HealthEngine to pay $2.9m for selling user data, changing reviews

The Federal Court has ordered telehealth operator HealthEngine to pay a $2.9m fine for sharing its users’ personal information to private health insurance brokers for cash, and publishing misleading patient reviews and ratings.

The penalty, for misleading conduct, came after the company admitted giving third party private health insurance brokers names, dates of birth, phone numbers and email addresses of over 135,000 patients between April 2014 and June 2018.

It made $1.8m from those deals.

Competition regulator ACCC began investigating HealthEngine in July 2018 and alleged, among other things, that patients were misled into thinking their information would stay with HealthEngine.

The fine and requirement to contact all of those patients is a cautionary tale for an industry on the rise.

Since March, telehealth has been the main way Australians have been able to access basic medical services and some more complex ones, particularly those living under Victoria’s draconian lockdown, and it looks like it has finally secured its place in the country’s medical sector.

But that also means the introduction of a tech mindset into a sector that is covered by its own section of privacy law, and where breaches of ethics or privacy will be punished more severely both by regulators and by an Australian public that considers health data more sensitive than financial information.

“These penalties and other orders should serve as an important reminder to all businesses that if they are not upfront with how they will use consumers’ data, they risk breaching the Australian Consumer Law,” ACCC chair Rod Sims said.

“The ACCC is very concerned about the potential for consumer harm from the use or misuse of consumer data.”

Manipulated reviews

The case was brought by the ACCC in 2018 and included allegations of “manipulated reviews”.

As part of the case, HealthEngine admitted that between March 2015 and March 2018 it did not publish around 17,000 reviews and edited around 3,000 reviews to remove negative aspects, or to embellish them.

HealthEngine also admitted that it misrepresented to consumers the reasons why it did not publish a rating for some health or medical practices.

Last year Sims said the ACCC considered that conduct to be “particularly egregious” because patients would have visited doctors at their time of need based on manipulated reviews that did not accurately reflect the experience of other patients.

HealthEngine describes itself as Australia’s largest online health marketplace, which is used by over a million consumers every month and lists over 70,000 health practices and practitioners.