College of Law > Academics > Centers, Institutes & Initiatives > Mary and Michael Jaharis Health Law Institute > e-Pulse Blog > FTC settlement with HSPS reminds software providers the importance of truthful advertising with respect to data encryptio
The FTC’s Settlement with HSPS Reminds Software Providers the Importance of Truthful Advertising with Respect to Data Encryption
By Deba Alam /
April 26, 2016 /
/
Facebook
Main Content
On January 5, 2016, the Federal
Trade Commission (“FTC”) announced that
it had reached an agreement with leading software provider, Henry Schein
Practice Solutions, Inc. (“HSPS”), to settle the charges it had filed against HSPS.
The charges brought by the FTC alleged, among
other things, that HSPS misrepresented its dental office management program,
Dentrix G5, by falsely advertising the software’s level of encryption in
protecting patients’ data. In its
complaint, the FTC alleges that HSPS engaged in unfair and deceptive practices for
two years by falsely advertising that the Dentrix G5 software used industry-standard
encryption and that it met the regulatory data security obligations as required
by the Health
Insurance Portability and Accountability Act of 1996 (“HIPAA”).
Dentrix G5 is software sold
by HSPS to assist dentists and other professionals in performing daily office
tasks such as collecting and storing patients’ personal information. Specifically, Dentrix G5 enables
healthcare professionals to enter patient data, process payments, send
appointment reminders, enter diagnostic information, document treatment plan
and progress, and submit claims for insurance. Given the amount of sensitive data
that the software collects and retains, the Dentrix G5 is subjected to the same
security-related standards required by HIPAA as others in the market.
The FTC alleges that HSPS not
only failed to meet these recommended security standards, but also falsely
advertised the level of encryption of its Dentrix G5 software. According to the FTC, in 2012, HSPS continued
to incorporate a third
party database engine in its Dentrix G5 software despite being
notified by the third party in November 2010 that there were security risks
associated with the engine. The FTC
contends that the third party vendor not only notified HSPS that the engine
used an untested proprietary algorithm as a form of data protection, but also
pointed out that the algorithm was less secure and more vulnerable than the
“widely-used, industry-standard
encryption algorithms, such as Advanced Encryption Standard (“AES”)
encryption.” The FTC contends that despite
the warnings, HSPS distributed marketing
materials falsely stating the level of encryption used by the Dentrix G5
software and misled the consumers in believing that the software complied with the
requirements established in HIPAA.
Although HSPS does not admit
any of the allegations set forth in the FTC’s complaint by agreeing to the
proposed settlement, HSPS has nevertheless emerged as the losing party in this
case. Not only do the settlement terms
require HSPS to pay the FTC $250,000, but they
also require that HSPS notify consumers that it had previously misrepresented the
security features of its software. Through
this settlement, the FTC has succeeded in discouraging HSPS from engaging in
false advertisement with respect to data encryption, and has set an example for
other software providers. The FTC’s
action against HSPS reflects the agency’s interest in ensuring that software
providers continue to accurately advertise and provide adequate security
measures to protect sensitive information.
Deba
Alam is currently a second year law student at DePaul University College of
Law. Deba is a contributing member of
the E-Pulse; a Jaharis Health Law Fellow; and staff writer for DePaul’s Journal
of Art, Technology, and Intellectual Property.