Cerebral Confesses to Sharing Health Data of 3.1M Users

Please support Telehealth.org’s ability to deliver helpful news, opinions, and analyses by turning off your ad blocker.

HERE IS HOW

Adding to the growing number of recent FTC investigations about data voluntarily being shared by telehealth platforms for profit, Cerebral reportedly notified 3.1 million users that their protected health information was shared with tech companies like Meta, Google, and TikTok. This admission by the Cerebral telehealth company is noteworthy because of the substantial valuation and size, the number of patients served, the number of clinicians employed, and the breadth of services offered through the Cerebral telehealth website and Cerebral app.

The company states, “Cerebral is a mental health subscription that provides clients with ongoing, comprehensive access to online care and medication management for a monthly rate. Conditions that Cerebral treats include: anxiety, depression, insomnia, postpartum depression, menopausal depression, ADHD (in certain states), trauma and PTSD, bipolar disorder (in certain states), and alcohol dependence (in certain states). Additionally, we can help with: relationship issues and divorce, stress management, anger management, LGBTQI+, grief and loss, traumatic life events, confidence and self-esteem, phobias, coping with illnesses.”

Cerebral Telehealth Company Allegations

Cerebral’s data sharing-for-profit marketing strategy appears to have been based on a pixel tracking technology, somewhat akin to that used by BetterHelp, GoodRx, and other companies. A Markup and Stat study reviewed by Telehealth.org in early January of 2023 showed the breadth and depth of what turns out to be an approach to marketing used by many of the leading telehealth platforms, including Cerebral. The strategy involves promising consumers their information is safe, only to knowingly provide that sensitive, perhaps even protected, health information to marketing companies for profit. With 49 of the 50 leading telehealth startups reportedly using similar strategies of sharing sensitive patient information for profit, the remarkable study was summarized and explained in Telehealth.org’s article titled Some Telehealth Platforms Are Tracking Sensitive Patient Data: Are They Violating HIPAA? The question posed in the title about possible HIPAA infractions was unanswered until now with Cerebral. 

Brief History of Cerebral Woes

While events may have preceded the May 2022 American Bar Association, report that prosecutors from the US Attorney’s Office for the Eastern District of New York served Cerebral with a Grand Jury Subpoena citing possible violations of the Controlled Substances Act. The Subpoena was sent to Cerebral Medical Group, a contractor providing services on behalf of Cerebral for potentially overprescribing stimulants.

Picked up and reported by Telehealth.org in conjunction with complaints of one of Cerebral’s competitors operating under Done Global, Cerebral’s questionable advertising practices led to an agreement whereby Cerebral agreed to discontinue prescribing the ADHD medication Adderall.

Cerebral’s March 9 Admission Letter 

MedCityNews provides a download to Cerebral’s March 9 admission letter sent to users, explaining how and which patient information was shared. Consumers reportedly were misinformed about who will see their data, including demographics, self-report symptom checklists, and more. Although most companies ask visitors to check a box regarding which types of information will be shared, it is reasonable to assume that visitors to mental health sites are unaware of the repercussions of accepting all website cookies. It is advisable, then, to only accept the “necessary” cookies but to be aware that by agreeing, they may be opening the door to having a range of Internet and, in particular, social media activities tracked.

And Much More

Cerebral problems continue as the FTC investigates the company’s business practices. According to the June 14, 2022, issue of the Wall Street Journal, the FTC is investigating the company for continuing to bill customers a subscription fee until the customer cancels. Known as the “negative option,” this practice has a history of being considered an unfair business practice by the FTC. The organization reportedly seeks information about whether Cerebral is engaged in this practice.

The FTC’s “Civil Investigative Demand” comes as Cerebral also is tied into a Department of Justice investigation into its prescribing practices and possible violations of the Controlled Substances Act. 

In April 2022, Matthew Truebe, Cerebral’s ex-vice president of product and engineering, sued Cerebral, claiming that Cerebral terminated his employment after he criticized Cerebral for overprescribing addictive stimulant drugs, including Adderall, to young people. This practice surfaced after a Bloomberg article exposed the report of several employees who accused the startup of over-prescribing addictive medications such as Adderall for ADHD because of the COVID-related loosening of requirements for in-person examinations before prescribing addictive drugs.

Related or not, it may be worth noting that the Department of Drug Enforcement (DEA) has imposed tighter rules for the online prescribing of medications, including Adderall and buprenorphine, after the scheduled end of the COVID-related pandemic on May 11, 2023. This DEA post-COVID decision has come after years of controversy surrounding in-person requirements from the telehealth community.

Last May, Cerebral Medical Group received a grand jury subpoena from the US Attorney’s Office for the Eastern District of New York. The Controlled Substances Act regulates the distribution of potentially addictive medicines like Adderall and Xanax.

In June of 2022, the Wall Street Journal reported that some of Cerebral’s nurse practitioners felt pressured by the company to prescribe stimulants and felt the company’s 30-minute patient evaluations weren’t long enough to properly diagnose ADHD. 

In February 2023, Cerebral also announced a 15% company layoff to reportedly scale back and restructure. The announcement did not specify how many jobs would be cut or which areas of the company would be impacted. This latest set of layoffs follows an October 22 layoff of 20% of its workers, and August saw a cutback in contract jobs, including nurse practitioners. 

These sizeable layoffs stand in contrast to PitchBook’s Cerebral vitals report, which includes valuation and funding. It is worthy of note that Cerebral’s most recent round of funding equaled $300M, which increased its valuation to $4.8B.

Readers interested in the official Cerebral press room will note that details of these recent events have not yet been posted.

HIPAA’S OCR Steps to Address Cerebral Telehealth Data Sharing  

With government forces converging to investigate Cerebral after sharp criticism and letters of inquiry from US Senators in February questioning their company’s sharing of sensitive patient information with marketing companies, Cerebral was identified on the US Department of Health and Human Services (HHS) Office for Civil Rights Breach Portal. The portal lists “Cases Currently Under Investigation” for “Breach of Unsecured Protected Health Information.” The Cerebral “breach submission date” was reportedly submitted on March 1, 2023, and is further explained as “unauthorized access/disclosure” related to network server.”

As suggested in our opening paragraphs and previous article about the Markup and Stat research project, FTC investigations are one thing, but privacy investigations of HIPAA violations by the HHS Office for Civil Rights (OCR) are quite another. The official enforcement arm assigned to issuing penalties for violating HIPAA, the OCR’s public posting of the Cerebral investigations marks the first time Telehealth.org has noticed such widespread investigation of sharing protected health information.

Privacy concerns become an issue for some mental health app companies when recent research suggests that a number of them routinely sell sensitive mental health data to data brokers, who, in turn, resell the information to buyers on the open market. Apparently, many mHealth apps technically are not considered “covered entities” by HIPAA. Telehealth.org has not seen any indication that the Cerebral app has been involved in such activity or that the current HIPAA investigation of Cerebral is directly related to the Cerebral app in any way.

Related FTC Investigations

As noted in recent announcements regarding BetterHelp and GoodRx FTC investigations for allegedly sharing sensitive consumer data with marketing companies, some of the leading advertising companies themselves are being pulled into the crackdown. For example, the United States District Court for the Northern District of California filed a class action lawsuit in the Summer of 2022 against Meta (Facebook), the UCSF Medical Center, and the Dignity Health Medical Foundation, claiming that they have been illegally collecting patients’ health data for targeted advertising. 

Telehealth.org will keep you posted on any related news, particularly any FTC and OCR announcements related to telehealth. Clinicians wondering how to think about current or prospective telehealth employers are encouraged to consider learning their legal and ethical requirements when accepting employment with digital health employers. 

Accepting Telehealth Jobs: 5 Big Legal & Ethical Mistakes to Avoid

Do you have questions about being employed or looking for employment from a digital health company? Online employment can pose dilemmas that leave clinicians at a loss for how to proceed. This program will answer your questions about how or reasonably uphold your legal and ethical mandates.

Read More