1

132 3088

UNITED STATES OF AMERICA

FEDERAL TRADE COMMISSION

COMMISSIONERS: Edith Ramirez, Chairwoman

Julie Brill

Maureen K. Ohlhausen

Joshua D. Wright

Terrell McSweeny

In the Matter of

PaymentsMD, LLC, 

a limited liability company.

)

)

)

)

)

)

)

DOCKET NO. 

COMPLAINT

The Federal Trade Commission, having reason to believe that PaymentsMD, LLC

(“Respondent”) has violated the provisions of the Federal Trade Commission Act, and it 

appearing to the Commission that this proceeding is in the public interest, alleges:

1. Respondent PaymentsMD, LLC (“PaymentsMD”) is a Georgia limited liability company

with its principal office or place of business at 5665 New Northside Dr., Suite 320, 

Atlanta, GA 30328. PaymentsMD is a wholly owned subsidiary of ApolloMD Business 

Services, LLC.

2. The acts and practices of respondent as alleged in this complaint have been in or affecting 

commerce, as “commerce” is defined in Section 4 of the Federal Trade Commission Act.

RESPONDENT’S BUSINESS PRACTICES

3. Since 2008, PaymentsMD has provided billing services to medical providers. Medical 

providers that have contracted with PaymentsMD direct their patients to the 

PaymentsMD website, where consumers are able to enter their invoice number and credit 

card information to pay their medical bills.

4. In December 2011, PaymentsMD launched a free “Patient Portal” product that provided

consumers with a place to view their billing history. Unlike the bill-payment service, 

which enables consumers only to make a one-time payment, the billing history service of 

the Patient Portal enables consumers to access and view records of the consumers’ past 
2

and upcoming payment obligations for any medical providers that use PaymentsMD’s 

billing services. The Patient Portal service enabled consumers to pay their bills and to 

view their balance, payments made, adjustments taken, and information for other service 

dates. 

5. In June 2012, PaymentsMD entered into an agreement with Metis Health LLC (“Metis 

Health”) to develop an entirely new service called Patient Health Report, a fee-based 

service that would enable consumers to access, review, and manage their consolidated 

health records through a Patient Portal account. PaymentsMD and Metis Health agreed 

to split the profits. Both companies participated in developing the disclosures and 

authorizations for the service, and how and when this information would be presented to 

consumers during the Patient Portal registration process.

6. As described further below, in order to populate the Patient Health Report, respondent 

tried to obtain the sensitive health information of consumers registering for the Patient 

Portal from health insurance plans, pharmacies, and a medical testing lab, without 

appropriate authorization from those consumers. Indeed, many consumers registering for 

the Patient Portal had no idea that respondent would seek to collect their sensitive health 

information from third parties for use in the Patient Health Report service. 

THE PATIENT PORTAL INTERFACE FAILED TO DISCLOSE THAT 

RESPONDENT WOULD COLLECT CONSUMERS’ SENSITIVE HEALTH 

INFORMATION FOR THE PATIENT HEALTH REPORT

7. PaymentsMD’s home page described the Patient Portal as a medical billing related 

service. It stated that “At PaymentsMD, we can help you navigate through the maze of 

medical billing, reimbursement and payment processes. We also make it easy for you to 

maintain current information about your insurance coverage and to make payments over 

the Internet, at your convenience.” In order to register for the Patient Portal, a consumer 

could click on a button labeled “Patient Portal Login.” (Exhibit A).
3

8. Consumers could then either enter their login credentials or click on a link that stated 

“Don’t have an account? Create one now.” (See Exhibit B). 
4

Consumers that followed the link would then be taken to the Payment Portal registration 

page, which appeared as follows. (Exhibit C). 
5

The registration page stated that registering for the Payment Portal service would “allow 

you to: View your original balance; View any payments made; View any adjustments 

taken; View your current balance; View information for other service dates.” At no point 

in this process was it stated that respondent would be seeking consumers’ sensitive health 

information from third parties for use in a Patient Health Report service. 

9. Consumers who clicked the “Submit” button were taken to a “Patient Portal Account 

Authorization” page, which required four authorizations. The page presented the 

authorizations in four boxes that showed only six lines of text at a time. (Exhibit D).
6

Under each text box was a check box that consumers could select in order to proceed 

with the registration process. Alternatively, consumers could select a single box at the 

top of the page, which would populate all four boxes to indicate that each of the four was 
7

authorized. Although consumers who scrolled through the second and fourth boxes 

would have seen a statement that “[H]ealth records related to your treatment . . . may be 

used or disclosed pursuant to this Authorization,” the site design simultaneously made it 

hard to read the authorizations in their entirety, and easy to skip over them by clicking a 

single check box that preceded all of the authorizations. 

10. Consumers would reasonably believe that all four authorizations were to be used to 

provide the Patient Portal billing services for which they were registering. In fact,

respondent used two of the four purported authorizations to allow it to collect sensitive 

health information from third parties for use with the Patient Health Report service.

11. Although PaymentsMD’s home page and login page included links that allowed 

consumers to “click here to learn more” about the Patient Health Report service (see

Exhibit A), these links conveyed that the Patient Health Report was a separate service 

from the Patient Portal. At no point in registering for the Patient Portal would it have 

been clear to the consumer that they were purportedly giving respondent permission to 

obtain their sensitive health information from third parties for use in the Patient Health 

Report service.

RESPONDENT SOUGHT CONSUMERS’ SENSITIVE HEALTH 

INFORMATION WITHOUT THEIR KNOWLEDGE OR CONSENT

12. Respondent requested sensitive health information from a large number of health plans, 

pharmacies, and a medical lab about everyone who registered for the Patient Portal. 

These requests used consumers’ name, birth date, address, and sex. The information 

requested was as follows:

a. Pharmacies: Medication dispensed, dispense date, instructions, prescription 

number, prescribing physician, quantity dispensed, refill ability, co-pay amount, 

amount payable as co-insurance or deductible, and amount paid by health plan.

b. Health plans: Medical information (procedures, diagnoses, dates of service, 

medical providers, co-pay amount, amount payable for co-insurance or 

deductible, and the amount paid by health plan); prescription information 

(medications dispensed, dispense dates, prescription number, prescribing 

physician, quantity dispensed, refill ability, co-pay amount, amount payable as 

coinsurance or deductible, and the amount paid by health plan); and lab 

information (test performed, date, laboratory, physician, co-pay, amount payable 

as co-insurance or deductible, and amount paid by health plan).

c. Laboratory: Lab test performed, date, laboratory, test results, normal range for 

test values, ordering physician, co-pay, amount payable as co-insurance or 

deductible, and the amount paid by health plan.

13. Metis Health sent requests to health plans that were identified using PaymentsMD’s 

billing records. For the pharmacies, Metis Health sent requests to all major commercial 

pharmacies with locations near the consumers’ home address, notwithstanding that 
8

neither PaymentsMD nor Metis Health had any reason to believe that the consumer had 

used any of those pharmacies. 

14. Metis Health sent approximately 5,500 requests for consumers’ health information to 31 

different companies. One company fulfilled the requests. The others, concerned about 

the validity of the requests – which in some cases related to minors or consumers who 

were not in fact a customer of the company receiving the request – refused to fulfill the 

requests.

RESPONDENT’S SUBSEQUENT COMMUNICATIONS TO CONSUMERS 

GENERATED NUMEROUS COMPLAINTS

15. Initially, respondent did not inform consumers that Metis Health was attempting to 

collect their sensitive health information. When PaymentsMD began informing 

consumers, via an email sent a day after users registered for Patient Portal, numerous 

consumers filed complaints with PaymentsMD regarding the collection of their sensitive 

health information. The common themes of the complaints were that consumers did not 

want their information collected, and that they had only registered for the Patient Portal 

to track their bills. PaymentsMD ultimately did not sell any Patient Health Reports.

DECEPTIVE OMISSION

(Count 1)

16. As described in Paragraphs 3-15, respondent represented, directly or indirectly, expressly 

or by implication, that consumers registering for its free Patient Portal billing service 

could access and review their medical payment history.

17. Respondent failed to disclose adequately that, if consumers registered for its free Patient 

Portal billing service, respondent would also engage in a comprehensive collection from 

third parties of consumers’ sensitive health information for the Patient Health Report 

service.

18. This fact would be material to consumers in deciding whether to register for the Patient 

Portal. Respondent’s failure to disclose adequately this fact, in light of the 

representations made, is a deceptive act or practice.

DECEPTIVE REPRESENTATION

(Count 2)

19. As described in Paragraphs 3-15, respondent represented, directly or indirectly, expressly 

or by implication, that the authorizations were to be used exclusively to provide the free 

Patient Portal billing history service for which consumers were registering. 

20. In fact, the authorizations were not used exclusively to provide the free Patient Portal 

billing history service for which consumers were registering. Instead, all of the 
9

authorizations were also used by respondent to attempt to collect sensitive health 

information for use with the Patient Health report service, and two were only used for this 

purpose. Therefore, this representation is false or misleading. 

VIOLATIONS OF SECTION 5

21. The acts and practices of respondent as alleged in this complaint constitute deceptive acts 

or practices in or affecting commerce in violation of Section 5(a) of the Federal Trade 

Commission Act, 15 U.S.C. § 45(a).

THEREFORE, the Federal Trade Commission this ___ day of __________, 2014, has issued 

this complaint against respondent.

By the Commission.

Donald S. Clark

Secretary