On February 1, 2023, the FTC announced a proposed order against GoodRx, its first action under the Health Breach Notification Rule. The FTC alleged GoodRx shared users' medications and health conditions with Facebook, Google, Criteo and others despite promising not to, used the data to target ads and displayed a seal falsely suggesting HIPAA compliance. GoodRx agreed to a $1.5 million civil penalty and a ban on sharing health data for advertising. For functional medicine practices, it showed that unauthorized sharing can be treated as a breach.
Functional medicine practices collect a lot of health information. Detailed intake questionnaires, lab results, symptom trackers, supplement plans and program apps are central to how many of them work. That depth of information is what makes the care personal, and it is also what makes the data sensitive. In 2023, the FTC showed what can happen when a health company shares that kind of information with advertisers.
On February 1, 2023, the FTC announced its first enforcement action under the Health Breach Notification Rule, against telehealth and prescription discount company GoodRx. The case did not involve a functional medicine practice, but its lessons fit practices that run apps, portals, online programs and digital marketing.
This retrospective covers what happened and what it means today. It connects to our coverage of the BetterHelp order, the 2023 FTC and HHS tracking letters and Washington’s My Health My Data Act in 2024.
What actually happened in 2023
February 1: the proposed order. The FTC announced its first enforcement action under the Health Breach Notification Rule. GoodRx agreed to pay a $1.5 million civil penalty, and the proposed order, filed by the Department of Justice, required court approval.
The allegations. According to the FTC, GoodRx promised users it would never share personal health information with advertisers, then shared information including prescription medications and health conditions with Facebook, Google, Criteo and other third parties.
Ad targeting. The FTC said GoodRx uploaded lists of users who had bought particular medications to Facebook and targeted them with health-related ads.
The HIPAA seal. The FTC alleged GoodRx displayed a seal on its telehealth homepage falsely suggesting it complied with HIPAA.
The remedies. The order permanently banned sharing health data with applicable third parties for advertising, required affirmative express consent for other sharing, required GoodRx to direct third parties to delete data, limited data retention and mandated a privacy program. The Commission voted 4-0. The FTC’s health privacy guidance page collects related resources.
Why it mattered for functional medicine practices
The GoodRx case changed how the FTC’s breach rule was understood. Many people assumed a “breach” meant a hack. The FTC treated unauthorized sharing of health data, including sharing through advertising tools, as something that could trigger breach notification duties for covered entities. That shifted the question from “were we hacked?” to “did health data leave in a way people did not authorize?”
Functional medicine practices often operate partly outside traditional insurance and may offer apps, online programs, membership portals and supplement stores. Depending on structure, some of those activities may fall outside HIPAA, which is exactly the space where the FTC’s rule and the FTC Act apply.
The case also showed how ordinary marketing tools can create the problem. GoodRx’s sharing happened through pixels, software development kits and audience uploads, the same tools many practices use. None of those tools is exotic, and most are set up in minutes, which is precisely why they deserve scrutiny before they touch health information.
What typical agencies did
Most agencies serving wellness and functional medicine practices did not change much. Customer lists were still uploaded to ad platforms. Pixels stayed on program pages and checkout flows. Some websites displayed “HIPAA compliant” badges without anyone checking what supported the claim.
The better response was a privacy review that covered the website, apps, email platform and any ecommerce, followed by clear rules about what data can go where. That review needed to include tools added by vendors and former agencies, not only those the current team remembered installing, and it needed an owner inside the practice who would keep it current.
What it means for a functional medicine practice today
These steps reflect the lessons of the case without assuming any particular legal status, which is a question for counsel.
1. Map your health data
List every place health information is collected: intake forms, apps, portals, lab integrations, symptom trackers, email platforms and stores. Many practices discover they collect more than they realized, in more systems than they expected.
2. Follow the data out
For each system, identify which third parties receive data, including analytics and advertising tools embedded in apps and pages. Software development kits inside mobile apps deserve particular attention, since they are less visible than website pixels.
3. Stop health-based ad targeting
Do not upload patient or program lists tied to conditions, tests or treatments to ad platforms. Do not build audiences from health data. If reaching existing patients matters, email them directly under your own privacy terms.
4. Keep promises accurate
Make sure the privacy policy matches what actually happens, and update it whenever tools change. GoodRx’s problem began with a promise that its practices contradicted.
5. Remove unverified badges
Do not display compliance seals or claims unless counsel confirms they are accurate and supportable. A badge is a factual claim, and the FTC treats it like one.
6. Plan for incidents
Know what notification duties might apply if data is shared or exposed improperly, and who decides. Having a plan before an incident is far easier than building one during it.
Supplements, programs and ecommerce
Many functional medicine practices sell supplements or programs online. Ecommerce platforms often include pixels and marketing integrations by default. A purchase of a supplement associated with a specific condition can itself be health information. Practices should review what their store shares with ad platforms and email tools, especially at checkout.
The simplest approach is to keep advertising pixels away from product and checkout pages tied to health conditions, and to measure sales through the store’s own reporting rather than detailed ad platform tracking. Product claims also need substantiation, a separate FTC issue we cover in our piece on the 2023 substantiation notices.
Apps and patient portals
Program apps and portals are where functional medicine practices hold the most detailed data: lab values, food logs, symptom scores and protocols. Those systems are often provided by vendors, and their data practices vary widely.
Before adopting an app or portal, ask what analytics and advertising tools it embeds, what data it shares and with whom, what agreements the vendor will sign and how data is deleted when a patient leaves. The FTC made clear in 2023 that relying on a third party does not remove a company’s responsibility, a point it repeated in the July 2023 tracking letters.
State laws added to the picture
After 2023, state consumer health data laws expanded the rules for health information outside HIPAA. Washington’s My Health My Data Act, signed in April 2023, created consent requirements for consumer health data and took effect for most entities in 2024. Other states adopted their own rules. We explain the Washington law in our functional medicine retrospective.
For practices that serve patients across states through telehealth or online programs, the combined effect is that health data shared for marketing without clear consent carries growing risk.
Marketing that does not need the data
Functional medicine marketing works best when it explains the practice’s approach clearly. Educational content about how the practice evaluates patients, what a first visit includes, how programs are structured and what they cost builds the trust that leads to bookings.
Search visibility for “functional medicine near me” and related terms depends on a strong Google Business Profile, a fast and helpful website and steady reviews, none of which require sharing health data. Our functional medicine marketing guide covers that playbook.
Measuring without exposure
Practices still need to know what works. Counting consultation requests, calls and program enrollments by source answers that question. Simple attribution such as an intake question about how someone heard about the practice remains surprisingly useful, and it costs nothing to add.
What practices should avoid is sending the details of a person’s health interests to platforms that use them for advertising. Measurement and privacy can coexist when the design starts from that principle, and the resulting data is usually cleaner and easier to act on.
Email marketing deserves a second look
Email is one of the most effective channels for functional medicine practices, and it is also a place where health data can drift. Email platforms often segment subscribers by the program they joined, the lab panel they ordered or the condition-focused content they downloaded. Those segments can be useful for care communication, but practices should be careful about syncing them to ad platforms or sharing them with outside vendors.
Many email tools offer one-click integrations that send subscriber lists to social platforms for “custom audiences.” Turning those on for health-based segments recreates exactly the kind of sharing the FTC objected to in 2023. A good rule is to keep health-based segments inside the email platform, use them only for communication the patient expects and review integrations regularly.
Vendor questions worth asking
Functional medicine practices tend to use many vendors: electronic health records, lab ordering portals, scheduling tools, telehealth platforms, supplement dispensaries and program apps. Each one handles data differently. Before signing, ask a short set of questions. What tracking or analytics does the product include? Does it share data with advertising or analytics companies? Will the vendor sign the agreements your counsel requires? Where is data stored, and how is it deleted?
Write the answers down and keep them on file. If a vendor cannot answer clearly, treat that as useful information. A practice’s privacy posture is only as strong as its weakest integrated tool, and GoodRx’s own problems involved several third-party tools at once.
Trust as a growth asset
Functional medicine patients often invest significant time and money in their care. They share detailed histories and stay with a practice for months or years. That relationship depends on trust, and privacy is part of it.
A practice that can say plainly that it does not share patient health information with advertisers, and mean it, has a credible point of difference. It also removes a category of risk that could otherwise damage the reputation it has built through careful clinical work.
What 2023 does not tell us
The GoodRx order addressed one company’s conduct and its status as a vendor of personal health records. It does not tell us how the rule applies to any particular practice, which depends on facts and HIPAA status. We also have no public data on how many smaller health businesses changed their practices after the case.
The premium practice advantage
Premium functional medicine practices treat data with the same care as protocols. Visit our functional medicine marketing service, our services, who we help and our approach to Google Maps and AI search visibility. Our team works from Austin with practices nationwide.
The bottom line
The 2023 GoodRx case made unauthorized health data sharing a breach issue. Functional medicine practices that map their data, keep promises accurate and avoid health-based ad targeting stay on the right side of that line.
Check if your market is open. We take one practice per specialty per market. Request a market check or call (716) 400-0084.
Frequently asked questions
What did the FTC announce about GoodRx in 2023?
On February 1, 2023, the FTC announced a proposed order against GoodRx, its first enforcement action under the Health Breach Notification Rule, including a $1.5 million civil penalty.
What did the FTC allege GoodRx did?
Shared users' personal health information, including medications and health conditions, with Facebook, Google, Criteo and others despite privacy promises, and used the data to target health-related ads.
What is the Health Breach Notification Rule?
An FTC rule requiring vendors of personal health records and related entities not covered by HIPAA to notify consumers, the FTC and sometimes the media after a breach of health information.
Why does the HIPAA seal matter?
The FTC said GoodRx displayed a seal falsely suggesting HIPAA compliance. Compliance badges and claims on a website must be accurate.
Does this apply to functional medicine practices?
It depends on the practice's structure and HIPAA status, so get legal advice. The broader lessons about honest privacy promises and not sharing health data for ads apply widely.
What should a functional medicine practice do now?
Audit tracking on the website and any apps or portals, keep privacy promises accurate, remove unverified compliance badges and avoid sharing health data with ad platforms.