Cerebral Fined $7 Million for Careless Privacy Violations

The FTC is proposing a $7 million fine against telehealth firm Cerebral for careless handling and sharing of patients' data, as well as deceptive advertising practices. The company allegedly shared sensitive data with third parties, mailed patients postcards with diagnosis and treatment details, and had lax security practices that exposed confidential medical records. Cerebral will be required to pay partial refunds, establish a comprehensive data privacy program, and report annually on it, with a 20-year audit requirement.