Hacker News new | past | comments | ask | show | jobs | submit login
BetterHelp Barred by FTC from Sharing Data with Facebook (bloomberg.com)
109 points by roseway4 on March 2, 2023 | hide | past | favorite | 71 comments



I used BetterHelp mid-pandemic. It's one of the few times I've issued a credit card chargeback.

Their business model is one big scam. You don't pay per-session, you pay per-month. Thus, they oversubscribe their "therapists" (who are almost all independent contractors doing BH as their side gig), and so the incentive is encourage you to book as infrequently as possible.

Once you take that into account, it ends up being as expensive or more than a traditional therapist.


A "scam"? That's a pretty strong word. I'd go with an "ineffective ripoff".

I tried two competitors. Both were horrible. Thirty minute sessions, where the "therapist" did all the talking, and then occasionally gave a PDF worksheet. Apparently this is "cognitive behavioral therapy".

I tried TalkSpace twice. My favorite experience was when I texted the "therapist" and got back -- and let me quote in full -- "That's a lot. Can you fill out this worksheet, and do this self-assessment?" (This would be the same assessment I had done four times prior. And the worksheet looked like it came from the chummiest chumsite on the web. There was even a URL on the bottom, where she had just clicked "Print | Save to PDF".

I tried Cerebral, and its "therapists" were equally worthless. However, the "prescriber" gave me an SSRI (shockingly fast), which actually helped.

Cerebral felt like a pill mill, and apparently the DOJ also thinks so. https://www.theverge.com/2022/5/9/23063356/cerebral-teleheal...


Counter-point, they make it easy to try different therapists until you find one you feel comfortable with and you feel is helpful to you (not an easy task) with no additional costs, all from the comfort of your home. I think I was paying ~$60/45 minute session with a great provider, who was always able to get me in schedule-wise, provided great benefit, and saved me from an hour+ drive each way.

I know several people, myself included, who have found their service very valuable.


In the same time period this company appeared, therapists also started hosting online sessions en masse. Being an employed person in the US, I have health insurance, so sessions with a therapist of choice were $25 out of pocket.


> Being an employed person in the US, I have health insurance, so sessions with a therapist of choice were $25 out of pocket.

The overwhelming majority of therapists in my town are not on contract with my HMO. I tried two different therapists who did, and it was so bad you couldn't have paid me to go back.


I'm surprised about the insurance. Most therapists and mental health clinicians don't take insurance (for some reason). Kaiser has mental health professionals on staff, but good luck finding one. Kaiser has been repeatedly in trouble with California for understaffing, and now is funneling people into shitiest apps on ProductHunt as an alternative.

https://www.fastcompany.com/90631941/we-have-never-seen-such...


Just wanted to write I also used the service and found it to be worth the money. Not perfect, but, it did a good job getting me through a rough patch at a price I felt was reasonable


Was pretty underwhelmed at it as well and had a very similar experience to yours.

The therapists were also no very good, talking themselves all the time.

And now this. I wouldn’t touch it with a ten feet pole and request my data to be deleted (if we can still trust them to do so)


I haven't used it but always figured it might be a good way to dip your toes in the water.

One of the hardest parts of starting therapy is finding a therapist who's a good match for you. And it's a lot of work to find therapists, schedule, have an awkward conversation after a first session about whether you'll have a second...

So even if it winds up being the same price or even more, it could still be a net benefit in terms of being an efficient and anxiety-free way of finding a therapist who's a good match. Or even just the right therapy modality.

I've often wondered, though, once you find a therapist you like, what prevents you from just seeing them directly, without BetterHelp taking their cut?


It's not as good of a deal though, because

- 1) you're dealing with therapists who are treating this like a side gig,

- 2) they're all overbooked,

- 3) dealing with a company that prioritizes money extraction over helping people, and

- 4) a poor experience with BH (likely) turns people off from therapy, which can be an actually wonderful experience.

I really can't blame the therapists much. Hate the game, not the player. BetterHelp the company needs to shape up.


It seems like a lot of these therapy services are dealing with the fact that a time-based therapy session is simply not fungible or optimizable in any capacity. DoorDash can stack meals, but you can't stack therapy sessions. On top of that, there's a lot of poor therapists (or at least poor therapy-patient pairings) across the industry.


> almost all independent contractors

Are they though? It seems like corporations found a loophole where they don't have to take on employees, pay proper taxes and abide by employment laws.

Just to pre-empt some comments - employees can have multiple employers at the same time and be "independent" the same way as "independent" "contractors".

Government really needs to clamp down on this.


This doesn't really seem like an abuse of contractors.

The therapists on better help: choose their own hours, can choose not to work with certain clients, can choose what type of therapy to use, etc.

This seems like a pretty textbook example of what an independent contractor should be.

> and be "independent" the same way as "independent" "contractors".

Employees can be some level of independent, but usually the level of control is the defining feature of employee vs contractor.


> The therapists on better help: choose their own hours, can choose not to work with certain clients, can choose what type of therapy to use, etc.

Employees can do that too.

> the level of control is the defining feature of employee vs contractor.

Not really. The most defining factor is substitution, but that is not always true. For instance if a contractor has never even looked how they could provide a substitute, then most likely they are only a "contractor" on paper.


Just because someone can be an employee doesn't mean it is an abuse for them to be a contractor. There is some overlap where either status fits.


But in that case this is exploitation, because people who are de-facto employees don't get the same rights as employees.

You could only advocate for this if you had a vested interest in a big corporation using such a loophole.

Otherwise, e.g. is supermarket a platform that gives independent contractors the ability to work on the tills or stack shelves etc?

The only difference here is that the "platform" is on the internet.


> Otherwise, e.g. is supermarket a platform that gives independent contractors the ability to work on the tills or stack shelves etc?

In this metaphor, i think the independent contractor would be the person who provides the produce. Which is how grocery stores generally work. (I.e. betterhelp sells therapy services, grocery stores sell groceries. The person working the till at the grocery store is more akin to the person working in the customer service dept at better help, not the person who provides the item for sale)

Professional people being independent contractors is hardly a new thing. Lawyers are usually hired as independent contractors. Its not like they are being taken advantage of.


This doesn't qualify as a scam in my book.


The last thing the world needs is a mental health company with this "Silicon Valley start-up vibe".


Apparently these kinds of services are exempt from HIPAA which is a huge problem and really should be more of an outrage and resolved quickly by congress.


Sorry to ask for a source, but is that actually true? I'm pretty sure they are covered. I would be interested in opening an account and filing a complaint against them if they aren't treating PII or PHI in a compliant manner.


The psychologists/therapists themselves would always be bound by HIPPA, from what I understand. But I don't think that a service like BetterHelp would be bound any more than google calendar would be bound by HIPPA just because doctors are using it. "Covered entities" and usually just the medical companies, insurance companies, and some governmental agencies when it comes to HIPPA.


> The psychologists/therapists themselves would always be bound by HIPPA, from what I understand. But I don’t think that a service like BetterHelp would be bound any more than google calendar would be bound by HIPPA just because doctors are using it.

If a covered entity is using it to gather and return PHI from/to clients then either (1) the service provider must be a business associated (and is, therefore, covered by HIPAA), or (2) any PHI must pass over the service provider’s encrypted and inaccessible to the service provider, and every time that doesn’t occur is a privacy breach.

But both this article and the FTC page on the settlement make it sound like BetterHelp is a provider [0], not an intermediary (note that them being subject to FTC jurisdiction because of violation of their published privacy policy, etc., does not mean that they would not also be subject to HHS jurisdiction for HIPAA violations.)

[0] From the FTC page: “California-based BetterHelp offers online counseling services under several names, including BetterHelp Counseling”


There are two different types of covered entities - providers, and those providing services to providers.


Put simply, HIPAA only applies to insurance based transactions.


> Put simply, HIPAA only applies to insurance based transactions.

That’s not true.

(Following explanation has been edited significantly to accurately describe how HIPAA applies beyond insurance transactions; original was overly broad.)

HIPAA was centrally about insurance (it is the “Health Insurance Portability and Accountability Act”), and only covers providers who conduct certain insurance-related transactions electronically, but the privacy positions apply to conduct by those covered healthcare providers generally as well as the whole chain of insurance transactions connected to them (not just to the content of covered insurance transactions, or patients involved in those transactions), it was put in the bill to address concerns with the standardization and promotion of electronic transactions and standard identifiers for insurance transactions, which critics feared would result in a health care privacy apocalypse, but it applies beyond the scope of the insurance transactions.


I will die on this hill. I ran a HealthTech company and we spent extensive time and legal counsel understanding our HIPAA obligations.

For example, if a provider is cash-only, they are not bound by HIPAA.

----

It's really important to see the nuance in the definition of a covered entity: https://www.hhs.gov/hipaa/for-professionals/covered-entities...

> This includes providers such as:

> Doctors

> Clinics

> Psychologists

> Dentists

> Chiropractors

> Nursing Homes

> Pharmacies

> *...but only if they transmit any information in an electronic form in connection with a transaction for which HHS has adopted a standard.*

Emphasis mine. That last sentence is the big "gotcha" on who HIPAA applies to.


You are correct that HIPAA only applies to entities who engage in insurance-related transactions, and that a cash-only provider would not be bound by it, and you are right to point this out as an important limitation.

At the same time, it does not apply only to insurance-based transactions; its applicability is on an entity level, not just a transaction level. A cash patient at a provider who engages in covered transactions is still protected by HIPAA.


> At the same time, it does not apply only to insurance-based transactions; its applicability is on an entity level, not just a transaction level. A cash patient at a provider who engages in covered transactions is still protected by HIPAA.

Also not true.

By default, if something in an organization is HIPAA-bound, the whole organization is. However, HIPAA allows organizations to be "hybrid entities". Essentially, should an organization have a desire, they can carve out the non-HIPAA compliant parts of their business as a "non-HIPAA entity".

You don't really see this in the "standard" healthcare system. It's simply far easier for everything to be treated under the same umbrella. Particularly, since most of them stand to gain nothing additional than the transaction-for-healthcare piece.

However, it seems far more common in the "direct-to-consumer" space where these companies are banking on secondary data and marketing plays.


>> A cash patient at a provider who engages in covered transactions is still protected by HIPAA.

> Also not true.

Wait, what? So if I'm paying my doctor in cash, then my doctor is not bound by HIPAA rules?

The rest of your comment doesn't seem to explain this (or I didn't understand it.)

If true, This is deeply disturbing, as it's not unusual that I pay in cash. I always assumed that I had even better privacy because no insurance company was being informed of my visit. it would mean that HIPAA isn't just weaker than people think, it's extremely weak.


> Wait, what? So if I'm paying my doctor in cash, then my doctor is not bound by HIPAA rules?

Only if the doctor does not accept any insurance payments at all (ie, from other patients). If they're "in network" with any insurance provider, they're generally required to abide by HIPAA for all patients. It's possible to get around that, but most independent providers aren't going to bother, and neither are larger health systems. Smaller practice conglomerates (e.g. the for-profit startups you see advertising on social media) are the ones most likely to be be taking advantage of this.

The main other case where you see this come up is outpatient therapy or psychiatry, because providers in most other contexts are not 100% self-pay, but many mental health providers are 100% self-pay.

> it would mean that HIPAA isn't just weaker than people think, it's extremely weak.

HIPAA is extremely weak. It's better than nothing, because the few protections it gives are important, but it's nowhere near sufficient.


It’s getting into territory that’s beyond my complete comprehension and ability to explain. There’s also a difference between what’s technically possible and what’s practical. Most places aren’t putting the effort into splitting.

If your doctor accepts insurance, they’re likely treating everything as though it’s covered by HIPAA. If your doctor is cash-only, then they are not bound by HIPAA (unless they have some other agreement that binds them).


Wow. I definitely learned something today.


This is not accurate. That's its main purpose, but it covers more than just that.

https://www.cdc.gov/phlp/publications/topic/hipaa.html


It's not fully accurate, but it's accurate enough for lay people. I founded a HealthTech company. I'm very familiar with the rules.

The key here is in the definition of a covered entity: https://www.hhs.gov/hipaa/for-professionals/covered-entities...

> [list of providers] ...but only if they transmit any information in an electronic form in connection with a transaction for which HHS has adopted a standard.

In grossly simple terms, that means if insurance/medicare/medicaid is not involved, it's not a "transaction for which HHS has adopted a standard"


Ah, I understand. Thank you. That explains the existence of several troubling loopholes I've seen.


Yep. We actually got multiple legal opinions on this. I was coming in from outside healthcare and absolutely baffled how little HIPAA applies to.


My wife is a nurse, and she once made a comment that alluded to this. She said that where HIPAA applies, it applies very strongly. That's why hospital staff, for instance, are always extremely careful about not violating HIPAA. But, she said, it doesn't apply everywhere. Her example was with drug and medical appliance companies who use patient data for marketing purposes.


Yep, if you’re a covered entity, you want to make sure you get things eighth. Punishments for being wrong can be very severe.

Many organizations will use an abundance of caution and treat far more than necessary as HIPAA-controlled simply because it’s less risky.


> The company will also pay $7.8 million to resolve allegations that it revealed sensitive data

> Teladoc had revenue of $2.4 billion last year, with about $1 billion coming from the BetterHelp.

The fine does not seem like a large enough fraction of their revenue to deter future abuse.


They also had a net loss of $13.7 billion (!) in 2022. Yes, you read that right. [1]

They had a $429 million net loss in 2021.

I'll be honest, I don't understand what "non-cash goodwill impairment" is that leads to losses that are almost 6x revenue. In any case, the company seems to already be losing plenty of money without the FTC needing to lift a finger...?

[1] https://ir.teladochealth.com/news-and-events/investor-news/p...


My reading of a definition for "goodwill impairment" is that it means the company acquired other companies, and determined later that it overpaid for them. Non-cash probably means that it paid for those acquisitions with stock rather than money.

All of which seems to me like a good argument for penalties being based on revenue rather than profits.

https://www.investopedia.com/terms/g/goodwill-impairment.asp


GAAP accounting lives in its own world, based on the operations of a 19th century barrel-making factory, where the value of a firm is simply the sum of all assets they hold minus all liabilities they owe.

In real life, an acquired firm is worth more than that because it's a "going concern." Even if you're buying a factory, it's worth more than the machinery and inventory because it's a business that will generate cash in the future.

The point of the GOODWILL asset is a sort of hack to represent this intangible value that you're going to get from operating the business you bought, which theoretically is exactly the difference between the net assets and the acquisition price. By putting in a goodwill amount, the acquisition isn't considered a net gain or loss at the moment that it happens; the books assume that the correct price was paid with no impact on company value.

When you realize that the business is actually a bit of a dud, you can take a GOODWILL IMPAIRMENT which basically means "eh, I guess running this business isn't worth as much as we thought." You reduce the value of the goodwill asset and recognize an expense, reducing your profit for the year where you realized there was an issue. There's therefore an incentive to recognize goodwill impairments when (or before) you make a lot of profit, so that you can reduce your profit and therefore your taxes.

(Side note - accrual accounting makes a lot more sense once you start thinking of assets as "cash that's missing but we aren't admitting it yet" and liabilities as "cash that's there but we aren't admitting it yet"; admitting or "recognizing" these things turns assets into expenses and liabilities into revenues.)

This gets really funny in software. Software startups live in their own world, based on a handful of them working out and dominating the entire economy, where the value of a firm is whatever you want it to be because it's basically infinity or zero.

So in these cases, goodwill represents the massive gap between "the amount we paid for our computers plus some percent of the amount we've spent on engineering salaries" and "I bet this thing will make use worth $50B one day so let's pay $2B for this capability." It's Schrodinger's accounting entry, waiting for the acquisition team to be proven right or wrong (usually wrong) one day. And most importantly, it's a mouth-watering chunk of tax avoidance that can be written down whenever needed to offset profits. Legitimately, because you really did lose that money making a bad business decision.


That’s… fascinating. And people say accountants have no imagination!


I found financial accounting to be one of the most interesting courses I've taken. It's basically thousands of pages of rules to simply try to match expenses and revenues at the appropriate time so that you know if your business decisions are individually profitable without getting misled by different timings of cash coming in and going out.

And it's basically incapable of handling IP-based businesses like software and pharmaceutical R&D. Those tend to be one-shot gambles on R&D, where you have absolutely no clue if your investment will pay off, and if it does the margins are nearly 100%. But they have to try anyway, leading to many clever-but-imperfect patches on the GAAP system.


Goodwill impairment means, in a nutshell, they think they paid too much to acquire.


Saw a toot yesterday that claimed that David Graeber had cajoled some economist into admitting that they did not know of a single case where a corporation broke the law and ended up losing money because of it, even when they were fined. Graeber supposedly characterized this as "Do all the crime you want, but expect to give us (the government) a cut".

It's a bit cynical, but if true, would be a good centerpiece of a populist campaign.


https://archive.is/YlkgC#selection-3665.0-3667.10

Sounds like they might have been sharing hashed emails and other identifiers with advertisers to execute retargeting campaigns:

> BetterHelp said its use of “limited, encrypted information” for targeting ads was an “industry-standard practice” for health-care companies. The company admitted no wrongdoing and it doesn’t share “names or clinical data from therapy sessions” with advertisers, according to a statement.


Yes, I'm sure this entity can be trusted with my data even though there is no incentive to do so and no penalty should they fuck up.


This is why I wouldn't dare to use their services. And doubly so if one of the companies they shared with was Facebook.


But they promised they don’t not share your more personal data, only the personal data!


Unique identifiers and clinical data from anywhere other than therapy sessions is all nicely bundled into a secondary (or maybe primary?) income stream though.


Shouldn’t Facebook be banned from receiving targeting data from ANY healthcare company? They ought to be fined, or preferably shut down.


BetterHelp has been around for a while now, and I'd be curious if it's actually helping with long-term mental health outcomes, on an individual and population level.

I mean, their advertising campaigns are massive. They advertise on literally every podcast, and now NPR. They advertise even more than Squarespace, and even more than [insert latest mattress company].


In the ads of theirs that I've heard, they include a disclaimer saying (paraphrasing) that their services are not intended to treat mental health conditions, but are meant to provide "counselling" -- basically a sympathetic ear.


I used a similar service and experienced a lapse in care when one of my appointments randomly vanished and the therapist voided out of their system. Super weird, but I learned about bridge scripts...


Are they not required to conform to HIPAA?


BetterHelp is a platform, not a provider. The actual therapists you talk to can't talk about you, but BetterHelp sure can.


Sounds like a bullshit loophole that should be struck down then. BetterHelp should be a platform just like a hospital is a platform...


It's completely insane that they're not a "business associate" or a "covered entity" under hipaa. That's a pretty serious indication that the rules are broken.


I'm appalled...


tldr: Yes and No: https://www.hhs.gov/hipaa/for-professionals/covered-entities...

There's a lot of nuance. Put simply, HIPAA is not required to be applied to a cash-based transactions. HIPAA is dependent on health insurance (and in-turn the government's influence on health insurance). Most healthcare providers accept/rely on insurance, so they simply choose to follow HIPAA standards.

An entity can be a "hybrid" entity, in which they explicitly seperate define HIPAA-compliant and non-HIPAA compliant parts of their businesses. Most providers don't go to this effort since (1) it does introduce risk (accidental intra-org boundary breaking) (2) most of their systems of going to be HIPAA-complaint anyways (3) they're not in the business of selling healthcare info.

I'm getting a bit fuzzy at this part of the law, but I believe that HIPAA only applies to transactions "for which HHS has adopted a standard.". That means even within health insurance transactions, there are legal carve-outs.

Realistically, the US needs far stricter health-privacy laws.


can we drop the charade and just direct-ship me a monthly sampler of adhd and anxiety drugs? thanks.


While ADHD medications are relatively safe, you really don’t want to start messing with anxiety medications. All of them have side effects and need to be dosed properly. Benzos are very quickly addictive. Beta blockers can kill you. Antidepressants can fuck you up.


Good! It's absolutely unacceptable that something as intimate and vulnerable as a therapy company would share my data with a company as abusive as Facebook.


I see a bit of confusion in this thread about what and where HIPAA applies to. I ran a HealthTech company a few years back. We spent extensive time working with lawyers to understand our obligations under HIPAA. While we always held ourselves to the same standard as a covered entity, our product/service was not technically obligated to follow HIPAA. I was shocked by this and we got serval differing legal opinions that all said the same.

Put simply, HIPAA is enforced on healthcare providers via their relationship with insurance companies. And, in turn those insurance companies relationship with the government.

For example, a cash-only clinic is not required to be HIPAA compliant. They do not process "transmit any information in an electronic form in connection with a transaction for which HHS has adopted a standard." [0]. Therefore, they are not a covered entity and not bound by HIPAA.

In fact, there are a lot of loopholes that HIPAA doesn't apply to. For most of your healthcare, it doesn't matter. It's far easier for most hospitals/doctors just to treat everything as though it's HIPAA compliant. All of their systems are already compliant, so they don't benefit from the loopholes.

Things get weird with "direct-to-consumer" health providers. Particularly, the cash-only (or credit card) providers. They aren't covered entities, so they are not bound by HIPAA. They are bound by general privacy law, but not by HIPAA.

tldr: HIPAA is far less limited in reach than most people think.

0 - https://www.hhs.gov/hipaa/for-professionals/covered-entities...


I doubt therapist are licensed and credentialed in the state the patient is in.


This depends on the state the patient is in. Most states require the therapist to be licensed in the state the patient is in, but there are exceptions.

For instance, many states allow an out-of-state licensed therapist (via telehealth or otherwise) to practice in their state for a limited period of time, typically 20 days.

During covid, many states (and the federal government) temporarily lifted restrictions on therapists operating in states they aren't licensed in as well. I don't know how many, if any, of those states have put the restrictions back in place.

And there are often different rules about when a patient has an established relationship with a licensed therapist but moves out of state.

To really know, you need to check with your own state's licensing department.


PewDiePie called this company out so many years ago.


FTC sees no issue with BetterHelp offering social workers as "therapists"?


No one does. LICSW is the common license for therapists (the SW stands for Social Worker). They aren't psychologists or psychiatrists, but they are therapists.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: