Your Mental State Could Be For Sale
A chance referral prompts a look at mental health privacy online. And it's not good.
I had one of those naked nightmares a few nights ago.
In it, I stand on a brightly lit stage and past the glare I can make out a crowd filling a very large stadium. I see the white of lab coats, the glint of stethoscopes. Some very serious looking business-clad types. Everyone has clipboards, notebooks, laptops.
Corporate logos festoon the wall at the edge of the stadium. Kaiser, Amazon, CBS. United Healthcare, Eli Lilly, Merck, Meta. Google, Media.net, PropellerAds, Mayo Clinic, Twitter, Best Buy, CVS, IBM, Teladoc, AdBlades, Microsoft, Yahoo, Infolinks, MetLife. There are banners from DHS, NIMH, FBI. DMV, Social Security Administration. The hubbub is mostly unintelligible but from seats nearby I hear disjointed fragments like “impressions” “ROI” “dwell time” “demographic reach” “lunch at our place” and “market share.”
The microphone at my face switches on and after a brief howl of feedback, I speak.
“Sometimes I feel really sad and hopeless; I look at the bottles in my medicine chest and think ‘what if?’ My friends say I’m too weird now. I smoke too much pot. I even thought I should get my baby brother stoned. I want sex all the time, but my fantasies scare me. My grandfather’s handyman abused me. Voices in my head keep telling me to wrap my parents up in electrical conduit and leave them in the desert.”
Laptop keys click, heads nod, conversations are whispered, urgent phone calls are made. I hear “Yes, we’ll dispatch behavioral set ‘c’ to TikTok and I have a call in to Lilly for the latest.” “How about a dubaltamil with hydropzonine supplement recommendation buy?” “The guys from Meta have a profile we can use for this.” “Reduce purchase effectivity capacity by 25% on this one.” “Yes, FBI is checking records now.”
In this fantasy world, I reveal my deepest darkest inner thoughts and feelings to this crowd from the commerce-advertising-medical-government complex who then set about analyzing and dissecting me to send me “more relevant advertising” and, much more disconcerting, adjust my social score. And maybe worse.
Except this is not a fantasy.
If you use one of the now-ubiquitous apps for online mental health therapy or for connecting to a live therapist, you’re at risk of revealing your mental health status to this nameless, faceless army. If you wouldn’t stand up in front of them and disclose the most painful and scary parts of yourself you need help with, then think twice about signing up with one of these apps.
Mental health treatment can be dispensed without the inconvenient physical presence required for orifice insertions, fluid collection, and other doctor’s office delights. It’s not necessary to physically sit in a leather chair staring across a desk at the person with the notepad compassionately murmuring “yes, please go on.” So, delivering psychological services virtually instead of in person took hold during the pandemic and is here to stay. But beware.
People will pay and pay and pay for treating an endless array of disorders limited only by the human mind’s capacity for creating its own angst and despair. Online psychological services require only a Zoom-like account and some practitioners who can be located anywhere, available to be deployed on a chat at any time. Even better, an “AI” chatbot is cheap and always on. This all means there is a ton of money to be made in the business of “appifying” behavioral health.
Cue corporations, hedge funds, and millennial app devs.
I went to my real-life medical group to ask about therapy and their response was: “we are overtaxed [meaning ‘we don’t make enough money in the behavioral health department, so we have no staff’] – so we’ll make a referral and they’ll get in touch.”
A series of way-too-friendly, presumptive-close voicemails and emails followed from an entity called Mood Health. “Call us now so we can onboard you!” messages arrived twice a day for two days. This over-eager outreach tweaked my BS antennae; they weren’t behaving like a normal health provider, they sounded too “sales-y.” The customer acquisition advance team from the audience in my dream had swung into action.
I went to the moodhealth.com home page. “Mental Health Care You’ll Love!” “Book Your First Visit!” “Ready to Rock?” People in stock photos looked like happy folks in video ads for anti-psychotics. Red flag. I went looking for the social media turd in the soup and found links to Facebook, TikTok, Google, and Pinterest trackers. (I highly recommend uBlock Origin tracking blocker whenever accessing any health provider’s site.) This raised more red flags; next stop, their privacy page.
Their privacy policy said “we don’t consider ourselves subject to HIPAA” - the Federal law protecting your personal health information’s privacy. They also disclaimed any requirement to be compliant with California privacy regulations. Same for their affiliates and partners, and all their other hangers-on. They disclaimed any responsibility for protecting your data security anywhere in their networks or those of their subcontractors.
This is completely unacceptable so I emailed that I would not use their service. A nice person replied and wrote, “sorry you misunderstand our privacy policy, would you like us to clarify it for you?” No, I thought – it’s plain English; what part of “we don’t think we’re subject to Federal privacy regulations” would I not understand?
This is what their privacy page said at the time:
Disclaimer of HIPAA Applicability.
Much Better is not a “covered entity” as defined in the federal medical record privacy statute known as the Health Insurance Portability and Accountability Act of 1996, as amended, and the regulations issued under that law (“HIPAA”). Additionally, with respect to the personal information we will obtain about you, we are not a “business associate” under HIPAA. Therefore, even though your personal information contains medical information that is the type of information commonly protected under HIPAA, it is not subject to any of the protections available to you under HIPAA. HIPAA is inapplicable to our relationship with you.
Disclaimer of CCPA Applicability.
Much Better is not subject to regulation under the California Consumer Privacy Act of 2018 (“CCPA”). Therefore, even if you are a California resident and Much Better may have personal information about you that is the type of the information subject to the CCPA, the CCPA is not applicable to Much Better or to our relationship with you.
Red flag, red flag, red flag. This notice has since been removed and now there’s no statement about HIPAA compliance at all. They still disclaim any responsibility for the security of any health data which is a violation of HIPAA regulations.
Mood Health is owned by Much Better, Inc., which was created in 2021 by Michael Clare, who lists his experience as Rhode Island School of Design, “User Experience and Product Developer” at Juxtapose, a “creation-oriented investment firm,” and “Experience Design” at now-defunct Control Group in New York.
Much Better’s co-founder is COO Betsy McMichael, previously a clinical director at weight-loss practice JumpstartMD.
Their clinical operations manager ran a “health coaching practice,” and blogged about recipes back in 2013 before also working at JumpstartMD
Neither top executive nor the clinical director at Mood Health have any credentials or experience in psychology, counseling, or running a medical practice. None of the other staff I saw listed (I did not look into their therapists) have any psychological or psychiatric background.
This isn’t a hit piece about Mood Health – their intentions may be the most pure and compassionate, but even if so, their lack of experience is another giant red flag and their naïve approach to health care and privacy could be dangerous.
In a darker view, it’s also possible that Mood Health is about presenting a slick interface, mining your psyche, and selling your data thus excavated to the nameless faceless crowd of data “consumers” from my dream.
Perhaps reality is somewhere in between, but in any case, you are the potential victim of any resulting privacy abuse.
If you plan to use one of the many online psychological services providers, I recommend:
Use a browser with a full set of privacy protections. The best option is uBlock Origin which has a Firefox add-on. If you use their app, you are may be giving up much more privacy.
Read the privacy policy! If they do not explicitly declare they comply with HIPAA then move on.
Now that I think of it, a visit to a clinician’s office is like super quaint.
Note: BetterHelp’s privacy policy at least mentions compliance with GDPR and California privacy laws and a computer security audit. Their parent company Teladoc’s privacy policy alludes to HIPAA in several places but falls short of plainly stating they comply with the law and has some slippery language I don’t like. Of several other apps I reviewed only Talkspace.com explicitly and plainly states they are compliant with HIPAA. The Federal office for investigating HIPAA compliance complaints declined to pursue an investigation of Mood Health.