1423161

UNITED STATES OF AMERICA

FEDERAL TRADE COMMISSION

COMMISSIONERS: Edith Ramirez, Chairwoman

Julie Brill

Maureen K. Ohlhausen

Terrell McSweeny

____________________________________

In the Matter of AGREEMENT CONTAINING

CONSENT ORDER

HENRY SCHEIN 

PRACTICE SOLUTIONS, INC., DOCKET NO.

a corporation.

____________________________________

The Federal Trade Commission has conducted an investigation of certain acts and 

practices of Henry Schein Practice Solutions, Inc. (“Henry Schein”). Proposed respondent, 

having been represented by counsel, is willing to enter into an agreement containing a consent 

order resolving the allegations contained in the attached draft complaint. Therefore, 

IT IS HEREBY AGREED by and between Henry Schein, by its duly authorized officers, 

and counsel for the Federal Trade Commission that: 

1. Proposed respondent Henry Schein Practice Solutions, Inc. is a Utah corporation with its 

principal office or place of business at 1220 South 630 East, American Fork, Utah 84003. 

2. Proposed respondent neither admits nor denies any of the allegations in the complaint, 

except as specifically stated in the order. Only for purposes of this action, proposed respondent 

admits the facts necessary to establish jurisdiction. 

3. Proposed respondent waives: 

a. Any further procedural steps; 

b. The requirement that the Commission’s decision contain a statement of findings 

of fact and conclusions of law; and 

c. All rights to seek judicial review or otherwise to challenge or contest the validity 

of the order entered pursuant to this agreement. 

4. This agreement shall not become part of the public record of the proceeding unless and 

until it is accepted by the Commission. If this agreement is accepted by the Commission, it, 

together with the draft complaint, will be placed on the public record for a period of thirty (30) 
2

days and information about it publicly released. The Commission thereafter may either 

withdraw its acceptance of this agreement and so notify proposed respondent, in which event it 

will take such action as it may consider appropriate, or issue and serve its complaint (in such 

form as the circumstances may require) and decision in disposition of the proceeding. 

5. This agreement contemplates that, if it is accepted by the Commission, and if such 

acceptance is not subsequently withdrawn by the Commission pursuant to the provisions of 

Section 2.34 of the Commission’s Rules, the Commission may, without further notice to 

proposed respondent (1) issue its complaint corresponding in form and substance with the 

attached draft complaint and its decision containing the following order in disposition of the 

proceeding, and (2) make information about it public. When so entered, the order shall have the 

same force and effect and may be altered, modified, or set aside in the same manner and within 

the same time provided by statute for other orders. The order shall become final upon service. 

Delivery of the complaint and the decision and order to proposed respondent’s address as stated 

in this agreement by any means specified in Section 4.4(a) of the Commission’s Rules shall 

constitute service. Proposed respondent waives any right it may have to any other manner of 

service. The complaint may be used in construing the terms of the order. No agreement, 

understanding, representation, or interpretation not contained in the order or in the agreement 

may be used to vary or contradict the terms of the order. 

6. Proposed respondent has read the draft complaint and consent order. It understands that 

it may be liable for civil penalties in the amount provided by law and other appropriate relief for 

each violation of the order after it becomes final. 

ORDER

DEFINITIONS

For purposes of this order, the following definitions shall apply: 

1. “Affected Customer(s)” means any consumer, including any dental practice, that

purchased the Dentrix G5 dental office practice management software. 

2. “Commerce” means as defined in Section 4 of the Federal Trade Commission Act, 15 

U.S.C. § 44. 

3. “Clear(ly) and Conspicuous(ly)” means that a required disclosure is difficult to miss (i.e., 

easily noticeable) and easily understandable by ordinary consumers, including in all of the 

following ways:

A. In any communication that is solely visual or solely audible, the disclosure must 

be made through the same means through which the communication is presented. 

In any communication made through both visual and audible means, such as a 

television advertisement, the disclosure must be presented simultaneously in both 

the visual and audible portions of the communication, even if the representation 

requiring the disclosure is made in only one means. 
3

B. A visual disclosure, by its size, contrast, location, the length of time it appears, 

and other characteristics, must stand out from any accompanying text or other 

visual elements so that it is easily noticed, read, and understood. 

C. An audible disclosure, including by telephone or streaming video, must be 

delivered in a volume, speed, and cadence sufficient for ordinary consumers to 

easily hear and understand it. 

D. In any communication using an interactive electronic medium, such as the 

Internet or software, the disclosure must be unavoidable. 

E. On a product label, the disclosure must be presented on the principal display 

panel.

F. The disclosure must use diction and syntax understandable to ordinary consumers 

and must appear in each language in which the representation that requires the 

disclosure appears. 

4. “HIPAA” means the Health Insurance Portability and Accountability Act of 1996, Pub.L. 

104-191, 110 Stat. 1936. 

5. “Personal Information” shall mean individually identifiable information from or about an 

individual consumer including, but not limited to: (a) a first and last name; (b) a home or other 

physical address, including street name; (c) online contact information, such as an email address, 

instant messaging user identifier, or screen name; (d) a telephone number; (e) a Social Security 

number; (f) a driver’s license number or other government-issued identification number; (g) a 

bank account, debit card, or credit card account number; (h) a photograph; and (i) medical 

information about a consumer including, but not limited to, prescription information, clinical 

laboratory testing information, health insurance information, physician examination notes, and 

medical history.

6. “Respondent” shall mean Henry Schein Practice Solutions, Inc. and its successors and 

assigns. 

I.

IT IS ORDERED that Respondent, directly or through any corporation, subsidiary, 

division, or other device, in connection with the labeling, advertising, promotion, offering for 

sale, sale, or distribution of any product or service designed to collect or store Personal 

Information, in or affecting commerce, shall not misrepresent, in any matter, expressly or by 

implication:

A. whether or to what extent the product or service offers industry-standard 

encryption; 
4

B. the ability of the product or service to help customers meet regulatory obligations 

related to privacy or security; or

C. the extent to which a product or service maintains the privacy, security, 

confidentiality, and integrity of Personal Information.

II.

IT IS FURTHER ORDERED that Respondent must notify Affected Customers, Clearly 

and Conspicuously, that Dentrix G5 uses a less complex encryption algorithm to protect patient 

data than Advanced Encryption Standard (“AES”), which is recommended as an industry 

standard by the National Institute of Standards and Technology (“NIST”). Notification must 

include the following: 

A. Respondent must identify all Affected Customers who purchased Dentrix G5 

prior to January 2014 (“eligible customers”). 

1. Such eligible customers, and their contact information, must be identified 

to the extent such information is in Respondent’s possession, custody, or 

control. 

2. Eligible customers include those identified at any time through the 

eligibility period, which runs for one (1) year after the date of service of 

this order. 

B. Respondent must notify all identified eligible customers by mailing each a notice: 

1. The letter must be in the form shown in Attachment A.

2. The envelope containing the letter must be in the form shown in 

Attachment B. 

3. The mailing of the notification letter must not include any other 

enclosures. 

4. The mailing must be sent by first-class mail, postage prepaid, address 

correction service requested with forwarding and return postage 

guaranteed. For any mailings returned as undeliverable, Respondent must 

use standard search methodologies such as re-checking Respondent’s 

records and the Postal Service’s National Change of Address database and 

re-mailing to the corrected address within eight days. 

C. Respondent must notify all eligible customers within sixty (60) days after service 

of this order and any eligible customers identified thereafter within thirty (30) 

days of their identification. 

D. Respondent must establish a toll-free telephone number and an email address 

dedicated to responding to inquiries about the order and must respond promptly 

and accurately to such inquiries.

E. Respondent must submit reports on its notification program under penalty of 

perjury: 
5

1. Respondent must submit a report, within one hundred and twenty (120) 

days after the date of service of this order, annually thereafter, and at the 

conclusion of the program summarizing its compliance to date, including:

the total number of eligible customers identified, notices mailed, and 

notices re-mailed, the number of mailings returned as undeliverable, and 

efforts taken to locate the customers for whom mailings were returned and 

deliver them the notice, as well as the number of calls and emails received 

and their disposition. For customers for whom mailings were returned as 

undeliverable, Respondent shall make reasonable efforts to locate and 

notify those customers. 

2. If a representative of the Commission requests any information regarding 

the notice program, including any of the underlying customer data, 

Respondent must submit it within ten (10) days of the request. 

III.

IT IS FURTHER ORDERED that: 

A. Respondent must pay to the Commission $250,000, which Respondent stipulates its 

undersigned counsel holds in escrow for no purpose other than payment to the Commission. 

B. Such payment must be made within eight (8) days of the effective date of this order by 

electronic fund transfer in accordance with instructions provided by a representative of the 

Commission. 

IV.

IT IS FURTHER ORDERED that: 

A. All money paid to the Commission pursuant to this order may be deposited into a fund 

administered by the Commission or its designee to be used for relief, including consumer redress 

and any attendant expenses for the administration of any redress fund. If a representative of the 

Commission decides that direct redress to Affected Customers is wholly or partially 

impracticable or money remains after redress is completed, the Commission may apply any 

remaining money for such other relief (including consumer information remedies) as it 

determines to be reasonably related to Respondent’s practices alleged in the complaint. Any 

money not used is to be deposited to the U.S. Treasury. Respondent may, upon request, be 

notified whether the money has been deposited to the U.S. Treasury, but has no right to 

challenge any activities pursuant to this provision. No portion of any payment under this Part 

shall be deemed a payment of any fine, penalty, or punitive assessment.

B. In the event of default on any obligation to make payment under this order, interest, 

computed as if pursuant to 28 U.S.C. § 1961(a), shall accrue from the date of default to the date 

of payment. In the event such default continues for ten (10) days beyond the date that payment 

is due, the entire amount will immediately become due and payable. 
6

C. Each day of nonpayment is a violation through continuing failure to obey or neglect to 

obey a final order of the Commission and thus will be deemed a separate offense and violation 

for which a civil penalty shall accrue. 

D. Respondent acknowledges that its Taxpayer Identification Number, which Respondent 

has previously provided to the Commission, may be used for collecting and reporting on any 

delinquent amount arising out of this order, in accordance with 31 U.S.C. § 7701. 

V.

IT IS FURTHER ORDERED that Respondent must directly or indirectly provide 

sufficient customer information to enable the Commission to efficiently administer consumer 

redress to all Affected Customers. Respondent represents that it has provided this redress 

information to the Commission. If a representative of the Commission requests in writing any 

information related to redress, Respondent must provide it, in the form prescribed by the 

Commission representative, within fourteen (14) days. 

VI.

IT IS FURTHER ORDERED that Respondent shall, for five (5) years after the last date 

of dissemination of any representation covered by this order, maintain and upon request make 

available to the Commission for inspection and copying: 

A. All advertisements and promotional materials containing the representation; 

B. All materials that were relied upon in disseminating the representation; and 

C. All tests, reports, studies, surveys, demonstrations, or other evidence in its 

possession or control that contradict, qualify, or call into question the representation, or the basis 

relied upon for the representation, including complaints and other communications with 

consumers or with governmental or consumer protection organizations. 

VII.

IT IS FURTHER ORDERED that Respondent shall deliver a copy of this order to all 

current and for the next five (5) years future principals, officers, directors, and managers, and to 

all current and future employees having managerial responsibilities with respect to the subject 

matter of this order. Respondent shall deliver this order to such current personnel within thirty 

(30) days after service of this order, and to such future personnel within thirty (30) days after the 

person assumes such position or responsibilities. For any business entity resulting from any 

change in structure set forth in Part VIII, delivery shall be at least ten (10) days prior to the 

change in structure. Respondent must secure a signed and dated statement acknowledging 

receipt of this order, within thirty (30) days of delivery, from all persons receiving a copy of the 

order pursuant to this section. 
7

VIII.

IT IS FURTHER ORDERED that Respondent shall notify the Commission at least thirty 

(30) days prior to any change in the corporation(s) that may affect compliance obligations arising 

under this order, including but not limited to a dissolution, assignment, sale, merger, or other 

action that would result in the emergence of a successor corporation; the creation or dissolution 

of a subsidiary, parent, or affiliate that engages in any acts or practices subject to this order; the 

proposed filing of a bankruptcy petition; or a change in the corporate name or address. Provided, 

however, that with respect to any proposed change in the corporation about which Respondent 

learns less than thirty (30) days prior to the date such action is to take place, Respondent shall 

notify the Commission as soon as is practicable after obtaining such knowledge. Unless 

otherwise directed by a representative of the Commission in writing, all notices required by this 

Part shall be emailed to Debrief@ftc.gov or sent by overnight courier (not the U.S. Postal 

Service) to: Associate Director for Enforcement, Bureau of Consumer Protection, Federal Trade 

Commission, 600 Pennsylvania Avenue NW, Washington, DC 20580. The subject line must be: 

In re Henry Schein Practice Solutions, Inc..

IX.

IT IS FURTHER ORDERED that Respondent, within sixty (60) days after the date of 

service of this order, shall file with the Commission a true and accurate report, in writing, setting 

forth in detail the manner and form of its compliance with this order. Within ten (10) days of 

receipt of written notice from a representative of the Commission, Respondent shall submit 

additional true and accurate written reports. 

X.

This order will terminate twenty (20) years from the date of its issuance, or twenty (20) 

years from the most recent date that the United States or the Federal Trade Commission files a 

complaint (with or without an accompanying consent decree) in federal court alleging any 

violation of the order, whichever comes later; provided, however, that the filing of such a 

complaint will not affect the duration of: 

A. Any Part in this order that terminates in less than twenty (20) years; 

B. This order’s application to any Respondent that is not named as a defendant in 

such complaint; and 

C. This order if such complaint is filed after the order has terminated pursuant to this 

Part. 

Provided further, that if such complaint is dismissed or a federal court rules that the Respondent 

did not violate any provision of the order, and the dismissal or ruling is either not appealed or 

upheld on appeal, then the order will terminate according to this Part as thought the complaint 

had never been filed, except that the order will not terminate between the date such complaint is 
8

filed and the later of the deadline for appealing such dismissal or ruling and the date such 

dismissal or ruling is upheld on appeal. 

Signed this day of , 2015

________________________________

MICHAEL ETTINGER

Vice President, 

Henry Schein Practice Solutions, Inc. 

__________________________________

CHRISTOPHER E. ONDECK

Counsel for Henry Schein Practice Solutions, Inc.

___________________________________

JESSICA L. LYON

Counsel for the Federal Trade Commission

____________________________________

KRISTIN J. MADIGAN

Counsel for the Federal Trade Commission
9

APPROVED: 

______________________________________________

MANEESHA MITHAL, Associate Director

Division of Privacy and Identity Protection 

________________________________________________

LAURA RIPOSO VANDRUFF, Acting Assistant Director

Division of Privacy and Identity Protection

_________________________________________________

JESSICA L. RICH, Director

Bureau of Consumer Protection
Attachment A
[To appear on Henry Schein Practice Solutions, Inc. letterhead]

[Date]

[Name of customer] 

[Mailing address of customer

Including zip code] 

SUBJECT: Important Information Regarding the Security of Patient Records 

Stored in Dentrix G5

Dear Valued Customer:

Our records show you purchased Dentrix G5, which is sold by our company, Henry Schein 

Practice Solutions, Inc. (“HSPS”), prior to January 2014. 

From early 2012 to January 2014, we advertised that Dentrix G5 “encrypts” patient data and 

helps dentists meet the security requirements of HIPAA, the Health Insurance Portability and 

Accountability Act. But according to the Federal Trade Commission, the nation’s consumer

protection agency, our claims were deceptive. To resolve the case, we have agreed to not make 

those claims in the future and to contact our customers so they can take appropriate steps to 

protect patient records, if necessary.

We understand that the security of your patients’ records is important to you. So here’s what you 

need to know if you use our software. 

The Department of Health and Human Services (“HHS”) looks to the National Institute of 

Standards and Technology for guidance on how healthcare providers should encrypt sensitive 

information. NIST recommends a method called Advanced Encryption Standard (AES) and 

says, “Whenever possible, AES should be used for the encryption algorithm because of its 

strength and speed.”

This is important because if a dental practice using AES encryption experiences a data breach, it 

may not have to contact patients under HHS’ Breach Notification Rule. Our software uses a less 

complex method that doesn’t meet the AES encryption standard recommended by HHS and 

NIST. Therefore, practices relying on Dentrix G5 software alone would not qualify for the safe 

harbor under the Breach Notification Rule. If you experience a data breach, you may have to 

contact each affected patient personally – and depending on the size of the breach, you may have 

to notify HHS and others, too. Of course, you should obtain your own legal advice in the event 

of a data breach. 

As of January 2014, our marketing materials state that our software “masks” data, but doesn’t

encrypt it. That description is more accurate and will help dentists make informed decisions 

about protecting their patients’ data. We also strongly recommend that dentists consider multiple 

safeguards to secure access to patient data and work with both IT and security policy experts to 

create and implement a comprehensive security plan for their practice. 
If you have questions, please call us at [toll-free telephone number and email address dedicated 

to responding to inquiries regarding this notice]. To learn more about the FTC’s case, please call 

the FTC at 1-877-FTC-HELP. 

Sincerely, 

[Signature]

[Name – printed] 

[Title – President] 

Henry Schein Practice Solutions, Inc. 
Attachment B
First-class 

postage 

stamp

Dennis Dentist

123 Main Street

Anytown, Anystate 00000

Henry Schein Practice Solutions, Inc. 

[Return Address] 

GOVERNMENT ORDERED NOTICE 

[14 pt. bold type] 

FORWARDING AND RETURN POSTAGE GUARANTEED