Regulators Escalate Scrutiny of Telehealth Companies Over Data Privacy and Deceptive Practices

Federal regulators are increasingly targeting telehealth companies, accusing them of deceptive business practices that include exposing customer health data, enrolling users in hard-to-cancel subscriptions, and circumventing proper medical consultations. The Federal Trade Commission (FTC) has filed lawsuits against several prominent services, including telehealth pioneer Hims & Hers, alleging violations of U.S. consumer protection laws.

Hims has denied the FTC's allegations, characterizing the lawsuit as an attempt to generate publicity. This action follows similar cases brought by the FTC against more than half a dozen other telehealth companies in recent years, such as online therapy provider BetterHelp and pharmacy discount service GoodRx. In these prior instances, regulators asserted that these companies shared user health data with platforms like Meta and Google without obtaining explicit consent.

The current regulatory focus highlights a gap in federal law: the Health Insurance Portability and Accountability Act (HIPAA), which governs health information, generally does not extend to many telehealth companies offering services like prescriptions and online counseling. Experts note that this legal loophole allows numerous companies to collect substantial amounts of consumer health data without the same federal protections afforded to traditional healthcare providers.

Telehealth services typically begin with users completing questionnaires about their medical history and desired medications. However, the FTC alleges that Hims automatically enrolled customers in recurring prescriptions with minimal opportunity for users to review treatment recommendations. Similar industry practices have been observed, particularly with services offering injectable weight-loss drugs, where some companies have been found to require little to no real-time consultation with a physician before prescribing.

Research into companies selling GLP-1 drugs revealed that fewer than a third mandated video or audio consultations. In some cases, prescriptions were issued within minutes, potentially without adequate discussion of patient weight-loss goals, history, or risk factors like eating disorders, which these drugs can exacerbate. A Yale University study found that most platforms selling these drugs made it very easy to obtain prescriptions, with many automatically dispensing medication without a chance for the patient to intervene.

Privacy advocates and legal experts point to the absence of clear federal legislation prohibiting such data disclosures as a contributing factor. While the FTC has used its authority to pursue actions based on "fraudulent, deceptive or unethical business methods," such cases often result in companies agreeing to cease the cited practices without admitting wrongdoing. Penalties for violations are often limited.

Some states, including California and Connecticut, have enacted their own online privacy laws with specific protections for health information. However, enforcement against telehealth companies violating these rules has been limited.

Privacy experts recommend that consumers use ad blockers and private browsing modes when interacting with telehealth websites to make it more difficult for companies to track their online activity. Reviewing user agreements for explicit details on data usage policies is also advised, as some companies state their right to sell data related to users' sexual health. Ultimately, declining terms of service remains the most certain, albeit often unavoidable, method for consumers to protect their personal health information when using these platforms.