Millions of Americans turn to online healthcare services for convenient access to medical advice and prescription treatments. But information shared during those visits may not always remain between patients and their healthcare providers. A growing federal lawsuit against telehealth company Hims & Hers is exposing how sensitive medical information can allegedly make its way into the advertising systems of major social media platforms.
On November 10, five additional states joined a lawsuit brought by the Federal Trade Commission (FTC), accusing Hims & Hers of misleading consumers about its privacy protections. Arizona, Florida, Nebraska, Ohio and Wisconsin joined an existing case involving federal regulators, Utah and California officials acting through Los Angeles County. The lawsuit alleges that the company shared sensitive consumer health information with advertising platforms, including Meta and Snap, despite assurances that customers’ information would remain private.
According to the amended federal complaint, Hims & Hers uploaded approximately 14 million consumer email addresses to Meta between September 2020 and June 2023 to create targeted advertising audiences. Regulators allege that the information connected consumers to particular medical treatments they had sought, potentially revealing sensitive health interests to an advertising company. The complaint also describes tracking technologies that allegedly transmitted information about visitors’ activities on the telehealth website.
The allegations extend beyond privacy. Federal regulators also accuse Hims & Hers of charging some consumers for prescription treatments before they had an opportunity to consult with a healthcare provider, enrolling customers in recurring subscriptions without adequate disclosure and making those subscriptions difficult to cancel. Hims & Hers disputes the government’s allegations and has said it intends to defend itself vigorously. The case remains pending, and the allegations have not been established as violations by the court.
The Readovia Lens
The Hims & Hers case highlights a broader concern about healthcare in the digital age: not every company collecting medical information is subject to the same privacy protections as a traditional healthcare provider. The Health Insurance Portability and Accountability Act (HIPAA) does not automatically cover every consumer health application or online wellness service. Before sharing sensitive information, consumers should examine how a platform uses advertising trackers, whether it shares data with outside companies and what its privacy policy says about marketing. They should also review subscription and cancellation terms before providing payment information. As healthcare increasingly moves online, convenience should not come at the expense of understanding who may have access to personal medical information.
