Telehealth companies promise speed and convenience, but regulators say many are prioritizing profit over patient safety and privacy. The Federal Trade Commission has sued telehealth pioneer Hims & Hers for allegedly sharing customers’ medical data without permission, automatically enrolling users in hard-to-cancel subscriptions, and approving prescriptions without real physician consultations. The case reflects a broader pattern: the FTC has filed similar complaints against more than a half-dozen telehealth platforms in recent years, including BetterHelp and GoodRx, and the problem persists because existing federal privacy laws do not cover these services the way they protect traditional medical offices.
The gap exists because HIPAA, the main federal health privacy law, applies only to specific healthcare providers and insurers, not to direct-to-consumer telehealth platforms. That legal blindspot means companies can share sensitive health information with advertisers and social media platforms without clear legal consequences. Regulators have used broader FTC authority to take action, but only by proving companies made false privacy claims. Hims told customers its platform was “100% online, private and secure,” yet the company allegedly shared data with Meta and other platforms. Still, experts note that penalties are limited: companies typically sign an agreement to stop the practice, and there has been little enforcement against telehealth firms that break state privacy rules.
How Prescriptions Get Approved Without Doctor Visits
The speed of telehealth comes at a cost to medical care. A study of nearly 50 companies selling GLP-1 weight-loss drugs found that less than a third required any real-time video or audio consultation with a physician. In many cases, prescriptions were approved within minutes after users completed a questionnaire. “What we saw overwhelmingly was that it was incredibly easy to get access to the GLP-1s,” said Dr. Reshma Ramachandran of Yale University, who led the research. “Most of the time, the prescription was automatically sent, without even an opportunity to stop the dispensing.”
This approach bypasses medical guidance that professional societies recommend. Doctors typically discuss weight-loss goals, previous attempts, and eating disorders before prescribing GLP-1 drugs, since these medications can trigger or worsen eating disorders. Yet only slightly more than half the telehealth websites studied included a question about eating disorders on their intake forms. Users may receive medications without basic health screening or the chance to ask questions.
What Consumers Should Know Before Signing Up
Privacy experts recommend taking steps to limit data exposure when using telehealth sites. Using ad blockers and private browser windows makes it harder for companies to track location and browsing history. Reading the user agreement matters too: some telehealth platforms explicitly state they can sell data about users’ sex lives. “There’s an entire universe of companies collecting huge amounts of consumer health data every day that aren’t covered by our current health sector-specific laws,” said Andrew Crawford, an attorney with the nonprofit Center for Democracy and Technology.
The fundamental problem is structural. Federal law generally does not require telehealth companies to protect health information the way it protects hospitals and insurers. Lawmakers in California, Connecticut, Maryland and other states have passed new online privacy laws with special health protections, but enforcement remains sparse. Even vigilant consumers face limits: after doing all the work to understand how companies handle data, users often have little choice but to accept the terms or forgo the service.
Hims has disputed the FTC’s allegations, calling them “an effort to generate headlines at our expense.” The company and others argue they provide valuable access to medications that might otherwise take weeks to obtain. Yet the speed and convenience that draw users may obscure practices that regulators say harm both privacy and patient care. Without stronger oversight, telehealth users remain caught between the appeal of quick access and the risk of inadequate medical attention and data exposure.
