Telehealth start-ups are monetizing misinformation – and your data

Even as the world bounces back from the Covid-19 pandemic, research has shown that more and more people are taking their healthcare into their own hands. The internet is a big part of how they do it. Telehealth companies that provide direct-to-consumer medications and related services saw their profits climb swiftly during the pandemic, but even as in-person medical visits have once again become the norm, these companies have continued to thrive.

In the U.S., one special breed of telehealth companies tends to focus on “wellness” issues common among people in their 20s and 30s: Companies like Cerebral, Hims & Hers, Keeps and Mindbloom offer a quick path to prescription medications for anxiety, depression, sexual health and skin-related issues. They also tend to feature a sleek, Instagram-friendly aesthetic.

Hims, launched in 2017, uses the tagline: “Telehealth for a healthy, handsome you.” For years, I’d noticed ads for Hers, its sister brand, dotting my social media feeds and featuring on the walls of subway cars. I finally visited the Hers website and found a banner stretched across the homepage: “Anxiety treatment, no insurance required. START YOUR FREE ASSESSMENT,” it read. Curious to learn more, I clicked on the link.

After a short intake assessment, the platform told me to wait for a provider evaluation that would also take place entirely online. If prescribed, the medication would be delivered to my door, as soon as possible. In the meantime, I could browse the site to see what kinds of drugs they prescribe. Brand names like Lexapro, Wellbutrin and Zoloft float across the sections for medication featuring the website’s calming, sage-green color palette. The site also sells health and sex-adjacent products like melatonin gummies (to help you “get the sleep of your dreams”) and USB-rechargeable vibrators (because “life’s too short for boring sex”). The familiar shopping cart icon in the upper right corner of the site reinforced the idea that I was here to buy something, not to seek a professional medical consultation.

It felt almost too easy. I didn’t see it through — I see a regular doctor at a regular brick-and-mortar clinic. But it left me wondering how other people might understand — or misunderstand — what the service really offers. Hims & Hers and companies like it often adopt the language of telehealth that we see coming from established healthcare providers, a practice that might give consumers the impression that the company has their best interests at heart. But these companies aren’t regulated in the same way that traditional healthcare providers are. And they are out to make money. In the first half of 2021 alone, venture capitalists invested nearly $15 billion into digital health companies.

In the eyes of Dr. Adrianne Fugh-Berman, a pharmacology researcher at Georgetown University, “there’s real telehealth and there’s fake telehealth.” Real telehealth, she explained, was an asset during the worst periods of the pandemic. And for years, it has helped people with limited mobility, or those who live in far-flung places, get access to specialist clinicians who tend to work in big city hospitals.

But then there are fake telehealth outfits, which Fugh-Berman described as “companies who are really just bypassing clinicians to provide drugs to patients.” 

“There’s a prescriber involved,” she said, and that clinician does provide some level of safety. But she cautioned that they ultimately answer to the telehealth company, not to a traditional medical institution. “Their job is to prescribe you drugs,” said Fugh-Berman. If they deny a lot of people drugs, “they are not going to keep that job.” 

In traditional healthcare, patients typically see a primary care provider who can recommend treatment, medication or otherwise, with their full health status and history in mind. Although traditional healthcare institutions have been caught bending to the interests of big pharma — a major factor in the U.S. opioid crisis — there are regulatory measures in place to prevent this. New-fangled telehealth companies do not have the same guardrails.

Fugh-Berman runs Georgetown’s PharmedOut program, a project to help educate healthcare professionals on pharmaceutical marketing practices. According to PharmedOut’s resources, companies that use direct-to-consumer advertising are not subject to FDA regulations if they provide “disease awareness,” even though these sorts of campaigns can “lead to the overuse of marginally effective or potentially dangerous drugs for minor conditions.” PharmedOut warns that this practice can harm public health, especially as more companies rely on social media ads to get in front of potential customers.

Although it’s rare, plenty of the antidepressants that these companies prescribe can cause serotonin syndrome, a serious and potentially fatal response. The anxiety drug propranolol, described by Hims & Hers as a medication that can help you ace “a public speaking engagement, interview, or audition,” can trigger asthma attacks for people with the disease. Last year, Bloomberg investigated the telehealth company Cerebral, which focuses on mental health treatment, and found that patients were prescribed medications that led to complications and even death from overdoses. In short, the actual health risks that these companies might present for consumers are real.

Then there’s the matter of the telehealth companies’ business model. Alongside payments for the services they provide, companies like Hims & Hers also collect a good deal of customer data. We all know what it’s like to be asked to consent to the terms of service of data privacy agreements. They’re incredibly long, written in legalese and impossible to negotiate with. If you want the service, you select “I agree” and hope for the best.

The mere fact that these companies deal with people’s health data might make customers think that it will be covered by HIPAA, the U.S. federal law that requires healthcare and insurance providers to protect sensitive health information from being disclosed without patient consent. But just because you’re sharing your health data does not mean it’s protected. In fact, Hims & Hers’ privacy policy mentions that it is not a “covered entity” under HIPAA. This suggests that the company is collecting demographic data and medical information, as well as images and messages, all on behalf of the diagnosing providers and with no guarantee of privacy protection under U.S. law. We asked Hims & Hers for more information about their business and how they handle customer data but did not receive a response prior to publication.

What happens to your data after it is collected? Researchers have shown that it can be bought and sold by third-party data brokers. Last year, The Markup reported that private information about the medications prescribed through telehealth services (Hims & Hers was among those they tested) had been shared with Big Tech companies like Meta, Google and Snapchat. This data is often used to improve ad-targeting and prompt customers to purchase even more products or services based on their browsing habits. But it could be used or abused in other ways, too.

The lack of HIPAA oversight over some telehealth companies is a concern for Keith Porcaro, who researches law and technology at Duke University. He explained that these kinds of companies can get around privacy protections that traditional healthcare companies would otherwise be subject to and said that regulations need to catch up with the market.

“Companies like this are changing people’s expectations about healthcare,” he said. “There’s an assumption, especially if you talk to doctors, that there’s sort of one model of getting care: You go to your doctor and rely on doctors for everything. Putting doctor shortages aside, there’s a lot of evidence that says that most people take care of most of their health problems on their own,” Porcaro told me.

Bypassing traditional healthcare routes in favor of for-profit, start-up companies may be making consumers more vulnerable to medical misinformation. Influenced by a growing self-care movement that has popularized the idea that “you know your situation best,” consumers increasingly turn to these companies. 

Porcaro puts some of this on people’s legitimate “mistrust of the medical establishment,” based on their negative experiences with traditional healthcare. In a 2022 Pew research study on race and disparities in healthcare, more than 70% of Black female respondents between the ages of 18 and 49 said that they had had a negative experience with healthcare providers, ranging from pain they reported not being taken seriously to being treated with less respect than other patients. The same report found that most Black Americans were skeptical of “medical researchers when it comes to issues of openness and accountability” and suspected that misconduct in medical research remains just as likely to happen today as in the past. Long-standing stigma may drive prospective patients to seek alternative routes to healthcare. But people looking for quick solutions might be willing to accept help from just about anyone. 

“People who are going to services like this, especially mental health or addiction treatment, are vulnerable,” Porcaro said. And they’re not just vulnerable to misinformation, he said, “they’re vulnerable to actual harm.”

The convenience and branding of telehealth start-ups may have plenty of appeal for Gen Zers and people with legitimate reservations about the medical establishment. But they come with some serious trade-offs that could affect your health data — and your health itself.

CORRECTION [05/15/2023 11:08 AM EDT]: The original version of this story said Duke University lawyer and technologist Keith Porcaro. Keith Porcaro researches law and technology at Duke University.