1

132 3088

UNITED STATES OF AMERICA

FEDERAL TRADE COMMISSION

COMMISSIONERS: Edith Ramirez, Chairwoman

Julie Brill

Maureen K. Ohlhausen

Joshua D. Wright

Terrell McSweeny

In the Matter of

Michael C. Hughes, 

individually.

)

)

)

)

)

)

)

DOCKET NO. 

COMPLAINT

The Federal Trade Commission, having reason to believe that Michael C. Hughes 

(“Respondent”), individually, through his direction, control, and ownership of PaymentsMD, 

LLC (“PaymentsMD”) has violated the provisions of the Federal Trade Commission Act, and it 

appearing to the Commission that this proceeding is in the public interest, alleges:

1. Respondent Michael C. Hughes was the Chief Executive Officer, sole employee, and part 

owner of PaymentsMD, a Georgia limited liability company, until July 2014. 

Individually or in concert with others, he controlled or had the authority to control, or 

participated in the acts and practices alleged in this complaint. He resides in Atlanta, 

Georgia.

2. The acts and practices of respondent as alleged in this complaint have been in or affecting 

commerce, as “commerce” is defined in Section 4 of the Federal Trade Commission Act.

PAYMENTSMD’S BUSINESS PRACTICES

3. From August 2008 to July 2014, respondent, through his direction and control of 

PaymentsMD, has provided billing services to medical providers. Medical providers that 

have contracted with PaymentsMD direct their patients to the PaymentsMD website, 

where consumers are able to enter their invoice number and credit card information to 

pay their medical bills.
2

4. In December 2011, respondent, through his direction and control of PaymentsMD,

launched a free “Patient Portal” product that provided consumers with a place to view 

their billing history. Unlike the bill-payment service, which enables consumers only to 

make a one-time payment, the billing history service of the Patient Portal enables 

consumers to access and view records of the consumers’ past and upcoming payment 

obligations for any medical providers that use PaymentsMD’s billing services. The 

Patient Portal service enabled consumers to pay their bills and to view their balance, 

payments made, adjustments taken, and information for other service dates. 

5. In June 2012, PaymentsMD entered into an agreement with Metis Health LLC (“Metis 

Health”) to develop an entirely new service called Patient Health Report, a fee-based 

service that would enable consumers to access, review, and manage their consolidated 

health records through a Patient Portal account. PaymentsMD and Metis Health agreed 

to split the profits. Both companies participated in developing the disclosures and 

authorizations for the service, and how and when this information would be presented to 

consumers during the Patient Portal registration process.

6. As described further below, in order to populate the Patient Health Report, respondent, 

through his direction and control of PaymentsMD, tried to obtain the sensitive health 

information of consumers registering for the Patient Portal from health insurance plans, 

pharmacies, and a medical testing lab, without appropriate authorization from those 

consumers. Indeed, many consumers registering for the Patient Portal had no idea that 

PaymentsMD, under respondent’s direction and control, would seek to collect their 

sensitive health information from third parties for use in the Patient Health Report 

service. 

THE PATIENT PORTAL INTERFACE FAILED TO DISCLOSE THAT 

PAYMENTSMD WOULD COLLECT CONSUMERS’ SENSITIVE HEALTH 

INFORMATION FOR THE PATIENT HEALTH REPORT

7. PaymentsMD’s home page described the Patient Portal as a medical billing related 

service. It stated that “At PaymentsMD, we can help you navigate through the maze of 

medical billing, reimbursement and payment processes. We also make it easy for you to 

maintain current information about your insurance coverage and to make payments over 

the Internet, at your convenience.” In order to register for the Patient Portal, a consumer 

could click on a button labeled “Patient Portal Login.” (Exhibit A).
3

8. Consumers could then either enter their login credentials or click on a link that stated 

“Don’t have an account? Create one now.” (See Exhibit B). 
4

Consumers that followed the link would then be taken to the Payment Portal registration 

page, which appeared as follows. (Exhibit C). 
5

The registration page stated that registering for the Payment Portal service would “allow 

you to: View your original balance; View any payments made; View any adjustments 

taken; View your current balance; View information for other service dates.” At no point 

in this process was it stated that PaymentsMD, under respondent’s direction and control, 

would be seeking consumers’ sensitive health information from third parties for use in a 

Patient Health Report service. 

9. Consumers who clicked the “Submit” button were taken to a “Patient Portal Account 

Authorization” page, which required four authorizations. The page presented the 

authorizations in four boxes that showed only six lines of text at a time. (Exhibit D).
6

Under each text box was a check box that consumers could select in order to proceed 

with the registration process. Alternatively, consumers could select a single box at the 

top of the page, which would populate all four boxes to indicate that each of the four was 
7

authorized. Although consumers who scrolled through the second and fourth boxes 

would have seen a statement that “[H]ealth records related to your treatment . . . may be 

used or disclosed pursuant to this Authorization,” the site design simultaneously made it 

hard to read the authorizations in their entirety, and easy to skip over them by clicking a 

single check box that preceded all of the authorizations. 

10. Consumers would reasonably believe that all four authorizations were to be used to 

provide the Patient Portal billing services for which they were registering. In fact, two of 

the four purported authorizations were used to collect sensitive health information from 

third parties for use with the Patient Health Report service.

11. Although PaymentsMD’s home page and login page included links that allowed 

consumers to “click here to learn more” about the Patient Health Report service (see

Exhibit A), these links conveyed that the Patient Health Report was a separate service 

from the Patient Portal. At no point in registering for the Patient Portal would it have 

been clear to consumers that they were purportedly giving PaymentsMD permission to 

obtain their sensitive health information from third parties for use in the Patient Health 

Report service.

RESPONDENT, THROUGH HIS OWNERSHIP AND CONTROL OF 

PAYMENTSMD, SOUGHT CONSUMERS’ SENSITIVE HEALTH 

INFORMATION WITHOUT THEIR KNOWLEDGE OR CONSENT

12. Respondent, through his direction and control of PaymentsMD, requested sensitive 

health information from a large number of health plans, pharmacies, and a medical lab 

about everyone who registered for the Patient Portal. These requests used consumers’

name, birth date, address, and sex. The information requested was as follows:

a. Pharmacies: Medication dispensed, dispense date, instructions, prescription 

number, prescribing physician, quantity dispensed, refill ability, co-pay amount, 

amount payable as co-insurance or deductible, and amount paid by health plan.

b. Health plans: Medical information (procedures, diagnoses, dates of service, 

medical providers, co-pay amount, amount payable for co-insurance or 

deductible, and the amount paid by health plan); prescription information 

(medications dispensed, dispense dates, prescription number, prescribing 

physician, quantity dispensed, refill ability, co-pay amount, amount payable as 

coinsurance or deductible, and the amount paid by health plan); and lab 

information (test performed, date, laboratory, physician, co-pay, amount payable 

as co-insurance or deductible, and amount paid by health plan).

c. Laboratory: Lab test performed, date, laboratory, test results, normal range for 

test values, ordering physician, co-pay, amount payable as co-insurance or 

deductible, and the amount paid by health plan.

13. Metis Health sent requests to health plans that were identified using PaymentsMD’s 

billing records. For the pharmacies, Metis Health sent requests to all major commercial 
8

pharmacies with locations near the consumers’ home address, notwithstanding that 

neither PaymentsMD nor Metis Health had any reason to believe that the consumer had 

used any of those pharmacies. 

14. Metis Health sent approximately 5,500 requests for consumers’ health information to 31 

different companies. One company fulfilled the requests. The others, concerned about 

the validity of the requests – which in some cases related to minors or consumers who 

were not in fact a customer of the company receiving the request – refused to fulfill the 

requests.

PAYMENTMD’S SUBSEQUENT COMMUNICATIONS TO CONSUMERS 

GENERATED NUMEROUS COMPLAINTS

15. Initially, PaymentsMD did not inform consumers that Metis Health was attempting to 

collect their sensitive health information. When PaymentsMD, under respondent’s 

direction and control, began informing consumers, via an email sent a day after users 

registered for Patient Portal, numerous consumers filed complaints with PaymentsMD 

regarding the collection of their sensitive health information. The common themes of the 

complaints were that consumers did not want their information collected, and that they

had only registered for the Patient Portal to track their bills. PaymentsMD ultimately did 

not sell any Patient Health Reports.

DECEPTIVE OMISSION

(Count 1)

16. As described in Paragraphs 3-15, respondent, through his direction and control of 

PaymentsMD, represented, directly or indirectly, expressly or by implication, that 

consumers registering for the free Patient Portal billing service could access and review 

their medical payment history.

17. Respondent, through his direction and control of PaymentsMD, failed to disclose

adequately that, if consumers registered for the free Patient Portal billing service, 

PaymentsMD would also engage in a comprehensive collection from third parties of 

consumers’ sensitive health information for the Patient Health Report service.

18. This fact would be material to consumers in deciding whether to register for the Patient 

Portal. Respondent’s failure to disclose adequately this fact, in light of the 

representations made, is a deceptive act or practice.

DECEPTIVE REPRESENTATION

(Count 2)

19. As described in Paragraphs 3-15, respondent, through his direction and control of 

PaymentsMD, represented, directly or indirectly, expressly or by implication, that the 
9

authorizations were to be used exclusively to provide the free Patient Portal billing 

history service for which consumers were registering. 

20. In fact, the authorizations were not used exclusively to provide the free Patient Portal 

billing history service for which consumers were registering. Instead, all of the 

authorizations were also used by PaymentsMD, under respondent’s direction and control, 

to attempt to collect sensitive health information for use with the Patient Health report 

service, and two were only used for this purpose. Therefore, this representation is false 

or misleading. 

VIOLATIONS OF SECTION 5

21. The acts and practices of respondent as alleged in this complaint constitute deceptive acts 

or practices in or affecting commerce in violation of Section 5(a) of the Federal Trade 

Commission Act, 15 U.S.C. § 45(a).

THEREFORE, the Federal Trade Commission this ___ day of __________, 2014, has issued 

this complaint against respondent.

By the Commission.

Donald S. Clark

Secretary