The Federal Trade Commission, joined by the state of Utah and Los Angeles County Counsel on behalf of California, on July 29 sued telehealth provider Hims & Hers, alleging the company shared consumers’ sensitive health information without authorization.
The lawsuit accuses the publicly traded direct-to-consumer telehealth company of sharing conditions, medications and demographic data with third parties, marking one of the most high-profile health data privacy enforcement actions against a consumer-facing digital health platform.
Hims & Hers serves millions of customers seeking prescriptions and treatments for conditions including hair loss, erectile dysfunction, weight management and mental health. The company operates primarily through its website and mobile app.
The FTC has authority to pursue civil penalties and injunctions under the FTC Act and the Health Breach Notification Rule. The multi-state nature of the suit amplifies its enforcement significance.
The action puts every consumer-facing telehealth platform on notice about the legal consequences of sharing patient health data with advertising partners, analytics companies or other third parties without explicit consumer consent.
Digital health companies have faced increasing scrutiny from regulators over data-sharing practices. The FTC has previously pursued actions against other health apps and platforms for similar conduct, but the Hims & Hers case is notable for the company’s size and brand recognition.
The company is publicly traded and reported revenues exceeding $1 billion in recent filings. The lawsuit could result in significant financial penalties and mandatory changes to its data-handling practices.