1

UNITED STATES OF AMERICA

FEDERAL TRADE COMMISSION

In the Matter of

MICHAEL C. HUGHES, 

individually.

)

)

)

)

)

)

)

FILE NO. 132 3088

AGREEMENT CONTAINING 

CONSENT ORDER

The Federal Trade Commission (“Commission”) has conducted an investigation of 

certain acts and practices of Michael C. Hughes (“proposed respondent”), former CEO and 

partial owner of PaymentsMD, LLC (“PaymentsMD”). Proposed respondent, having been 

represented by counsel, is willing to enter into an agreement containing a consent order resolving 

the allegations contained in the attached draft complaint. Therefore,

IT IS HEREBY AGREED by and between Michael C. Hughes, individually, and 

counsel for the Federal Trade Commission that:

1. Proposed respondent Michael C. Hughes was the CEO and partial owner of PaymentsMD

from approximately August 2008 to July 2014. Individually, or in concert with others, he 

formulated, directed, controlled, or participated in the policies, acts, or practices of the 

company. He resides in Atlanta, Georgia.

2. Proposed respondent waives:

A. any further procedural steps;

B. the requirement that the Commission’s decision contain a statement of findings of 

fact and conclusions of law; and

C. all rights to seek judicial review or otherwise to challenge or contest the validity 

of the order entered pursuant to this agreement.

3. This agreement shall not become part of the public record of the proceeding unless and 

until it is accepted by the Commission. If this agreement is accepted by the Commission, 

it, together with the draft complaint, will be placed on the public record for a period of 

thirty (30) days and information about it publicly released. The Commission thereafter 

may either withdraw its acceptance of this agreement and so notify proposed respondent, 

in which event it will take such action as it may consider appropriate, or issue and serve 

its complaint (in such form as the circumstances may require) and decision in disposition 

of the proceeding.
2

4. Proposed respondent neither admits nor denies any of the allegations in the draft 

complaint, except as specifically stated in this order. Only for purposes of this action, 

proposed respondent admits the facts necessary to establish jurisdiction.

5. This agreement contemplates that, if it is accepted by the Commission, and if such 

acceptance is not subsequently withdrawn by the Commission pursuant to the provisions 

of Section 2.34 of the Commission’s Rules, the Commission may, without further notice 

to proposed respondent, (1) issue its complaint corresponding in form and substance with 

the attached draft complaint and its decision containing the following order in disposition 

of the proceeding, and (2) make information about it public. When so entered, the order 

shall have the same force and effect and may be altered, modified, or set aside in the 

same manner and within the same time provided by statute for other orders. The order 

shall become final upon service. Delivery of the complaint and the decision and order to 

proposed respondent’s address by any means specified in Section 4.4(a) of the 

Commission’s Rules shall constitute service. Proposed respondent waives any right he 

may have to any other manner of service. The complaint may be used in construing the 

terms of the order. No agreement, understanding, representation, or interpretation not 

contained in the order or the agreement may be used to vary or contradict the terms of the 

order.

6. Proposed respondent has read the draft complaint and consent order. Proposed 

respondent understands that he may be liable for civil penalties in the amount provided 

by law and other appropriate relief for each violation of the order after it becomes final. 

ORDER

DEFINITIONS

For purposes of this Order, the following definitions shall apply:

1. “Covered information” shall mean information from or about an individual consumer, 

including but not limited to (a) a first and last name; (b) a home or other physical address, 

including street name and name of city or town; (c) an email address or other online 

contact information, such as an instant messaging user identifier or a screen name; (d) a 

telephone number; (e) a Social Security number; (f) a driver’s license or other stateissued identification number; (g) a financial institution account number; (h) an insurance 

account number or other insurance information; (i) credit or debit card information; 

(j) credit report information; (k) a persistent identifier, such as a customer number held in 

a “cookie,” a static Internet Protocol (“IP”) address, a mobile device ID, or processor 

serial number; and (l) health information, as defined below.

2. “Health information” shall mean information about an individual consumer’s health or 

medical care, including but not limited to (a) an insurance account number or other 

insurance information; (b) prescription information; (c) medical records; (d) information 
3

concerning the consumer’s diagnoses or treatments; and (e) medical or health related 

purchases.

3. Unless otherwise specified, “respondent” shall mean Michael C. Hughes, individually.

4. “Commerce” shall mean as defined in Section 4 of the Federal Trade Commission Act, 

15 U.S.C. § 44.

5. “Clear(ly) and prominent(ly)” shall mean:

a. In textual communications (e.g., printed publications or words displayed on the 

screen of a computer or mobile device), the required disclosures are of a type, 

size, and location sufficiently noticeable for an ordinary consumer to read and 

comprehend them, in print that contrasts highly with the background on which 

they appear;

b. In communications disseminated orally or through audible means (e.g., radio or 

streaming audio), the required disclosures are delivered in a volume and cadence 

sufficient for an ordinary consumer to hear and comprehend them; 

c. In communications disseminated through video means (e.g., television or 

streaming video), the required disclosures are in writing in a form consistent with 

subparagraph (a) of this definition and shall appear on the screen for a duration 

sufficient for an ordinary consumer to read and comprehend them, and in the 

same language as the predominant language that is used in the communication; 

d. In communications made through interactive media, such as the Internet, online 

services, and software, the required disclosures are unavoidable and presented in a 

form consistent with subparagraph (a) of this definition, in addition to any audio 

or video presentation of them; and

e. In all instances, the required disclosures: (1) are presented in an understandable 

language and syntax, and (2) include nothing contrary to, inconsistent with, or in 

mitigation of any statement contained within the disclosure or within any 

document linked to or referenced therein.

I.

IT IS ORDERED that respondent, directly or through any corporation, subsidiary, 

division, website, or other device or affiliate owned or controlled by respondent, in or affecting 

commerce, shall not misrepresent, in any manner, expressly or by implication, the extent to 

which respondent uses, maintains, and protects the privacy, confidentiality, security, or integrity 

of covered information collected from or about consumers, including but not limited to: 

A. Services for which consumers are being enrolled in as part of any sign-up process;

B. The extent to which respondent will share covered information with, or seek 

covered information from, third parties; and
4

C. The purpose(s) for which covered information collected from third parties will be 

used.

II.

IT IS FURTHER ORDERED that respondent, directly or through any corporation, 

subsidiary, division, website, or other device or affiliate owned or controlled by respondent, in or 

affecting commerce, in connection with the online advertising, marketing, promotion, offering 

for sale, sale, or dissemination of any service, shall:

A. Separate and apart from any final “end user license agreement,” “privacy policy,”

“terms of use” page, or similar document, clearly and prominently disclose to 

consumers the practices regarding the collection, use, storage, disclosure or sharing of 

health information prior to seeking authorization to collect health information from a 

third party; and 

B. Obtain affirmative express consent from consumers prior to collecting health 

information from a third party.

III.

IT IS FURTHER ORDERED that respondent, directly or through any corporation, 

subsidiary, division, website, or other device or affiliate owned or controlled by respondent, in or 

affecting commerce, shall not use or collect any covered information pursuant to any

authorization obtained from consumers registering for the Patient Portal, or permit any third 

party to use or maintain any such covered information in respondent’s custody or control. 

Within sixty (60) days after the date of service of the order, respondent shall permanently delete 

or destroy any and all covered information in respondent’s possession or control that was 

collected pursuant to such authorization and shall provide a written statement to the Commission, 

sworn under penalty of perjury, confirming that all such information has been deleted or 

destroyed or that respondent does not possess or control such information. Provided that, if 

respondent is prohibited from deleting or destroying such information by law, regulation, or 

court order, respondent shall provide a written statement to the Commission, sworn under 

penalty of perjury, identifying any information that has not been deleted or destroyed and the 

specific law, regulation, or court order that prohibits respondent from deleting or destroying such 

information. Unless otherwise directed by a representative of the Commission, all statements 

required by this Part shall be sent by overnight courier (not the U.S. Postal Service) to the 

Associate Director of Enforcement, Bureau of Consumer Protection, Federal Trade Commission, 

600 Pennsylvania Avenue NW, Washington, DC 20580, with the subject line In the Matter of

Michael C. Hughes, LLC, FTC File No. XXXXX. Provided, however, that, in lieu of overnight 

courier, notices may be sent by first-class mail, but only if an electronic version of such notices 

is contemporaneously sent to the Commission at DEbrief@ftc.gov.
5

IV.

IT IS FURTHER ORDERED that respondent shall maintain and upon request make 

available to the Federal Trade Commission for inspection and copying, for a period of five (5) 

years from the date of preparation or dissemination, whichever is later, a print or electronic copy 

of all documents relating to compliance with this order, including but not limited to:

A. statements disseminated to consumers that describe the extent to which

respondent maintains and protects the privacy, security and confidentiality of 

any covered information, including, but not limited to, any statement related 

to a change in any website or service controlled by respondent that relates to 

the privacy, security, and confidentiality of covered information, with all 

materials relied upon in making or disseminating such statements;

B. all consumer complaints directed to respondent, or forwarded to respondent 

by a third party, that relate to the conduct prohibited by this order, and any 

responses to such complaints; and

C. all forms, websites, and other methods used to obtain affirmative express 

consent to collect health information from third parties; and any documents, 

whether prepared by or on behalf of respondent, that contradict, qualify, or 

call into question compliance with this order.

V.

IT IS FURTHER ORDERED that respondent, for any business that such respondent is 

the majority owner of or controls directly or indirectly, shall deliver a copy of this order to all 

current, and for five (5) years to all future subsidiaries, principals, officers, directors, and 

managers, and to all current, and for five (5) years to all future employees, agents, and 

representatives having responsibilities relating to the subject matter of this order. Respondent 

shall deliver this order to such current personnel within thirty (30) days after service of this 

order, and to such future personnel within thirty (30) days after the person assumes such position 

or responsibilities. Respondent must secure a signed and dated statement acknowledging receipt 

of this order, within thirty (30) days of delivery, from all persons receiving a copy of the order 

pursuant to this Part.

VI.

IT IS FURTHER ORDERED that respondent, for five (5) years after entry of this

order, shall notify the Commission of any changes to his current business or employment, or his 

affiliation with any new business or employment. Such notice shall include: the name and 

address of each business that respondent is affiliated with, employed by, creates or forms, 

incorporates, or performs services for; a detailed description of the nature of the business; and a 

detailed description of respondent’s duties and responsibilities in connection with the business or 

employment; and any changes in respondent’s name or use of any aliases or fictitious names, 

including “doing business as” names. All notices required by this Part shall be sent by overnight 
6

courier (not the U.S. Postal Service) to the Associate Director of Enforcement, Bureau of 

Consumer Protection, Federal Trade Commission, 600 Pennsylvania Avenue NW, Washington, 

D.C. 20580, with the subject line In the Matter of Michael C. Hughes, FTC File No. XXXXX.

Provided, however, that in lieu of overnight courier, notices may be sent by first-class mail, but 

only if an electronic version of any such notice is contemporaneously sent to the Commission at 

Debrief@ftc.gov.

VII.

IT IS FURTHER ORDERED that respondent within sixty (60) days after the date of 

service of this order, shall file with the Commission a true and accurate report, in writing, setting 

forth in detail the manner and form of his compliance with this order. Within ten (10) days of 

receipt of written notice from a representative of the Commission, he shall submit an additional 

true and accurate written report.

VIII.

This order will terminate twenty (20) years from the date of its issuance, or twenty (20) 

years from the most recent date that the United States or the Commission files a complaint (with 

or without an accompanying consent decree) in federal court alleging any violation of the order, 

whichever comes later; provided, however, that the filing of such a complaint will not affect the 

duration of:

A. any Part in this order that terminates in fewer than twenty (20) years;

B. this order’s application to any respondent that is not named as a defendant in such 

complaint; and

C. this order if such complaint is filed after the order has terminated pursuant to this 

Part.

Provided, further, that if such complaint is dismissed or a federal court rules that respondent did 

not violate any provision of the order, and the dismissal or ruling is either not appealed or upheld 

on appeal, then the order as to such respondent will terminate according to this Part as though the 

complaint had never been filed, except that the order will not terminate between the date such 

complaint is filed and the later of the deadline for appealing such dismissal or ruling and the date 

such dismissal or ruling is upheld on appeal.
7

Signed this ________ day of __________, 2014.

MICHAEL C. HUGHES

Dated: ____ By: ____________________________________

MICHAEL C. HUGHES

Dated: _____ By: ____________________________________

LISA J. SOTTO

HUNTON & WILLIAMS LLP

Counsel for Michael C. Hughes

FEDERAL TRADE COMMISSION

Dated: _____ By:_____________________________________

KEVIN H. MORIARTY

DAVID W. LINCICUM

JACQUELINE K. CONNOR

Counsel for the Federal Trade Commission
8

APPROVED:

_________________________________

MARK EICHORN

Assistant Director

Division of Privacy and Identity Protection

_________________________________

MANEESHA MITHAL

Associate Director 

Division of Privacy and Identity Protection 

_________________________________

JESSICA RICH

Director

Bureau of Consumer Protection