BetterHelp Barred by FTC from Sharing Data with Facebook
bloomberg.com
bloomberg.com
Their business model is one big scam. You don't pay per-session, you pay per-month. Thus, they oversubscribe their "therapists" (who are almost all independent contractors doing BH as their side gig), and so the incentive is encourage you to book as infrequently as possible.
Once you take that into account, it ends up being as expensive or more than a traditional therapist.
One of the hardest parts of starting therapy is finding a therapist who's a good match for you. And it's a lot of work to find therapists, schedule, have an awkward conversation after a first session about whether you'll have a second...
So even if it winds up being the same price or even more, it could still be a net benefit in terms of being an efficient and anxiety-free way of finding a therapist who's a good match. Or even just the right therapy modality.
I've often wondered, though, once you find a therapist you like, what prevents you from just seeing them directly, without BetterHelp taking their cut?
- 1) you're dealing with therapists who are treating this like a side gig,
- 2) they're all overbooked,
- 3) dealing with a company that prioritizes money extraction over helping people, and
- 4) a poor experience with BH (likely) turns people off from therapy, which can be an actually wonderful experience.
I really can't blame the therapists much. Hate the game, not the player. BetterHelp the company needs to shape up.
I know several people, myself included, who have found their service very valuable.
The overwhelming majority of therapists in my town are not on contract with my HMO. I tried two different therapists who did, and it was so bad you couldn't have paid me to go back.
https://www.fastcompany.com/90631941/we-have-never-seen-such...
Are they though? It seems like corporations found a loophole where they don't have to take on employees, pay proper taxes and abide by employment laws.
Just to pre-empt some comments - employees can have multiple employers at the same time and be "independent" the same way as "independent" "contractors".
Government really needs to clamp down on this.
The therapists on better help: choose their own hours, can choose not to work with certain clients, can choose what type of therapy to use, etc.
This seems like a pretty textbook example of what an independent contractor should be.
> and be "independent" the same way as "independent" "contractors".
Employees can be some level of independent, but usually the level of control is the defining feature of employee vs contractor.
Employees can do that too.
> the level of control is the defining feature of employee vs contractor.
Not really. The most defining factor is substitution, but that is not always true. For instance if a contractor has never even looked how they could provide a substitute, then most likely they are only a "contractor" on paper.
You could only advocate for this if you had a vested interest in a big corporation using such a loophole.
Otherwise, e.g. is supermarket a platform that gives independent contractors the ability to work on the tills or stack shelves etc?
The only difference here is that the "platform" is on the internet.
In this metaphor, i think the independent contractor would be the person who provides the produce. Which is how grocery stores generally work. (I.e. betterhelp sells therapy services, grocery stores sell groceries. The person working the till at the grocery store is more akin to the person working in the customer service dept at better help, not the person who provides the item for sale)
Professional people being independent contractors is hardly a new thing. Lawyers are usually hired as independent contractors. Its not like they are being taken advantage of.
I tried two competitors. Both were horrible. Thirty minute sessions, where the "therapist" did all the talking, and then occasionally gave a PDF worksheet. Apparently this is "cognitive behavioral therapy".
I tried TalkSpace twice. My favorite experience was when I texted the "therapist" and got back -- and let me quote in full -- "That's a lot. Can you fill out this worksheet, and do this self-assessment?" (This would be the same assessment I had done four times prior. And the worksheet looked like it came from the chummiest chumsite on the web. There was even a URL on the bottom, where she had just clicked "Print | Save to PDF".
I tried Cerebral, and its "therapists" were equally worthless. However, the "prescriber" gave me an SSRI (shockingly fast), which actually helped.
Cerebral felt like a pill mill, and apparently the DOJ also thinks so. https://www.theverge.com/2022/5/9/23063356/cerebral-teleheal...
The therapists were also no very good, talking themselves all the time.
And now this. I wouldn’t touch it with a ten feet pole and request my data to be deleted (if we can still trust them to do so)
If a covered entity is using it to gather and return PHI from/to clients then either (1) the service provider must be a business associated (and is, therefore, covered by HIPAA), or (2) any PHI must pass over the service provider’s encrypted and inaccessible to the service provider, and every time that doesn’t occur is a privacy breach.
But both this article and the FTC page on the settlement make it sound like BetterHelp is a provider [0], not an intermediary (note that them being subject to FTC jurisdiction because of violation of their published privacy policy, etc., does not mean that they would not also be subject to HHS jurisdiction for HIPAA violations.)
[0] From the FTC page: “California-based BetterHelp offers online counseling services under several names, including BetterHelp Counseling”
The key here is in the definition of a covered entity: https://www.hhs.gov/hipaa/for-professionals/covered-entities...
> [list of providers] ...but only if they transmit any information in an electronic form in connection with a transaction for which HHS has adopted a standard.
In grossly simple terms, that means if insurance/medicare/medicaid is not involved, it's not a "transaction for which HHS has adopted a standard"
Many organizations will use an abundance of caution and treat far more than necessary as HIPAA-controlled simply because it’s less risky.
That’s not true.
(Following explanation has been edited significantly to accurately describe how HIPAA applies beyond insurance transactions; original was overly broad.)
HIPAA was centrally about insurance (it is the “Health Insurance Portability and Accountability Act”), and only covers providers who conduct certain insurance-related transactions electronically, but the privacy positions apply to conduct by those covered healthcare providers generally as well as the whole chain of insurance transactions connected to them (not just to the content of covered insurance transactions, or patients involved in those transactions), it was put in the bill to address concerns with the standardization and promotion of electronic transactions and standard identifiers for insurance transactions, which critics feared would result in a health care privacy apocalypse, but it applies beyond the scope of the insurance transactions.
For example, if a provider is cash-only, they are not bound by HIPAA.
----
It's really important to see the nuance in the definition of a covered entity: https://www.hhs.gov/hipaa/for-professionals/covered-entities...
> This includes providers such as:
> Doctors
> Clinics
> Psychologists
> Dentists
> Chiropractors
> Nursing Homes
> Pharmacies
> *...but only if they transmit any information in an electronic form in connection with a transaction for which HHS has adopted a standard.*
Emphasis mine. That last sentence is the big "gotcha" on who HIPAA applies to.
At the same time, it does not apply only to insurance-based transactions; its applicability is on an entity level, not just a transaction level. A cash patient at a provider who engages in covered transactions is still protected by HIPAA.
Also not true.
By default, if something in an organization is HIPAA-bound, the whole organization is. However, HIPAA allows organizations to be "hybrid entities". Essentially, should an organization have a desire, they can carve out the non-HIPAA compliant parts of their business as a "non-HIPAA entity".
You don't really see this in the "standard" healthcare system. It's simply far easier for everything to be treated under the same umbrella. Particularly, since most of them stand to gain nothing additional than the transaction-for-healthcare piece.
However, it seems far more common in the "direct-to-consumer" space where these companies are banking on secondary data and marketing plays.
> Also not true.
Wait, what? So if I'm paying my doctor in cash, then my doctor is not bound by HIPAA rules?
The rest of your comment doesn't seem to explain this (or I didn't understand it.)
If true, This is deeply disturbing, as it's not unusual that I pay in cash. I always assumed that I had even better privacy because no insurance company was being informed of my visit. it would mean that HIPAA isn't just weaker than people think, it's extremely weak.
If your doctor accepts insurance, they’re likely treating everything as though it’s covered by HIPAA. If your doctor is cash-only, then they are not bound by HIPAA (unless they have some other agreement that binds them).
Only if the doctor does not accept any insurance payments at all (ie, from other patients). If they're "in network" with any insurance provider, they're generally required to abide by HIPAA for all patients. It's possible to get around that, but most independent providers aren't going to bother, and neither are larger health systems. Smaller practice conglomerates (e.g. the for-profit startups you see advertising on social media) are the ones most likely to be be taking advantage of this.
The main other case where you see this come up is outpatient therapy or psychiatry, because providers in most other contexts are not 100% self-pay, but many mental health providers are 100% self-pay.
> it would mean that HIPAA isn't just weaker than people think, it's extremely weak.
HIPAA is extremely weak. It's better than nothing, because the few protections it gives are important, but it's nowhere near sufficient.
> Teladoc had revenue of $2.4 billion last year, with about $1 billion coming from the BetterHelp.
The fine does not seem like a large enough fraction of their revenue to deter future abuse.
They had a $429 million net loss in 2021.
I'll be honest, I don't understand what "non-cash goodwill impairment" is that leads to losses that are almost 6x revenue. In any case, the company seems to already be losing plenty of money without the FTC needing to lift a finger...?
[1] https://ir.teladochealth.com/news-and-events/investor-news/p...
All of which seems to me like a good argument for penalties being based on revenue rather than profits.
https://www.investopedia.com/terms/g/goodwill-impairment.asp
In real life, an acquired firm is worth more than that because it's a "going concern." Even if you're buying a factory, it's worth more than the machinery and inventory because it's a business that will generate cash in the future.
The point of the GOODWILL asset is a sort of hack to represent this intangible value that you're going to get from operating the business you bought, which theoretically is exactly the difference between the net assets and the acquisition price. By putting in a goodwill amount, the acquisition isn't considered a net gain or loss at the moment that it happens; the books assume that the correct price was paid with no impact on company value.
When you realize that the business is actually a bit of a dud, you can take a GOODWILL IMPAIRMENT which basically means "eh, I guess running this business isn't worth as much as we thought." You reduce the value of the goodwill asset and recognize an expense, reducing your profit for the year where you realized there was an issue. There's therefore an incentive to recognize goodwill impairments when (or before) you make a lot of profit, so that you can reduce your profit and therefore your taxes.
(Side note - accrual accounting makes a lot more sense once you start thinking of assets as "cash that's missing but we aren't admitting it yet" and liabilities as "cash that's there but we aren't admitting it yet"; admitting or "recognizing" these things turns assets into expenses and liabilities into revenues.)
This gets really funny in software. Software startups live in their own world, based on a handful of them working out and dominating the entire economy, where the value of a firm is whatever you want it to be because it's basically infinity or zero.
So in these cases, goodwill represents the massive gap between "the amount we paid for our computers plus some percent of the amount we've spent on engineering salaries" and "I bet this thing will make use worth $50B one day so let's pay $2B for this capability." It's Schrodinger's accounting entry, waiting for the acquisition team to be proven right or wrong (usually wrong) one day. And most importantly, it's a mouth-watering chunk of tax avoidance that can be written down whenever needed to offset profits. Legitimately, because you really did lose that money making a bad business decision.
And it's basically incapable of handling IP-based businesses like software and pharmaceutical R&D. Those tend to be one-shot gambles on R&D, where you have absolutely no clue if your investment will pay off, and if it does the margins are nearly 100%. But they have to try anyway, leading to many clever-but-imperfect patches on the GAAP system.
It's a bit cynical, but if true, would be a good centerpiece of a populist campaign.
Sounds like they might have been sharing hashed emails and other identifiers with advertisers to execute retargeting campaigns:
> BetterHelp said its use of “limited, encrypted information” for targeting ads was an “industry-standard practice” for health-care companies. The company admitted no wrongdoing and it doesn’t share “names or clinical data from therapy sessions” with advertisers, according to a statement.
I mean, their advertising campaigns are massive. They advertise on literally every podcast, and now NPR. They advertise even more than Squarespace, and even more than [insert latest mattress company].
There's a lot of nuance. Put simply, HIPAA is not required to be applied to a cash-based transactions. HIPAA is dependent on health insurance (and in-turn the government's influence on health insurance). Most healthcare providers accept/rely on insurance, so they simply choose to follow HIPAA standards.
An entity can be a "hybrid" entity, in which they explicitly seperate define HIPAA-compliant and non-HIPAA compliant parts of their businesses. Most providers don't go to this effort since (1) it does introduce risk (accidental intra-org boundary breaking) (2) most of their systems of going to be HIPAA-complaint anyways (3) they're not in the business of selling healthcare info.
I'm getting a bit fuzzy at this part of the law, but I believe that HIPAA only applies to transactions "for which HHS has adopted a standard.". That means even within health insurance transactions, there are legal carve-outs.
Realistically, the US needs far stricter health-privacy laws.
Put simply, HIPAA is enforced on healthcare providers via their relationship with insurance companies. And, in turn those insurance companies relationship with the government.
For example, a cash-only clinic is not required to be HIPAA compliant. They do not process "transmit any information in an electronic form in connection with a transaction for which HHS has adopted a standard." [0]. Therefore, they are not a covered entity and not bound by HIPAA.
In fact, there are a lot of loopholes that HIPAA doesn't apply to. For most of your healthcare, it doesn't matter. It's far easier for most hospitals/doctors just to treat everything as though it's HIPAA compliant. All of their systems are already compliant, so they don't benefit from the loopholes.
Things get weird with "direct-to-consumer" health providers. Particularly, the cash-only (or credit card) providers. They aren't covered entities, so they are not bound by HIPAA. They are bound by general privacy law, but not by HIPAA.
tldr: HIPAA is far less limited in reach than most people think.
0 - https://www.hhs.gov/hipaa/for-professionals/covered-entities...
For instance, many states allow an out-of-state licensed therapist (via telehealth or otherwise) to practice in their state for a limited period of time, typically 20 days.
During covid, many states (and the federal government) temporarily lifted restrictions on therapists operating in states they aren't licensed in as well. I don't know how many, if any, of those states have put the restrictions back in place.
And there are often different rules about when a patient has an established relationship with a licensed therapist but moves out of state.
To really know, you need to check with your own state's licensing department.