Prescription discounts: how the “free” cards work

In February 2023 the FTC brought its first-ever enforcement action under the Health Breach Notification Rule, against GoodRx. Precision matters, so here is the shape of it exactly: these were the FTC's allegations, resolved in a stipulated order filed through the Justice Department — not a court's findings after trial.

• The FTC alleged GoodRx shared users' personal health information — including medications and conditions — with Facebook, Google, Criteo, Branch, and Twilio for years, despite promising never to share health information with advertisers; that in August 2019 it uploaded lists of users who had bought particular medications to Facebook to target them with ads; that it let recipients use the data for their own purposes; that it displayed a seal falsely suggesting HIPAA compliance; and that until a watchdog exposed it in February 2020 it had no sufficient written privacy policies.
• The order: a $1.5 million civil penalty; a permanent ban on disclosing user health information to third parties for advertising; express consent required before other health-data disclosures; orders to direct third parties to delete the shared data; data-retention limits with a publicly posted schedule; and a comprehensive privacy program.
• Scale, from the FTC's release: since January 2017, more than 55 million consumers had used GoodRx's site or apps.

What this means today, stated carefully: GoodRx's current privacy-choices page says it works with advertising partners and that those activities "may be considered 'selling' or 'sharing'" of personal information under some state laws, with opt-out routes offered. Any claim that the company "never shares data" must be read against the order's permanent advertising ban — the restraint is a court order, not merely a promise.

GoodRx

Mechanics: the PBM model above — for-profit, contracts with PBMs, prices scan across networks and "can alter and shift between fills." Privacy: the 2023 FTC record above, plus its current privacy-choices page describing advertising-partner sharing with opt-outs. Not insurance — its own support pages say so.

SingleCare

Mechanics, in the company's own words: it "partners directly with pharmacies" rather than describing a PBM route, adjusts pricing monthly from demand, and "receive[s] a small fee from our pharmacy partners when you use your SingleCare card… which is how we can offer the service to you for free." Free membership, no credit card; "35,000+ participating pharmacies" per its help page. Privacy claim, also its own words: "we will never share your personal information with a third party… SingleCare does not rent, sell, or share any personally identifiable information." Honest label: that is the company's self-description from its own help and blog pages — not independently verified in this pass, and it sits in tension with the academic warning above that card companies generally are not HIPAA-governed. Both are printed; you weigh them.

RxSaver (by RetailMeNot)

Per consumer reporting (Clark.com, last updated October 2023 — dated, labeled): a free price-finder with printable or phone coupons, and — the notable part — "No enrollment or registration is required… you don't have to disclose your email, phone number, Facebook account or any other personal information." The test noted results favor preferred pharmacies until you expand the list. RxSaver's current operation and its own current privacy policy were not verified in this pass — no live RxSaver page was fetched.

The contrast model: Cost Plus Drugs

Not a card at all — an online pharmacy that sells the drug itself and itemizes its margin on the product page. One fetched example (30-count Flecainide Acetate 150mg): manufacturing $3.50 + 15% markup ($0.52) + pharmacy labor $5.00 = $9.02, plus $5.25 standard shipping and tax — against a listed "retail price at other pharmacies" of $90.90 on the same page. That comparison figure is the company's own, and one product page is one product page — but the structural contrast is the lesson: one model shows you its markup line by line; the card model hides its fee inside a transaction you never see itemized.

• A card is used instead of insurance — never with it. GoodRx, in its own support words: "GoodRx cannot be combined with your insurance or any federal or state-funded program such as Medicare or Medicaid." SingleCare and RxSaver say the same either/or. The pharmacist runs one or the other.
• Money spent through a coupon may not count toward your deductible or out-of-pocket maximum (SingleCare's own disclosure; the academic analysis agrees for pharmacy-specific cards). A cheaper fill today can be a slower deductible all year — that trade is yours to make with your eyes open.
• Prices vary by pharmacy and by fill. Re-check the price at your specific pharmacy for your specific fill, every time. Last month's price is a memory, not a quote.
• None of these is insurance. GoodRx and SingleCare both print it plainly. A card guarantees no coverage, no formulary, no protection — only a price at a moment.