[{"titre":"Practice Fusion case suggests 6 health privacy pointers","id":3194910,"pubDate":"Sat, 03 Oct 2026 08:09:37 +0200","description":"Practice Fusion case suggests 6 health privacy pointers lfair June 8, 2016 | 9:01AM Practice Fusion case suggests 6 health privacy pointers By Lesley Fair Combine two of the most talked-about consumer protection topics – health privacy and consumer-generated online content – and what do you get? A proposed FTC settlement with Practice Fusion, the largest cloud-based electronic health records company in the country, and six compliance tips for others in the industry. One of San Francisco-based Practice Fusion’s primary products is an electronic records system for outpatient providers. In 2009, the company launched “Patient Fusion,” an online portal where patients whose providers were already using Practice Fusion could view or download their health information or transmit it to another provider. Patient Fusion also let patients send and receive secure messages from their providers. Fast forward several years and the company decided to expand Patient Fusion to include a public directory where current and prospective enrollees could search for doctors geographically or by specialty, read patient reviews of providers, and request appointments. But Practice Fusion had to ask itself a question familiar to many online companies: How do we get the content – in this case, patient reviews? That’s the focus of the FTC’s lawsuit. According to the complaint , Practice Fusion solicited data in a misleading way that led some patients to believe they were sending follow-up messages directly to their doctors about their diagnosis, medical treatment, prescriptions, etc. – and not contributing content to a public website. Practice Fusion, however, populated its new site with the information those people provided, some of which was highly sensitive. Here’s what happened. After appointments with their doctors, patients received emails titled “How was your visit?” The message continued, “To help improve your service in the future, please let us know how your visit went” and included a link with rating stars. The message ended this way: Thank you, Dr. [Name] In a footer, the message said “This email was sent to you by Patient Fusion®, a tool Doctor [Name] uses to deliver the highest quality of care to patients.” Below that in smaller print it said “Sent on behalf of Doctor [Name]’s office by: Practice Fusion.” If patients clicked the link, they were taken to a page that asked for feedback about things like how long they had to wait for their appointment, the doctor’s bedside manner, and whether their medical concern was addressed. There also was a text box where patients were invited to “leave a review for your provider.” Below that was a pre-checked box with the phrase “Keep this review anonymous.” What did some people put in that box? Highly sensitive information directly addressed to their doctors, not evaluations meant to be shared publicly. Here are just a few examples: “Dr [name], My Xanax prescription that I received on Monday was for 1 tablet a day but usually it’s for 2 tablets a day. I have not taken it to the pharmacy yet. Can I pick up a new one, or can I get a prescription called into a pharmacy? Thanks, [patient’s full name] “I called today and left a message regarding my daughter and no one has returned my call. I think she is depressed and has stated several times this week that she wishes she was dead. Could someone please call me [phone number]?” “The cefuroxime axetil does not seem to be doing anything for me. I did a little research and I think I have a yeast infection called candida. Not sure what to do about it yet. I guess I will first try to change my diet. Medication? [patient’s full name] “I would like to make an appointment for my back pain and possible shingles. Can you please call me @ [phone number]? Thank you! [patient's full name]” “I HAVE NO INFECTION [healthcare provider name].  EVERYTHING WENT","source":"FTC USA Business Blog Posts","url":"https://www.ftc.gov/business-guidance/blog/2016/06/practice-fusion-case-suggests-6-health-privacy-pointers"},{"url":"https://www.ftc.gov/news-events/news/press-releases/2026/08/ftc-states-sue-amazon-over-secret-ad-surcharge-scheme","source":"Federal Trade Commission - Protecting America's Consumers","id":3127461,"pubDate":"Tue, 01 Sep 2026 08:10:10 +0200","titre":"FTC, States Sue Amazon Over Secret Ad Surcharge Scheme","description":"Today, 22 states joined the Federal Trade Commission in filing suit against Amazon, alleging that the company engaged in deceptive and unfair practices that secretly inflated prices in its online search advertising auctions. The complaint   alleges that, for over seven years, Amazon has covertly and substantially increased the prices that more than one million brands and sellers were required to pay to advertise on its platform. As a result, the complaint alleges that Amazon’s scheme has likely extracted tens of billions of dollars from its unwitting advertising customers. “When one of the world’s largest online retailers engages in unfair and deceptive conduct, the impact can be staggering,” said Chairman Andrew N. Ferguson. “Amazon has millions of advertising customers who were misled into paying significantly higher prices. These higher costs were largely passed on to American consumers. The FTC under President Trump won’t allow this deception to continue.” The FTC, along with the attorneys general of Alaska, Arizona, California, Colorado, Florida, Idaho, Illinois, Indiana, Iowa, Kentucky, Louisiana, Maryland, Nebraska, New Jersey, New York, North Carolina, Oklahoma, Pennsylvania, Rhode Island, South Carolina, Vermont and Washington, allege Amazon has imposed undisclosed surcharges on its advertising customers, which include over 500,000 small- and medium-sized businesses that participated in auctions for advertising placements on Amazon.com and its mobile app. In these auctions, prospective advertisers bid to place Sponsored Product ads, Sponsored Brands ads and Display Ads alongside the results that appear when a consumer searches for a product using a keyword on Amazon’s store. Placements are auctioned to the highest-ranked bidder for each keyword. As described in the complaint, Amazon has represented to prospective advertisers for years that Amazon runs “second price” auctions where the winner of the auction would only pay “one cent more than the next highest bidder” for each successful bid for an advertising keyword. However, in practice, the complaint alleges that Amazon has charged its Sponsored Products advertisers their own winning bid close to 80% of the time and has effectively converted its nominally “second price” auction into a first price auction. According to the complaint, Amazon’s “second price” auctions have been described by Amazon, and understood by advertisers, to be run as generalized second-price, or GSP auctions, which have been the accepted industry standard for digital advertising placements. The complaint states that Amazon has made these or similar representations on its website, in training videos and in other public-facing materials, as well as in presentations made to advertisers by its hundreds of sales personnel.  The type of auction matters to advertisers because it impacts how they bid. In a sealed first-price auction—the type of auction where winners pay the amount of their winning bid—bidders run the risk that they might overbid. So, in repetitive auctions for the same goods, they will often reduce their bid to determine what the minimum amount needed to win future auctions might be. This is called bid shading. In second-price auctions, bidders are more likely to bid higher, closer to their true value for the product, because they will only be liable to pay the least bid amount needed to win under the auction’s rules.  As alleged in the complaint, Amazon told advertisers it ran a GSP, but for years its auction pricing had “a surcharge hidden in it,” in the words of one internal Amazon document. The complaint alleges that, beginning in 2019, Amazon changed its auction rules without notice by adding an undisclosed surcharge that Amazon referred to internally as a “soft reserve price.” This resulted in advertisers paying substantially more than the price determined by the GSP auction.  According to the complaint, Amazon"},{"source":"EDPB News","url":"https://www.edpb.europa.eu/news/news/2025/cef-2024-edpb-identifies-challenges-full-implementation-right-access_en","titre":"CEF 2024: EDPB identifies challenges to the full implementation of the right of access","pubDate":"Mon, 20 Jan 2025 15:49:16 +0100","id":1857297,"description":"Brussels, 20 January - The European Data Protection Board (EDPB) has adopted a report on the implementation of the right of access by controllers . The report summarises the outcome of a series of coordinated national actions carried out in 2024 under the Coordinated Enforcement Framework (CEF). It lists the issues that were observed for some controllers, along with a series of recommendations to help them implement the right of access. A central element is controllers’ awareness of the EDPB Guidelines 01/2022 on data subjects rights – Right of access and whether these guidelines were followed in practice. EDPB Deputy Chair Zdravko Vukíc said: “The CEF is a valuable initiative that helps strengthen the cooperation among Data Protection Authorities (DPAs): by tackling selected topics in a coordinated fashion, they achieve greater efficiency and more consistency. How controllers implement the right of access lies at the heart of data protection and it is one of the most frequently exercised data subject rights.” Throughout 2024, 30 DPAs across Europe launched coordinated investigations into the compliance of controllers with the right of access, by opening formal investigations, assessing whether a formal investigation was warranted and/or carrying out fact-finding exercises.  A total of 1,185 controllers, consisting of small and medium-sized enterprises (SMEs) and big companies active in different industries and fields, as well as various types of public entities, responded to the action. Areas of improvement and main challenges The results suggest that more awareness raising about Guidelines 01/2022 is necessary , both at national and EU level, as the guidelines help controllers implement the right of access, explain how exercising this right can be made easier, and list the exceptions and limitations of the right to access. As a result of the 2024 CEF action, seven challenges were identified. One of them is the lack of documented internal procedures to handle access requests. In addition, inconsistent and excessive interpretations of the limits to the right of access were also observed, such as overly relying on certain exceptions to automatically refuse access requests. Another example is the barriers that individuals could encounter when exercising their right of access, such as  formal requirements or being requested to provide excessive identification documents. For each challenge identified, the report provides a list of non-binding recommendations to be taken into account by controllers and DPAs. Positive findings Despite the existing challenges, two thirds of participating DPAs evaluated the level of compliance of responding controllers with respect to the right of access from ‘average’ to ‘high’. One important factor identified as having an impact on the level of compliance was the volume of access requests received by controllers, as well as the size of the organisation. More specifically, large-sized controllers or controllers receiving more requests were more likely to reach a higher level of compliance than small organisations with less resources. Positive findings were observed across Europe. These include the implementation of best practices by controllers, such as user-friendly online forms enabling individuals to submit an access request easily as well as self-service systems to allow individuals to autonomously download their personal data in a few clicks and at any time. Background and next steps The CEF is a key action of the EDPB under its 2024-2027 Strategy, aimed at streamlining enforcement and cooperation among DPAs.  In the past three years, two previous CEF actions were carried out. The results of these national actions are aggregated and analysed together to generate deeper insight into the topic and allowing for targeted follow-up on both national and EU level. In 2023, the EDPB published the report on its first coordinated action on the use of cloud-based services by the public sector . In 2024, the EDPB also published the"}]