142-3039

Page 1 of 6

UNITED STATES OF AMERICA

BEFORE THE FEDERAL TRADE COMMISSION

COMMISSIONERS: Edith Ramirez, Chairwoman

Maureen K. Ohlhausen

Terrell McSweeny

In the Matter of

Practice Fusion, Inc.

)

)

)

)

)

DOCKET NO. CCOMPLAINT

The Federal Trade Commission, having reason to believe that Practice Fusion, Inc.

(“Respondent”) has violated the provisions of the Federal Trade Commission Act, and it 

appearing to the Commission that this proceeding is in the public interest, alleges:

1. Respondent Practice Fusion, Inc. (“Practice Fusion” or “Respondent”) is a Delaware 

corporation with its principal office or place of business at 650 Townsend Street,

Suite 500, San Francisco, California 94103.

2. The acts and practices of Respondent as alleged in this complaint have been in or 

affecting commerce, as “commerce” is defined in Section 4 of the Federal Trade 

Commission Act.

RESPONDENT’S BUSINESS PRACTICES

3. Since 2007, Respondent has provided services for healthcare providers. Its core service 

is a cloud-based electronic health record (“EHR”) that allows healthcare providers in the 

ambulatory/out-patient setting to store and utilize health information. 

4. In 2009, Respondent launched the Patient Fusion website, www.patientfusion.com 

(“Patient Fusion”), with an online portal that allows patients, who have been granted 

access by their healthcare providers, to view, download, and transmit to other providers 

their health information and send and receive secure messages directly to and from their 

providers. Respondent planned to launch a public-facing healthcare provider directory 

portion of the Patient Fusion website in 2013. The directory would allow current and 

prospective patients to search for providers by specialty or in a specific geographic area, 

read patient reviews of providers, and request appointments with providers through the 

website.
142-3039

Page 2 of 6

5. In order to populate the Patient Fusion website with provider reviews, starting in April 

2012, Respondent emailed healthcare providers’ patients post-visit satisfaction surveys

seeking reviews of the providers’ service. Practice Fusion described these surveys as a 

tool to “help improve your service in the future,” (as depicted below). The emails asked 

the patient to “please let us know how your visit went,” with a closing stating “Thank 

you, [Healthcare Provider’s Name]” at the end of the email. A disclosure at the bottom 

stated that the “email was sent to you by Patient Fusion®, a tool Doctor [Healthcare 

Provider’s Name] uses to deliver the highest quality of care to patients.” The email also 

indicated that it was “Sent on behalf of Doctor [Healthcare Provider’s Name]’s office” by 

Practice Fusion.

6. A link at the bottom of the email labeled “privacy statement” took the consumer to 

Practice Fusion’s Privacy Policy. The Privacy Policy included a section titled “Surveys, 

questionnaires, and polls.” Until April 8, 2013, Respondent did not indicate in this 
142-3039

Page 3 of 6

section or elsewhere in its privacy policy that it would publicly post reviews by patients 

of their providers.

7. Consumers who clicked on the stars in the email message were taken to the survey form, 

which among other things included a free text box at the bottom of the page prompting 

consumers to “Please leave a review for your provider:” (as depicted below). In light 

grey type just above the text box, the survey form indicated, “For your protection, do not 

include any personal information.” Below the free text box was a pre-checked box next 

to the phrase “Keep this review anonymous.” Leaving this box checked did not 

anonymize anything a consumer wrote in the free text box, including a consumer’s 

identifying information. Instead, the “Keep this review anonymous” selection only 

affected whether a review was posted on the Patient Fusion website under the handle 

“Anonymous” or under a patient’s first name. A button at the bottom of the survey 

enabled the consumer to “Submit my feedback.”
142-3039

Page 4 of 6

8. Consumers were required to check the box next to the phrase, “I agree to the terms of the 

Patient Authorization,” in order to submit their feedback, but were not required to view

the Patient Authorization. Consumers who clicked through to the Patient Authorization 

would have seen the following statements: “I authorize my provider and Practice Fusion, 

Inc. to publish my review on the Practice Fusion website . . . . The purpose of publishing 

my review is to make it available to patients and prospective patients of my provider, and 

other members of the public.” The Patient Authorization also stated that information 

submitted by the consumer would not be protected under the Health Insurance Portability 

and Accountability Act, or HIPAA.

9. Since survey information was collected for a full year before the Patient Fusion website 

went live, consumers who visited Respondent’s website would not have found any posted 

reviews, so they would not have any historical or contextual reference to alert them to the 

fact that their feedback would be publicly posted rather than provided to their physician, 

mental health specialist, or other healthcare provider for his or her sole use. 

10. In April 2013, Practice Fusion publicly launched the healthcare provider directory portion 

of the www.patientfusion.com website. At that time, Practice Fusion posted 

approximately 613,000 reviews it had collected from consumers during the previous year.

At the same time, Respondent revised its email communications to consumers soliciting 

survey responses to indicate that reviews they submitted “may be publicly visible on 

Patient Fusion to help patients find doctors in the area.” Respondent also revised the 

section on “Surveys and Ratings” in the Patient Fusion privacy policy to state for the first 

time that survey responses would be made public: “From time to time we ask users to 

submit surveys or ratings to assist healthcare providers and others in improving their 

operations or to assist other users in making informed choices. The content of such 

surveys or ratings, therefore, should be presumed public.” 

11. Based on the highly sensitive content of some consumers’ survey responses, combined 

with identifying information, they likely believed the communication was private. 

Consumers submitted hundreds of survey responses where they disclosed identifying 

information such as their full name or phone number combined with a sensitive health 

condition, medications taken, medical procedures performed, or treatments received. 

Examples of responses publicly posted include: 

• “Dr [healthcare provider name intentionally redacted by FTC staff], My Xanax 

prescription that I received on Monday was for 1 tablet a day but usually it's for 2 

tablets a day. I have not taken it to the pharmacy yet. Can I pick up a new one, or 

can I get a prescription called into a pharmacy? Thanks, [patient name

intentionally redacted by FTC staff]” Date: May 21, 2012 (Xanax (alprazolam) is 

a medication typically prescribed to treat anxiety disorders, panic disorders, and 

anxiety caused by depression.) 

• “I was pleased with Dr. [healthcare provider name intentionally redacted by FTC

staff]’s information on getting a facelift. I will call if I have further questions. 

Thank you, [patient name intentionally redacted by FTC staff]” Date: May 5, 

2012
142-3039

Page 5 of 6

• “I called today and left a message regarding my daughter and no one has returned 

my call. I think she is depressed and has stated several times this week that she 

wishes she was dead. Could someone please call me [phone number intentionally 

redacted by FTC staff]” Date: September 27, 2012

• “The cefuroxime axetil does not seem to be doing anything for me. I did a little 

research and I think I have a yeast infection called candida. Not sure what to do 

about it yet. I guess I will first try to change my diet. Medication? [patient name

intentionally redacted by FTC staff]” Date: June 9, 2012

• “My left foot was so much better after the wart was removed from under the 

callus! There may be one growing on the right foot.......we’ll see! My feet 

always feel so much better when leaving the office. [patient name intentionally 

redacted by FTC staff]” Date: July 12, 2012

• “I would like to make an appointment for my back pain and possible shingles. 

Can you please call me @[phone number intentionally redacted by FTC staff] 

Thank you! [patient name intentionally redacted by FTC staff]” Date: December 

31, 2012

• “I HAVE NO INFECTION [healthcare provider name intentionally redacted by 

FTC staff] EVERYTHING WENT FINE AFTER MY VISIT, SO IT’S A GO 

FOR MY CHEMO DAY.....THANKS HOPEFULLY I WILL SEE YOU 

TOMARROW AT METHODIST HOSPITAL.....THANKS... [patient name 

intentionally redacted by FTC staff]” Date: March 15, 2013

12. An October 21, 2013 article in Forbes Technology Blog highlighted the sensitive nature 

of some of the information posted on the Patient Fusion website (available at

http://www.forbes.com/sites/kashmirhill/2013/10/21/practice-fusion-patient-privacyexplicit-reviews/). 

13. In November 2013, Respondent for the first time implemented automated procedures to 

identify reviews where consumers had entered personal information in the open text 

fields in the survey. Respondent did not post reviews that contained such personal 

information; respondent also used this process to take down reviews containing personal 

information that had already been posted on the website. 

14. Communications between healthcare providers and Practice Fusion indicate that some 

healthcare providers were surprised that feedback they received was also posted publicly. 

Others were surprised that patients were being asked for feedback in the first place. 
142-3039

Page 6 of 6

PRACTICE FUSION’S DECEPTIVE FAILURE TO DISCLOSE

15. As described in Paragraphs 5-9, from April 5, 2012 through April 8, 2013, Respondent 

represented, directly or indirectly, expressly or by implication, that responses to a

healthcare provider satisfaction survey would be communicated to the consumer’s 

healthcare provider.

16. Respondent failed to disclose adequately that, if consumers provided responses to the 

satisfaction survey, Respondent would also publish the responses on its public healthcare 

provider review website, as described in Paragraphs 10-14. This fact would be material 

to consumers in deciding whether or how to respond to the survey, including, for 

example, what type of information to include in their responses. 

17. Respondent’s failure to disclose adequately the material information described in 

Paragraph 16, in light of the representation set forth in Paragraph 15, is a deceptive act or 

practice.

VIOLATIONS OF SECTION 5

18. The acts and practices of Respondent as alleged in this complaint constitute deceptive 

acts or practices in or affecting commerce in violation of Section 5(a) of the Federal 

Trade Commission Act.

Therefore, the Federal Trade Commission this __ day of ________, 2016, has issued this 

complaint against Respondent.

By the Commission.

Donald S. Clark

Secretary

SEAL: