Absolutely right call. How can any company officer actually believe this was an acceptable business practice. Being in that business they must have heard of HIPAA and regulation around PHI. What would keep hospitals from selling patient info?
Notably:
> [a bunch of providers] ...but only if they transmit any information in an electronic form in connection with a transaction for which HHS has adopted a standard.
If you don't process a specific type of transaction, no HIPAA requirements.
Because the penalty is small enough that it's a "cost of doing business". Until these fines are large enough to cause hardship to the company, or we start piercing the corporate veil and go after executives in their personal capacity this is going to keep happening.
I simply do not believe there is a good-faith argument that GoodRX wasn't familiar with the law in this case.