BetterHelp’s intake form was a privacy promise the ad stack broke

The week

On March 2, 2023, the Federal Trade Commission announced a proposed order against BetterHelp, an online counseling service owned by Teladoc. The FTC alleged that BetterHelp had promised consumers it would keep sensitive information private, including answers to an intake questionnaire about their mental health. According to the complaint, it nonetheless shared email addresses, IP addresses and health questionnaire information with advertising platforms, including Facebook and Snapchat, to target ads. Under the proposed order BetterHelp would pay $7.8 million for consumer refunds and would be banned from sharing consumers’ health information for advertising. A month earlier, on February 1, the FTC had brought its first case under the Health Breach Notification Rule, against GoodRx, over similar sharing. Neither company was treated as a HIPAA covered entity for this conduct.

Health systems sometimes file FTC privacy actions under consumer apps, not organizations governed by HIPAA. That misses why BetterHelp mattered to them. The case turned on the gap between what a sign-up experience told people and what the technology behind it did. Every hospital, ambulatory network and payer with online scheduling, a symptom checker or a patient app manages the same gap. It opens at three points in the patient’s digital journey: the moment of sign-up, the data captured along the way, and the measurement that follows.

The moment of sign-up

The FTC’s complaint leaned heavily on what BetterHelp told users. Its intake asked sensitive questions about mental health, and its site carried assurances about privacy. The alleged problem was that practices did not match those assurances. That is a deception theory under Section 5 of the FTC Act, and it does not depend on HIPAA. HIPAA-covered organizations also run digital properties, such as public marketing sites and some consumer tools, where their statements can be tested the same way.

Privacy language in an intake flow is part of the product, not boilerplate. When a scheduling page says information is confidential, a patient reasonably believes it applies to everything they type. Many health organizations write that language in legal and marketing, while digital and security teams decide what the page actually sends. The control is a joint sign-off: the people who write the promise and the people who know the data flows review each patient-facing flow together. They do it before launch and whenever tags, forms or vendors change. A short register listing each flow, its stated promise and its actual recipients makes the review repeatable.

Consent design matters as much as wording. A cookie banner that loads tags before the patient chooses, or treats continued browsing as agreement, undermines the promise on the same page. Where the organization relies on authorization for any sharing, the request should be separate, specific and easy to decline.

The data captured along the way

BetterHelp’s questionnaire existed to match people with therapists. Its answers were useful for care and, as the complaint described, useful to advertising systems. Health organizations collect comparable signals across their digital front door. They capture the service line searched, the provider booked, the condition page read and the text typed into a symptom checker. Much of it is collected not because anyone chose to, but because analytics and advertising tools capture page views, form events and URLs by default.

Earlier in this series we covered the tag ownership and scanning work that OCR’s tracking bulletin prompted. BetterHelp added a different test: whether data could be pulled back once it had gone. The proposed order required the company to direct third parties to delete the data it had shared. Most health organizations could not do that. They could not say which identifiers had gone to which platform, when, or under which account, because the transfer happened in the browser and was never logged on their side.

Minimizing capture is therefore partly about keeping a record of what leaves. Build forms so sensitive answers are processed server-side and never exposed to third-party scripts. Keep condition names and appointment types out of URLs and page titles, which tags routinely collect. Configure analytics to record that a step was completed, not what was entered. Where any data is sent to an outside platform, send it from a server the organization controls, so there is a log of each field, recipient and date. That log is what makes a deletion request, a regulator’s question or a patient’s access request answerable.

Vendor contracts are the backstop. Analytics and advertising vendors should be bound to restrict their use of any data received and to delete it on request, with confirmation in writing. Organizations should also know whether each vendor will sign a business associate agreement for pages that may involve PHI. Many will not, which settles whether their tags belong on those pages.

Behavioral health, reproductive health and substance use pages deserve the strictest treatment. The harm from disclosure there is greatest, and state laws were starting to single these categories out. A practical rule is that these service lines get no third-party advertising tags at all, with measurement handled through first-party, aggregate tools.

The measurement that follows

The third point is campaign measurement. BetterHelp’s alleged sharing served a familiar purpose: telling ad platforms who had signed up, so they could find similar people and report on campaign results. Health marketing teams face the same pressure to prove that digital spend produces appointments.

There are ways to measure without handing health context to ad platforms. Aggregate conversion counts can be reported without individual-level signals. Server-side measurement can strip identifiers and sensitive parameters before anything leaves the organization. Platforms’ own privacy-preserving options can be used where contracts and configurations have been reviewed. Each comes with trade-offs. Targeting and attribution get less precise, campaign costs per booked appointment may look higher, and marketing teams lose some optimization tools. Those trade-offs should be decided explicitly by marketing, privacy and patient experience leaders together, and recorded. They should not be left to tool defaults.

Marketing agencies need the same rules written into their statements of work. They often hold tag manager credentials and launch campaigns on short notice, so they are where new tracking most often appears without review.

Patient experience leaders have a direct stake. A privacy failure in a digital channel is experienced as a breach of trust, and it lands on the brand that made the promise. Patients do not distinguish between the hospital and its analytics vendor. Measuring trust, through complaint themes, opt-out rates and portal abandonment on sensitive steps, gives the experience team evidence to weigh against marketing’s attribution numbers.

With hindsight

The FTC finalized the BetterHelp order in July 2023, and in May 2024 it said about 800,000 consumers would receive refunds from the settlement. In April 2024 it adopted amendments to the Health Breach Notification Rule that confirmed the rule reaches many health apps. Washington’s My Health My Data Act, signed in April 2023, took broad effect in March 2024. It requires consent for collecting and sharing consumer health data and gives individuals a private right of action. Other states added their own health data provisions. HHS’s separate guidance on tracking technologies on HIPAA-regulated websites was narrowed by a federal court in 2024 for unauthenticated pages, but deception claims under the FTC Act and state law did not depend on it. Privacy statements in patient-facing journeys have remained enforceable commitments, whichever regulator is involved.