By: Jonah Haseley

As discussing mental health has become more normalized, advertisements for mental health apps like Better Help have become ubiquitous. BetterHelp spent over $100,000,000 on advertising its services in 2023 and has over 400,000 users as of the fourth quarter of 2024. With its growing societal footprint, BetterHelp has also faced growing legal scrutiny, particularly regarding privacy concerns.

Privacy Concerns and FTC Investigation

The Federal Trade Commission (FTC) found in a 2023 investigation that BetterHelp allegedly shared sensitive patient information with advertisers—despite telling its users that it would never do that. BetterHelp settled with the FTC, but the settlement only applies to users who signed up between 2017 and 2020. Though the settlement was worth 7.8 million dollars, each class member was only entitled to $10. The company did not admit to wrongdoing and maintains that it never shared sensitive patient data with advertisers.

In addition to the FTC investigation, BetterHelp has also been subject to multiple class action lawsuits. These lawsuits echo the FTC’s allegations of deceptive privacy practices, and the cases are pending in the U.S. District Court for the Northern District of California.  

Industry Problems

The problem with telehealth data privacy is not limited to BetterHelp. A recent study evaluated 50 telehealth startups and found that 49 of them shared sensitive patient data with big tech companies like Google and Facebook. This data includes data like names and emails addresses, but also prescriptions and answers to medical intake forms.

Governing Laws

With all of these issues in the industry, it is worth considering what laws constrain companies like BetterHelp. Unsurprisingly, the FTC considered BetterHelp’s representation that it was HIPPA (Health Insurance Portability and Accountability Act) compliant to be a deceptive trade practice. One of BetterHealth’s responses was that it recently received its HITRUST (Health Information Trust Alliance) certification. One could forgive a consumer for being confused by these acronyms. HITRUST is not a law – it is a cybersecurity framework adopted by private organizations. HIPPA is a federal statute about protecting patient privacy. While HIPPA is binding, it does not include a private cause of action, which would allow patients harmed by the unlawful release of their information to sue under HIPPA. But, alternatives to a private cause of action exist. One option is to file a complaint with the Department of Health and Human Services’ Office for Civil Rights (DHHS OCR). However, the White House has been rapidly dismantling civil rights offices throughout the federal government, so it is unclear whether federal investigation will remain a viable option. These closures are not limited to civil rights offices either. For example, the White House recently closed the entire Seattle Regional Office of the DHHS. Without a private cause of action and with administrative remedies threatened, consumers face increasing risks with their health data.

Potential Benefits of Telehealth While the implications of tech companies using confidential information obtained from therapy to target advertisements are terrifying, BetterHelp makes its case to the public that its service is a social good. The company argues that online therapy increases access for those in rural areas and makes treatment more financially accessible. Assuming the company is correct, the alternative to telehealth for some may be no treatment at all, which for those in need is not much of a choice. The status quo is caused by the failure of the federal government to meaningfully regulate the industry. While governmental regulation may not ultimately be feasible, a more realistic approach would be to provide consumers with a legal remedy for misuse of their data, to incentivize the industry to change its behavior.

#BetterHelp #telehealth #therapy