s action against Cerebral serves as a reminder of the importance of data privacy and the need for companies to prioritize the protection of their customers’ sensitive information. As the telehealth industry continues to grow, it is crucial that providers implement robust data security measures and maintain transparent cancellation policies to maintain consumer trust and avoid similar regulatory actions in the future.