US sues telehealth companies over data sharing, cancelation policies

The United States sued multiple telehealth companies, including the beleaguered telemental healthcare provider Cerebral Inc., for improperly sharing patient information, among other allegations.

The US Department of Justice (DOJ) and the Federal Trade Commission (FTC) announced the filing of an amended complaint against Cerebral, the company’s founder and former CEO Kyle Robertson, and former executive Alex Martelli, as well as telehealth companies Zealthy Inc., Gronk Inc., and Bruno Health P.A., and an executive of those companies, German Echeverry.

The complaint alleges that Cerebral misused patients’ personal health information, did not keep that information private and secure, and used deceptive and burdensome cancelation practices.

More specifically, the government alleges that the company intentionally deployed online tracking technologies across its website at Robertson’s direction, which collected and shared users’ information with third parties for business purposes, such as targeted advertisements, without users’ informed consent. The company reportedly did not protect sensitive consumer data from unauthorized disclosure.

Further, the complaint alleges that Cerebral employees were told to falsely impersonate patients on online review sites, post positive reviews, and suppress negative ones.

Not only that, but the company also did not disclose data privacy, data security, and cancellation terms before obtaining patients’ billing information, did not obtain informed consent before billing patients, and failed to provide simple processes to cancel Cerebral subscriptions, according to the complaint.

Thus, the US government alleges that Cerebral and Robertson violated the Federal Trade Commission Act (FTC Act), the Opioid Addiction Recovery Fraud Prevention Act of 2018, and the Restore Online Shoppers’ Confidence Act (ROSCA).

The government has settled its claims against Cerebral but continues to pursue its claims against Robertson and Martelli, as well as Zealthy, Gronk, Bruno Health, and Echeverry.

"Cerebral was transparent and fully cooperative throughout the FTC’s investigation and remains committed to providing excellent care for our valued patients while upholding the highest standards of customer service, data protection and privacy," according to a statement from the company, emailed to mHealthIntelligence. "Kyle Robertson has not been with the company since 2022, and we have no comment on the charges against him."

According to the complaint, Robertson continued to violate the FTC Act and ROSCA after he left Cerebral to found Zealthy, later renamed Gronk. Robertson heads the company with Medical Director German Echeverry.

The government alleges that Robertson and Echeverry violated ROSCA through Zealthy and its affiliated medical corporation, Bruno Health, by failing to clearly disclose the material terms of online subscriptions before obtaining consumers’ billing information, charging consumers’ credit cards before expressly obtaining informed consent to those terms, and failing to provide a simple cancellation process.

“The Justice Department is committed to stopping companies and their executives from mishandling and misusing individuals’ sensitive personal health information, and from implementing predatory billing practices,” said Principal Deputy Assistant Attorney General Brian M. Boynton, head of the DOJ’s Civil Division, in the press release. “Consumers who turn to telehealth companies for treatment expect that their sensitive health information will be handled with great care and that companies will abide by the representations they have made rather than flouting their stated policies for the sake of profits and growth.”

Per the government's settlement with Cerebral a few months ago, the company is required to stop misusing and improperly disclosing patient information, misrepresenting its data privacy or security practices, and misrepresenting its cancellation practices. An FTC order also requires the company to pay approximately $5 million in consumer redress and a civil penalty judgment of $10 million, suspended to $2 million due to the company’s inability to pay the total amount. The order is pending approval by the US District Court for the Southern District of Florida.

In addition to lax data security and deceptive advertising practices, Cerebral has also come under scrutiny for its controlled substance prescriptions, with workers alleging that they felt pressured to prescribe medications for attention-deficit/hyperactivity disorder (ADHD). A former Cerebral executive also claimed in a lawsuit filed in April 2022 that Cerebral employed "unlawful business practices." First reported by Bloomberg Law, the suit alleged that the company "planned to increase customer retention" by prescribing stimulants to all of its ADHD patients. Cerebral then received a grand jury subpoena related to its potential violations of the Controlled Substances Act.

Following this, CVS Health and Walmart announced in 2022 that they would no longer fill prescriptions for controlled substances provided by Cerebral.