Glow Inc. Settlement and Other Data Security News
On September 17, 2020, technology company Glow, Inc. (“Glow”) settled with the California attorney general in response to a data breach on Glow’s fertility-tracking app. This app was created so that women could compile their personal medical information as it relates to cycle and ovulation tracking. Between the years of 2013 and 2016, this app was subject to numerous allegations regarding its security.
According to the California attorney general, the app failed to require authorization from any user who would share their information with another user. This led to data sharing without proper consent. It also did not require a user to enter its old password before creating a new one, so any user could be locked out of their own account by someone attempting to steal data. The California attorney general alleged that these, among other privacy issues, violated California’s consumer protection and privacy laws. The settlement will require Glow to pay $250,000 and increase the privacy and security on the app. The settlement also requires Glow to obtain affirmative consent from all users before sharing any personal medical information.
Although this state case focused on issues from 2013-2016, this settlement is very timely and accurately reflects issues currently facing healthcare providers. During the 2019 Novel Coronavirus (“COVID-19”) pandemic, the Office of Civil Rights (“OCR”) has decided to temporarily stop giving penalties for noncompliance with HIPAA. The purpose of this is so that providers can continue to care for their patients while maintaining social distance protocol and implement telehealth in place of in-person office visits.