1

UNITED STATES OF AMERICA

FEDERAL TRADE COMMISSION

In the Matter of

PaymentsMD, LLC, a limited liability 

company.

)

)

)

)

)

)

)

)

)

)

FILE NO. 132 3088

AGREEMENT CONTAINING 

CONSENT ORDER

The Federal Trade Commission (“Commission”) has conducted an investigation of 

certain acts and practices of PaymentsMD, LLC (“PaymentsMD” or “proposed respondent”), a 

limited liability company. Proposed respondent, having been represented by counsel, is willing 

to enter into an agreement containing a consent order resolving the allegations contained in the 

attached draft complaint. Therefore,

IT IS HEREBY AGREED by and between PaymentsMD, by its duly authorized 

officers, and counsel for the Federal Trade Commission that:

1. Proposed respondent PaymentsMD, LLC, is a Georgia limited liability company with its 

principal office or place of business at 5665 New Northside Dr., Suite 320, Atlanta, GA 

30328.

2. Proposed respondent waives:

A. any further procedural steps;

B. the requirement that the Commission’s decision contain a statement of findings of 

fact and conclusions of law; and

C. all rights to seek judicial review or otherwise to challenge or contest the validity 

of the order entered pursuant to this agreement.

3. This agreement shall not become part of the public record of the proceeding unless and 

until it is accepted by the Commission. If this agreement is accepted by the Commission, 

it, together with the draft complaint, will be placed on the public record for a period of 

thirty (30) days and information about it publicly released. The Commission thereafter 

may either withdraw its acceptance of this agreement and so notify proposed respondent, 

in which event it will take such action as it may consider appropriate, or issue and serve 
2

its complaint (in such form as the circumstances may require) and decision in disposition 

of the proceeding.

4. Proposed respondent neither admits nor denies any of the allegations in the draft 

complaint, except as specifically stated in this order. Only for purposes of this action, 

proposed respondent admits the facts necessary to establish jurisdiction.

5. This agreement contemplates that, if it is accepted by the Commission, and if such 

acceptance is not subsequently withdrawn by the Commission pursuant to the provisions 

of Section 2.34 of the Commission’s Rules, the Commission may, without further notice 

to proposed respondent, (1) issue its complaint corresponding in form and substance with 

the attached draft complaint and its decision containing the following order in disposition 

of the proceeding, and (2) make information about it public. When so entered, the order 

shall have the same force and effect and may be altered, modified, or set aside in the 

same manner and within the same time provided by statute for other orders. The order 

shall become final upon service. Delivery of the complaint and the decision and order to 

proposed respondent’s address as stated in this agreement by any means specified in 

Section 4.4(a) of the Commission’s Rules shall constitute service. Proposed respondent 

waives any right it may have to any other manner of service. The complaint may be used 

in construing the terms of the order. No agreement, understanding, representation, or 

interpretation not contained in the order or the agreement may be used to vary or 

contradict the terms of the order.

6. Proposed respondent has read the draft complaint and consent order. Proposed 

respondent understands that it may be liable for civil penalties in the amount provided by 

law and other appropriate relief for each violation of the order after it becomes final. 

ORDER

DEFINITIONS

For purposes of this Order, the following definitions shall apply:

1. “Covered information” shall mean information from or about an individual consumer, 

including but not limited to (a) a first and last name; (b) a home or other physical address, 

including street name and name of city or town; (c) an email address or other online 

contact information, such as an instant messaging user identifier or a screen name; (d) a 

telephone number; (e) a Social Security number; (f) a driver’s license or other stateissued identification number; (g) a financial institution account number; (h) an insurance 

account number or other insurance information; (i) credit or debit card information; 

(j) credit report information; (k) a persistent identifier, such as a customer number held in 

a “cookie,” a static Internet Protocol (“IP”) address, a mobile device ID, or processor 

serial number; and (l) health information, as defined below.
3

2. “Health information” shall mean information about an individual consumer’s health or 

medical care, including but not limited to (a) an insurance account number or other 

insurance information; (b) prescription information; (c) medical records; (d) information 

concerning the consumer’s diagnoses or treatments; and (e) medical or health related 

purchases.

3. Unless otherwise specified, “respondent” shall mean PaymentsMD, LLC and its 

successors and assigns.

4. “Commerce” shall mean as defined in Section 4 of the Federal Trade Commission Act, 

15 U.S.C. § 44.

5. “Clear(ly) and prominent(ly)” shall mean:

a. In textual communications (e.g., printed publications or words displayed on the 

screen of a computer or mobile device), the required disclosures are of a type, 

size, and location sufficiently noticeable for an ordinary consumer to read and 

comprehend them, in print that contrasts highly with the background on which 

they appear;

b. In communications disseminated orally or through audible means (e.g., radio or 

streaming audio), the required disclosures are delivered in a volume and cadence 

sufficient for an ordinary consumer to hear and comprehend them; 

c. In communications disseminated through video means (e.g., television or 

streaming video), the required disclosures are in writing in a form consistent with 

subparagraph (a) of this definition and shall appear on the screen for a duration 

sufficient for an ordinary consumer to read and comprehend them, and in the 

same language as the predominant language that is used in the communication; 

d. In communications made through interactive media, such as the Internet, online 

services, and software, the required disclosures are unavoidable and presented in a 

form consistent with subparagraph (a) of this definition, in addition to any audio 

or video presentation of them; and

e. In all instances, the required disclosures: (1) are presented in an understandable 

language and syntax, and (2) include nothing contrary to, inconsistent with, or in 

mitigation of any statement contained within the disclosure or within any 

document linked to or referenced therein.
4

I.

IT IS ORDERED that respondent and its officers, agents, representatives, and 

employees, directly or through any corporation, subsidiary, division, website, or other device or 

affiliate owned or controlled by respondent, in or affecting commerce, shall not misrepresent, in 

any manner, expressly or by implication, the extent to which respondent uses, maintains, and 

protects the privacy, confidentiality, security, or integrity of covered information collected from 

or about consumers, including but not limited to: 

A. Services for which consumers are being enrolled as part of any sign-up process;

B. The extent to which respondent will share covered information with, or seek covered 

information from, third parties; and

C. The purpose(s) for which covered information collected from third parties will be 

used.

II.

IT IS FURTHER ORDERED that respondent and its officers, agents, representatives, 

and employees, directly or through any corporation, subsidiary, division, website, or other device 

or affiliate owned or controlled by respondent, in or affecting commerce, in connection with the 

online advertising, marketing, promotion, offering for sale, sale, or dissemination of any service, 

shall:

A. Separate and apart from any final “end user license agreement,” “privacy policy,”

“terms of use” page, or similar document, clearly and prominently disclose to 

consumers respondent’s practices regarding the collection, use, storage, disclosure or 

sharing of health information prior to seeking authorization to collect health

information from a third party; and 

B. Obtain affirmative express consent from consumers prior to collecting health 

information from a third party.

III.

IT IS FURTHER ORDERED that respondent and its officers, agents, representatives, 

and employees, directly or through any corporation, subsidiary, division, website, or other device 

or affiliate owned or controlled by respondent, in or affecting commerce, shall not use, collect or 

permit any third party to use or collect any covered information pursuant to any authorization 

obtained prior to the date of service of this order from consumers registering for the Patient 

Portal, except for the sole purpose of offering any health-related bill-payment or bill history 

services. Within sixty (60) days after the date of service of the order, respondent shall

permanently delete or destroy all covered information in respondent’s possession or control that 

was collected pursuant to such authorization by or on behalf of respondent from any third party 

for any purpose except for the offering of any health-related bill-payment or bill history services
5

and shall provide a written statement to the Commission, sworn under penalty of perjury,

confirming that all such information has been deleted or destroyed. Provided that, if respondent

is prohibited from deleting or destroying such information by law, regulation, or court order,

respondent shall provide a written statement to the Commission, sworn under penalty of perjury,

identifying any information that has not been deleted or destroyed and the specific law,

regulation, or court order that prohibits respondent from deleting or destroying such information.

Unless otherwise directed by a representative of the Commission, all statements required by this

Part shall be sent by overnight courier (not the U.S. Postal Service) to the Associate Director of

Enforcement, Bureau of Consumer Protection, Federal Trade Commission, 600 Pennsylvania

Avenue NW, Washington, DC 20580, with the subject line In the Matter of PaymentsMD, LLC,

FTC File No. 1323088. Provided, however, that, in lieu of overnight courier, notices may be 

sent by first-class mail, but only if an electronic version of such notices is contemporaneously 

sent to the Commission at DEbrief@ftc.gov.

IV.

IT IS FURTHER ORDERED that respondent shall maintain and upon request make 

available to the Federal Trade Commission for inspection and copying, for a period of five (5) 

years from the date of preparation or dissemination, whichever is later, a print or electronic copy 

of all documents relating to compliance with this order, including but not limited to:

A. statements disseminated to consumers that describe the extent to which respondent 

maintains and protects the privacy, security and confidentiality of any covered 

information, including, but not limited to, any statement related to a change in any 

website or service controlled by respondent that relates to the privacy, security, and 

confidentiality of covered information, with all materials relied upon in making or 

disseminating such statements;

B. all consumer complaints directed at respondent, or forwarded to respondent by a third 

party, that relate to the conduct prohibited by this order, and any responses to such 

complaints; and

C. all forms, websites, and other methods used to obtain affirmative express consent to 

collect health information from third parties; and any documents, whether prepared 

by or on behalf of respondent, that contradict, qualify, or call into question 

compliance with this order.
6

V.

IT IS FURTHER ORDERED that respondent shall deliver a copy of this order to all 

current and future subsidiaries, current and future principals, officers, directors, and managers, 

and to all current and future employees, agents, and representatives having responsibilities 

relating to the subject matter of this order. Respondent shall deliver this order to such current 

subsidiaries and personnel within thirty (30) days after service of this order, and to such future 

subsidiaries and personnel within thirty (30) days after the person or subsidiary assumes such 

position or responsibilities. For any business entity resulting from any change in structure set 

forth in Part VI, delivery shall be at least ten (10) days prior to the change in structure. 

Respondent must secure a signed and dated statement acknowledging receipt of this order, within 

thirty (30) days of delivery, from all persons or subsidiaries receiving a copy of the order 

pursuant to this Part.

VI.

IT IS FURTHER ORDERED that respondent shall notify the Commission at least 

thirty (30) days prior to any change in the corporation(s) that may affect compliance obligations 

arising under this order, including, but not limited to: a dissolution, assignment, sale, merger, or 

other action that would result in the emergence of a successor corporation; the creation or 

dissolution of a subsidiary, parent, or affiliate that engages in any acts or practices subject to this 

order; the proposed filing of a bankruptcy petition; or a change in the corporate name or address. 

Provided, however, that, with respect to any proposed change in the corporation(s) about which 

respondent learns fewer than thirty (30) days prior to the date such action is to take place, 

respondent shall notify the Commission as soon as is practicable after obtaining such knowledge. 

Unless otherwise directed by a representative of the Commission, all notices required by this Part 

shall be sent by overnight courier (not the U.S. Postal Service) to the Associate Director of 

Enforcement, Bureau of Consumer Protection, Federal Trade Commission, 600 Pennsylvania 

Avenue NW, Washington, D.C. 20580, with the subject line In the Matter of PaymentsMD, LLC, 

FTC File No. 1323088. Provided, however, that in lieu of overnight courier, notices may be sent 

by first-class mail, but only if an electronic version of any such notice is contemporaneously sent 

to the Commission at Debrief@ftc.gov.

VII.

IT IS FURTHER ORDERED that respondent within sixty (60) days after the date of 

service of this order, shall file with the Commission a true and accurate report, in writing, setting 

forth in detail the manner and form of its compliance with this order. Within ten (10) days of 

receipt of written notice from a representative of the Commission, it shall submit an additional 

true and accurate written report.

VIII.

This order will terminate twenty (20) years from the date of its issuance, or twenty (20) 

years from the most recent date that the United States or the Commission files a complaint (with 
7

or without an accompanying consent decree) in federal court alleging any violation of the order, 

whichever comes later; provided, however, that the filing of such a complaint will not affect the 

duration of:

A. any Part in this order that terminates in fewer than twenty (20) years;

B. this order’s application to any respondent that is not named as a defendant in such 

complaint; and

C. this order if such complaint is filed after the order has terminated pursuant to this 

Part.

Provided, further, that if such complaint is dismissed or a federal court rules that respondent did 

not violate any provision of the order, and the dismissal or ruling is either not appealed or upheld 

on appeal, then the order as to such respondent will terminate according to this Part as though the 

complaint had never been filed, except that the order will not terminate between the date such 

complaint is filed and the later of the deadline for appealing such dismissal or ruling and the date 

such dismissal or ruling is upheld on appeal.

Signed this ________ day of July, 2014.

PAYMENTSMD, LLC

Dated: _____ By: ____________________________________

David Afshar, Secretary

PaymentsMD, LLC

Dated: _____ By: ____________________________________

Kristy Brown, Esq.

Alston & Bird LLP

FEDERAL TRADE COMMISSION

Dated: _____ By:_____________________________________

KEVIN H. MORIARTY

DAVID W. LINCICUM

JACQUELINE K. CONNOR

Counsel for the Federal Trade Commission
8

APPROVED:

_________________________________

MARK EICHORN

Assistant Director

Division of Privacy and Identity Protection

_________________________________

MANEESHA MITHAL

Associate Director 

Division of Privacy and Identity Protection 

_________________________________

JESSICA RICH

Director

Bureau of Consumer Protection