Full Breakdown
Telehealth Companies Accused of Sharing Patient Data Without Consent
By Drooid · · How we work
FTC Lawsuit Targets Hims & Hers
The Federal Trade Commission has filed a lawsuit alleging that Hims & Hers, a leading telehealth provider, disclosed customers’ health information to advertising platforms such as Meta and Google, automatically enrolled users in recurring prescription subscriptions, and approved medications without a real-time physician consultation.
Industry Practices and Legal Gaps
Since the COVID-19 pandemic, dozens of online health services have expanded, offering quick prescriptions for conditions ranging from ADHD to weight-loss drugs. Many begin with a questionnaire rather than a live exam; a recent analysis found that fewer than one-third of nearly 50 companies selling GLP-1 drugs required any video or audio interaction with a clinician. Because the Health Insurance Portability and Accountability Act (HIPAA) applies only to traditional medical providers, telehealth platforms fall outside its protections, leaving the FTC’s broader consumer-protection authority as the primary enforcement tool.
Expert Criticism
- “There’s an entire universe of companies collecting huge amounts of consumer health data every day that aren’t covered by our current health sector-specific laws,” — Andrew Crawford, an attorney with the nonprofit Center for Democracy and Technology
- “What we saw overwhelmingly was that it was incredibly easy to get access to the GLP-1s,” — Dr. Reshma Ramachandran, of Yale University
- “There isn’t a clear federal law saying: ‘Don’t do this,’” — Justin Brookman, Consumer Reports’ director of technology policy
These experts highlight the expansive collection of health data by firms not covered by sector-specific statutes, the ease of obtaining powerful weight-loss medications without adequate screening, and the absence of a clear federal prohibition against such data-sharing practices.
Official Statements & Responses
In response, the company maintains that the lawsuit is a publicity stunt and asserts its compliance with existing regulations. Regulators note that penalties often result in cease-and-desist agreements rather than substantial fines, limiting the deterrent effect.
Consumer Protection Recommendations
Privacy experts advise users to employ ad blockers and private-browsing modes when accessing telehealth sites, scrutinize user agreements for data-sale clauses, and consider declining terms that permit the sale of sensitive information. As one analyst put it, the current system places a heavy burden on consumers to understand how each technology handles their personal health data, yet offers them little practical control.