The complaint pretty clearly states the FTC does not view them as a covered entity. There are several statements, but the most clear is near the end of page 23:

The complaint pretty clearly states the FTC does not view them as a covered entity. There are several statements, but the most clear is near the end of page 23: > In truth and in fact, GoodRx is not a HIPAA-covered entity, and its privacy and information practices did not comply with HIPAA’s requirements. Further, on page 25, they define them as a "vendor of personal health records" - which explicitly excludes covered entities (definition on page 19). ----- This is consistent with my understanding of a covered entity. Without the "transactions for which HHS has adopted a standard", GoodRx is not a covered entity. Further, even if they were a covered entity, it's possible for them to segment their HIPAA and non-HIPAA compliant business units. This is called a "hybrid entity". ---- Interestingly, the FTC is pinging them on for a misleading representation of being a covered entity. Since GoodRX was not a covered entity, they were not technically violating HIPAA.