Please support Telehealth.org’s ability to deliver helpful news, opinions, and analyses by turning off your ad blocker. Following the release of a report by STAT and The Markup, which found 49 of 50 telehealth startups may fall short of legal requirements for HIPAA compliance, a bipartisan group of US senators has fiercely criticized several prominent telehealth startups for sharing patient data with Facebook, Google, and other major advertising platforms.
US Senators Amy Klobuchar (D-MN), Susan Collins (R-ME), Maria Cantwell (D-WA), and Cynthia Lummis (R-WY) called on three telehealth companies to protect their patient’s sensitive health data. Letters were sent this month to telehealth companies Monument, Workit Health, and Cerebral requesting information on their data-sharing policies.
The Senators reportedly expressed concern over reports that, despite promises to prospective patients that their information about mental health and addiction treatment will remain confidential, the companies are tracking and sharing their customers’ personally identifiable health data for advertising purposes.
Who Is Protecting Patient Health Information?
Advertising companies such as Facebook and Google are immune to privacy rules due to the non-healthcare focus of their services. To date, HIPAA and various state healthcare privacy regulations could not be invoked for advertisers. However, the Senators above and Senator Sheldon Whitehouse (D-RI) introduced more stringent legislation to ban commercial advertising using Americans’ personal health data in 2021. Called Stop Commercial Use of Health Data Act, the legislation is intended to enhance consumers’ privacy by restricting companies from profiting from personally identifiable health data for advertising purposes. It also aims to give consumers greater access to and ownership of their personal health information. This and other Internet-related privacy laws are likely to be given new vigor now that flagrant disregard for consumer privacy rights has recently been identified in significant numbers of telehealth startups.
It may be interesting to note that beyond HIPAA, the federal law known as 42 CFR holds some addiction treatment providers to even stricter patient privacy standards when prescribing controlled substances to substance use disorder patients. Two companies targeted, Workit Health and Cerebral, offer online prescriptions for controlled substances.
Content of the Senators’ Letters
In letters to executives at the three telehealth startups, the lawmakers demanded a list of all third-party platforms they’ve shared user information with over the past three years, along with details of which user information has been shared.
The companies were given a deadline of February 10, 2023, to respond to the Senators’ letters, which asked whether they have ever shared information with a third-party service that could identify their users as individuals seeking treatment for addiction, substance use disorder, or a mental health condition. The letters were sent to Cerebral Chief Executive Officer Dr. David Mou, Monument Chief Executive Officer Mike Russell, and Workit Health Chief Executive Officer Robin Ann McIntosh. The entire content of the letters written can be seen here: Cerebral, Monument, and Workit Health.
An Environment of Telehealth Startup Crackdowns?
The telehealth startup letters come just days after the Federal Trade Commission reached a $1.5 million settlement with another telehealth startup, GoodRx, for sharing users’ health data with Facebook, Google, and others for advertising. The settlement follows a lawsuit filed on January 5, 2023, against other telehealth companies examined in the STAT and The Markup investigation, including Hey Favor, FullStory, Meta, and ByteDance, the company behind TikTok.
This article is published as a collaborative effort between Telehealth.org and the California-based Telehealth Institute, a nonprofit newsroom investigating how technology is being used to change healthcare. Sign up for newsletters here.
Telehealth Courtroom Realities: How to Stay Out of Legal Hot Water
Developed by a senior litigating telehealth attorney for the defense, this eye-opening telehealth training experience will help the clinician avoid the harsh realities of a courtroom.
This is frightening. Pass the legislation!
This is frightening. Pass the legislation!