FTC Settlement with Flo Health Over Health Data Sharing
The FTC finalized its order against Flo Health for sharing sensitive health data from its period-tracking app with third-party analytics firms including Facebook and Google, despite explicit privacy promises to users. The settlement requires Flo to obtain independent reviews of its privacy practices and obtain user consent before sharing health information. This case marked a turning point in FTC enforcement around health app data sharing outside HIPAA's traditional scope.
Key Analytics
Impact Analysis
Health-adjacent SaaS companies and digital health apps operating outside HIPAA's covered entity framework now face direct FTC scrutiny for deceptive data practices. Organizations collecting sensitive health data must treat privacy representations as binding commitments enforceable under Section 5. The settlement signaled that the FTC would aggressively pursue health data misuse even where HIPAA does not technically apply.
Recommended Actions
- Audit all third-party SDK integrations and analytics tools for unauthorized health data sharing
- Ensure privacy policies accurately reflect actual data collection and sharing practices
- Implement consent management workflows for any sharing of sensitive health information with third parties
Always verify requirements with official regulatory sources.
Estimated Remediation Effort
Indicative effort to address this development, broken down by your organization's current compliance posture. Select the posture that best matches where you are today.
A partial program exists: some policies and controls are in place, but coverage, evidence, and ownership have gaps.
- ›SDK and analytics sharing audit against current disclosures
- ›Consent workflow gaps for sensitive health data
- ›Privacy policy accuracy review
The Cost of Waiting
Readiness work is dramatically cheaper before a deadline than after one. The ranges below come from the same estimate: the difference is only how prepared you are when the work starts.
Roughly 60 to 140 hours avoided by preparing early
Effort ranges are indicative planning estimates, not quotes. Actual effort depends on organizational scope, environment complexity, and evidence maturity. Talk to us for a scoped assessment.