On September 9 the FTC narrowed the rule that made unauthorized health data sharing a reportable breach.
Ten days later, a Yale-led review showed exactly the kind of sharing that rule used to catch.
The Pulse
The FTC quietly narrowed who has to admit a health data breach.
On September 9, the FTC rescinded its 2021 policy statement that had pulled health apps and connected devices outside HIPAA's reach into the Health Breach Notification Rule.
Apps that only handle wellness or fitness data, without squarely selling a health service, lose the broader reading that treated unauthorized third-party sharing as a reportable breach.
Most patient-facing telehealth platforms already sit inside HIPAA and are not directly affected. But the federal backstop for the adjacent tools in your stack, quiz apps, symptom trackers, wellness content, just got thinner. Worth remembering right as the next item shows what that backstop used to catch.
A Yale review found most telehealth GLP-1 sellers skip a real consult.
A review led by Dr. Reshma Ramachandran of Yale, covered widely by the AP on September 19, looked at nearly 50 telehealth companies selling GLP-1 drugs and found fewer than a third required any real-time video or audio consultation before prescribing.
Some approvals landed within minutes. The same coverage ties in the FTC's ongoing case against Hims and Hers, built around two named practices: hard-to-cancel subscriptions and health data shared with ad platforms including Meta and Snap.
Speed-to-prescription used to be the pitch. It is becoming the exhibit, and the brands already named in a data-sharing complaint are the ones the next investigative piece looks at first.
Hims and Ro have both fully exited compounded GLP-1s.
Both companies now sell only FDA-approved branded semaglutide and tirzepatide, at prices comparable to or higher than their old compounded lines. Independent trackers put all-inclusive compounded pricing as low as $99 a month elsewhere in the category.
The two biggest names in telehealth weight loss just removed themselves from the "everyone does this" cover that mid-size compounded sellers leaned on since the shortage argument died in the Fifth Circuit in August.
If you still sell compounded product, you are no longer one voice in a crowd. You are one of the smaller, more visible names left standing in it.
The Deep Dive
Nobody has to tell your patients when their data leaks anymore. That job just became optional.
Two things landed nine days apart. The FTC narrowed the rule that made unauthorized health data sharing a reportable event. A Yale-led review, syndicated through the AP, showed telehealth GLP-1 sellers still passing patient data to ad platforms during intake.
1. The compliance backstop got thinner, not gone.
The rescinded policy only ever reached apps outside HIPAA's edge: quiz tools, symptom trackers, wellness content, the parts of your funnel built fast and rarely audited.
Your core patient record system is probably still covered. The tools around it, built by a different team on a different timeline, just lost part of their federal reporting obligation.
Nobody is coming to check that gap for you now. That was the point of the policy the FTC just pulled back.
2. Most of what leaks isn't a hack. It's a pixel doing its job.
The FTC's complaint against Hims names ad platform data sharing as one of two core practices, alongside hard-to-cancel subscriptions.
That sharing usually isn't a breach in the traditional sense. It's a Meta Pixel, a TikTok Pixel, or a Snap Pixel firing exactly as installed:
On your intake or questionnaire pages, passing treatment category as an event parameter
On your checkout or confirmation pages, passing order value alongside a hashed email or phone for platform matching
On your patient portal, if a marketing script ever got dropped in and never removed
None of that requires a breach. It requires nobody checking what the pixel actually sends, which is the default state of most telehealth marketing stacks.
3. The investigation is now faster than the regulation.
A Yale professor and an AP wire story did in three weeks what a federal rulemaking process would take years to do, and the FTC just made the formal reporting path narrower at the same time.
That is the actual shift here. The risk was never only "will the FTC catch this." It was always also "will a reporter, a researcher, or a competitor's lawyer catch this first," and that second risk did not shrink when the first one did.
A bad investigative story costs you conversion and trust in a week. A compliance notice costs you a fine on a schedule you can at least see coming.
The takeaway: treat this as your prompt to audit, not to relax. The rule that used to force disclosure got smaller. The practices that rule existed to catch are still running in plenty of telehealth stacks, yours possibly included, and finding out from a headline is worse than finding out from your own audit.
Quick Takes
The compounded field just got smaller, and more exposed.
Hims and Ro exiting compounded GLP-1s entirely removes the two biggest names from that side of the category.
Their exit was partly about the Fifth Circuit ruling, but it also removes the "the market leaders do this too" defense that mid-size compounded sellers have quietly leaned on.
If enforcement attention turns to who is left, the remaining names are now easier to list.
A $99 price floor changes what retention has to carry.
Independent trackers show all-inclusive compounded semaglutide as low as $99 a month, while branded product from Hims and Ro now runs at or above their old compounded pricing.
At a $99 price point, acquisition-heavy growth barely survives contact with CAC. The lifecycle program is not a nice-to-have layered on top of that margin. It is most of the profit left after the ad spend, which changes what "good enough" retention infrastructure means at that price tier.
One Thing to Try
Open your browser's network tab on your own intake flow, checkout page, and order confirmation page this week.
Watch for requests firing to Meta, TikTok, or Snap as you move through each step. Check what parameters ride along: treatment category, condition, order value, or a hashed email or phone number.
Anything that pairs a treatment or health detail with an identifier is the exact shape of what the FTC named in its Hims complaint. Strip the health-specific parameter, or move that event to a server-side conversion API that never sends it in the first place.
Takes an afternoon. Finding it yourself this week is a much better outcome than finding it in a reporter's inbox next month.
If retention is your biggest revenue leak, that’s what we fix. growthtrigger.xyz
Reply to this with your biggest retention challenge. I read and respond to every single one.