The appeal of telehealth is easy to explain: Instead of calling a doctor, booking an appointment and hoping to eventually get a prescription, you can log onto an app or website and get approved for a new medication within minutes.
asserted
you → explain → minutes
Since the COVID-19 pandemic, scores of online health services have launched with the promise of quick, convenient access to drugs for ADHD, sexual dysfunction, anxiety, weight loss and more.
asserted
scores → launch → ADHD
Increasingly, though, government regulators are accusing these companies of deceptive, unethical business practices, including disclosing their customers’ health data, signing them up for hard-to-cancel subscriptions and bypassing real-time consultations with doctors.
asserted
regulators → accuse → doctors
The Federal Trade Commission’s latest lawsuit alleges that telehealth pioneer Hims & Hers engaged in all of those tactics, running afoul of U.S. consumer protection laws.
asserted
Hims → allege → laws
Hims has disputed the government’s claims, calling them “an effort to generate headlines at our expense.”
uncertain
Hims → dispute → expense
In recent years, FTC officials have filed similar cases against more than a half-dozen telehealth companies, including online therapy provider BetterHelp and pharmacy discount service GoodRx.
asserted
officials → file → BetterHelp
In both cases, regulators said the companies shared users’ health data with online platforms such as Meta and Google, without getting permission.
asserted
companies → say → permission
Experts say part of the problem is that federal laws that govern the handling of health information generally don’t apply to telehealth companies.
asserted
that → say → companies
“There’s an entire universe of companies collecting huge amounts of consumer health data every day that aren’t covered by our current health sector-specific laws,” said Andrew Crawford, an attorney with the nonprofit Center for Democracy and Technology.
asserted
Crawford → ’ → Democracy
Here are some things to know before signing up for a telehealth service:
asserted
things → know → service
Don’t expect to actually talk to a physician
Nearly all telehealth visits begin with a questionnaire in which users provide details about their medical history and possible medications they’re interested in.
asserted
they → expect → history
According to the FTC’s lawsuit, Hims customers were automatically enrolled and billed for recurring prescriptions with “virtually no opportunity to review the provider’s recommended treatment.”
uncertain
customers → accord → treatment
Researchers have documented similar practices across the industry, even for injectable weight-loss drugs that typically require a physical exam and other precautions before beginning treatment.
asserted
that → document → treatment
A recent analysis of nearly 50 telehealth companies selling GLP-1 drugs found that less than a third actually required any real-time video or audio consultation with a physician.
asserted
third → sell → physician
In some cases, the prescriptions were approved within minutes.
asserted
prescriptions → approve → minutes
Your data may be shared with advertisers, social media companies and others
Americans often assume that any personal health information they share is protected by HIPAA, the federal privacy law that governs the handling of medical information.
uncertain
that → share → information
But the law generally only applies to specific types of health businesses, including medical offices, hospitals and insurers, not telehealth companies offering prescriptions, counseling, DNA tests and other online services.
asserted
law → apply → prescriptions
Privacy experts say that legal gap is one reason companies continue to disclose sensitive health information to advertisers and search engines.
asserted
companies → say → advertisers
“There isn’t a clear federal law saying: ‘Don’t do this,’” said Justin Brookman, Consumer Reports’ director of technology policy.
asserted
Brookman → be → policy
“There’s just a body of soft law and settled cases with the FTC that many companies probably aren’t even aware of.
asserted
companies → ’ → that
Because HIPAA does not cover every direct-to-consumer health platform, the FTC has generally used its broader authority to take action against “fraudulent, deceptive or unethical business methods.”
asserted
FTC → cover → methods
In practice, that means showing that telehealth companies disclosed their customers’ health information after initially saying they wouldn’t.
asserted
they → mean → information
Hims told customers that its platform offered a “100% online, private and secure” means of sharing information with the company’s medical professionals, according to the FTC complaint.
uncertain
platform → tell → complaint
But instead the company shared the data with Meta and other online platforms, the FTC alleges.
asserted
FTC → share → Meta
Still, experts say the penalties available to regulators are limited.
asserted
penalties → say → regulators
In most cases, companies sign a legal agreement stating that they’ll stop the practices cited by regulators.
asserted
they → sign → regulators
Lawmakers in California, Connecticut, Maryland and other states have passed new online privacy laws that include special protections for health information.
asserted
that → pass → information
But there’s been little enforcement against telehealth companies that break those rules.
asserted
that → break → rules
Online privacy tools offer a bit of protection
For now, privacy experts recommend using ad blockers and private web browsers — sometimes called “incognito” windows — when logging onto telehealth websites.
asserted
experts → offer → websites
Those tools can make it harder for companies to track your location, online history and other personal information.
asserted
companies → make → location
It’s also a good idea to read any user agreements to get a sense of how the company plans to use your personal data, said Crawford.
asserted
Crawford → ’ → data
Some telehealth sites, for example, explicitly state in their privacy policies that they have the right to sell data about users’ sex lives.
asserted
they → state → lives
The only surefire way to protect your information may simply be to decline the terms of service, usually one of the first steps required before accessing telehealth.
uncertain
way → protect → telehealth
“The system we have now overly burdens consumers to do a ton of work in terms of understanding how each piece of technology collecting their personal data is going to handle it,” he said.
asserted
he → have → it
“But even if you do all that work, you often have little agency.”
asserted
you → do → agency
The Aporia
