3 Lessons U.S. Healthtech Companies Can Learn From The Cerebral Investigations

By Bethany Corbin, Femtech Lawyer

Regulatory oversight and scrutiny of health technology (healthtech) companies has emerged as a priority for the federal government. Charged with mitigating fraud and abuse, protecting consumers, and ensuring digital health practices align with proper standards of care, the government has enhanced its oversight of healthtech companies since the COVID-19 pandemic. Most recently, substantial attention has been focused on the prescribing practices and potential engagement in unfair and deceptive acts by the once prominent mental health unicorn, Cerebral. Facing triple investigations by the Federal Trade Commission (FTC), Department of Justice (DOJ), and Drug Enforcement Administration (DEA), Cerebral has become a cautionary tale for healthtech companies looking to provide telemedicine services across the U.S. This article explores the regulatory investigations of Cerebral and identifies key lessons and risk mitigation strategies for healthtech companies nationwide.

The Cerebral Investigations — Digital Health Gone Wrong

Founded in 2019, Cerebral operates on a promise to democratize high-quality mental health care using digital health technology.¹ To enhance access and affordability of mental health services, Cerebral connects patients with licensed clinicians who can provide behavioral health resources and prescriptions for depression, anxiety, attention-deficit hyperactivity disorder (ADHD), post-traumatic stress disorder, and more. Using an on-demand subscription telehealth platform, Cerebral was perceived as revolutionizing access to mental health services during the COVID-19 pandemic while breaking down the stigmas and taboos associated with behavioral health illnesses. Cerebral partnered with national icons, including U.S. gymnast Simone Biles, and spent millions of dollars each month on online advertisements.² In the two years following the launch of its services, Cerebral obtained a $4.8 billion valuation and solidified crucial partnerships with health insurers.³

From the outside, Cerebral appeared as a golden child set to disrupt the relatively inaccessible mental health industry. However, Cerebral’s foundation had begun to crack in ways that threatened to undermine not only the company’s viability but also patient safety. In March 2022, the Wall Street Journal reported that Cerebral’s nurse practitioners complained of sustained pressure to unnecessarily prescribe Adderall and other ADHD medications regardless of medical necessity.³ In particular, clinicians voiced concern with renewing medications without appropriate follow-up and in-person visits.² Cerebral’s former vice president of product and engineering, Matthew Truebe, subsequently filed a lawsuit against the company in April 2022, claiming that Cerebral put profits before patient safety and overprescribed ADHD medications.⁴ Truebe alleged that Cerebral planned to increase customer retention through the prescription of stimulants and controlled substances to its entire ADHD patient population.⁴

Catching wind of Cerebral’s prescribing practices, the U.S. Attorney’s Office for the Eastern District of New York issued a grand jury subpoena in May 2022, allowing the DOJ to investigate Cerebral for potential violations of the Controlled Substances Act. The DOJ’s investigation analyzes whether Cerebral’s clinicians can acquire sufficient medical information and perform adequate medical examinations in half-hour telehealth appointments to support not only the diagnosis of a mental health condition but also the medical necessity of a controlled substance prescription. Prescribing controlled substances absent medical necessity could result in claims for fraudulent billing under the False Claims Act and jeopardize patient well-being. Sources have also claimed that the DEA is investigating Cerebral and Truepill — Cerebral’s preferred online pharmacy — regarding patients’ obtainment of controlled substances, particularly when such patients have established multiple accounts to obtain the drugs.⁵ By the end of May 2022, CVS Health and Walmart had stopped filling controlled substance prescriptions from Cerebral, and multiple health insurers — including Aetna and United Health — had removed Cerebral from their networks.⁶

A month later, the FTC initiated a separate investigation to determine whether Cerebral’s advertising and marketing practices constituted unfair or deceptive acts or practices.⁷ In particular, the FTC has raised concerns about whether Cerebral continued to bill customers after they had cancelled their subscriptions. Consumers have also publicly complained that Cerebral’s subscription cancellation process is burdensome and ineffective, with many patients never receiving promised refunds.⁸

While Cerebral’s regulatory investigations are ongoing, the negative publicity and business impacts from the investigations are undeniable. In light of the DOJ’s investigation, Cerebral stopped prescribing controlled substances to new patients.⁶ In June and October 2022, Cerebral announced substantial layoffs as part of an operational restructuring effort. The layoffs in October involved more than 20% of Cerebral’s workforce.⁹ The bad news continued following the death of Elijah Hanson in December 2022, in which it was discovered that the 21-year-old had obtained ADHD medication from Cerebral — despite never having been previously diagnosed with the condition.¹⁰ Hanson’s brother alleged he obtained the drug to abuse it, reinforcing patient safety concerns with Cerebral’s prescribing practices.¹⁰

Cerebral is not the only healthtech company facing regulatory scrutiny over its business practices. Mental health startup Done Global is similarly under investigation by the DEA for its controlled substance prescribing practices.¹¹ Comparable to Cerebral, Done is a membership-based platform that pairs patients seeking treatment for ADHD with licensed clinicians. Done received national attention in August 2022 following the death of Harlan Band, who had been prescribed Adderall by Done clinicians, despite his history of drug abuse.¹² The DEA is investigating Done’s controlled substance prescribing practices, representing widening interest from the federal government in regulating healthtech companies.

Key Takeaways From Cerebral For Healthtech Companies

With many healthtech companies employing similar business models as Cerebral — i.e., the exchange of money for on-demand access to clinicians and prescriptions — Cerebral’s woes may only be the beginning for the healthtech industry. The federal government is anticipated to step up its regulatory oversight of the digital health industry, with such investigations extending beyond mental health startups. Given the writing on the wall, it is important for healthtech companies to examine and understand regulatory pain points when it comes to digital health solutions and shore up their business practices before such investigations become widespread. Based on Cerebral, here are three important lessons that healthtech companies should know to minimize future regulatory risk.

1. Tele-Prescribing Lessons

The DOJ and DEA investigations of Cerebral center heavily on improper prescribing practices for controlled substances. Prior to the COVID-19 pandemic, a healthtech business model that integrated online prescribing of controlled substances would have been nearly impossible due to the prescribing laws in place. Specifically, the longstanding Ryan Haight Online Pharmacy Consumer Protection Act amended the Controlled Substances Act to prohibit the delivery or dispensation of a controlled substance by means of the internet unless the clinician had first conducted an in-person exam.¹³ This had the effect of requiring healthcare practitioners to perform in-person medical evaluations prior to issuing prescriptions for controlled substances, except in limited circumstances. During the pandemic, the government temporarily lifted this restriction as part of the public health emergency (PHE), allowing providers to tele-prescribe controlled substances for patients they may never have met in person. Though the PHE currently remains in effect, the Ryan Haight Act’s limitations on tele-prescribing controlled substances are expected to resume once the PHE expires.

In light of this regulatory landscape, it is essential for healthtech companies that tele-prescribe controlled substances during the remainder of the PHE to ensure they are complying with applicable state tele-prescribing rules and that their clinicians have formed a proper patient-physician relationship prior to tele-prescribing. Almost all states require the formation of a patient-physician relationship as a prerequisite to tele-prescribing. Some states impose additional requirements, including conducting an appropriate medical evaluation that adheres to the same standard of care as an in-person visit and ensuring that the patient has access to appropriate follow-up care. Providers who are unable to determine medical necessity during a visit should schedule appropriate follow-up visits and tests (as necessary) to gather sufficient information to make a medically informed decision. Medical necessity should be adequately documented in the patient’s medical record and should reference supporting documentation and diagnoses. If telehealth is not an appropriate avenue for treatment of a particular patient, the healthtech company should refer the patient to in-person care. It is crucial to ensure that the use of digital health technology satisfies the medical standard of care for all patients.

Additionally, healthtech companies should avoid pressuring clinicians to prescribe certain amounts of medication or write a certain number of prescriptions. Clinicians must retain independent medical judgment to evaluate and treat patients on a case-by-case basis, without having their medical decision-making clouded by corporate finances. It is advisable for healthtech companies to develop policies and procedures that ensure medical decision-making remains separate from corporate greed. Such policies should require clinicians to use and document their medical judgment for each patient.

Finally, healthtech companies should develop plans for business model changes that may result from the expiration of the PHE or the adoption of new regulatory rules based on current government investigations. When the PHE expires, the online controlled substance prescribing model may once again become obsolete. For companies that heavily rely on this capability, it is essential to begin thinking of long-term business strategies that can incorporate in-person visits as needed (assuming the PHE changes to the Ryan Haight Act are not made permanent prior to the PHE’s expiration). Further, the environment for tele-prescribing has shifted in response to the Cerebral investigations, with Walmart introducing a new policy in July 2022 that prohibits its pharmacies from accepting prescriptions for controlled substances issued through telehealth if there has not been an in-person patient visit within the past 24 months.¹⁴ While this is not a regulatory requirement, it is a risk mitigation strategy designed to help minimize the societal harms associated with overprescribing controlled substances. From a business standpoint, policies like these may force healthtech companies to find alternate pharmacies, which may be located outside the patient’s vicinity. Identifying and recognizing these types of trends early can help healthtech companies prepare for and quickly adapt their business models while minimizing the impact on revenue.

2. Marketing and Advertising Lessons

In addition to the tele-prescribing lessons, there are key takeaways from the FTC’s investigation of Cerebral, which focuses less on tele-prescribing and more on standard business practices that are common to many healthtech business models.

First, healthtech companies should reevaluate their marketing strategies given the regulatory climate. The FTC has been targeting companies that either misrepresent or exaggerate their businesses, particularly through online marketing and advertising campaigns. This includes not just content in a formal marketing campaign (e.g., social media advertisements) but also the language that healthtech companies use on their websites to describe their products and services. This language should be evaluated from two perspectives:

1. Is the language misleading to an ordinary consumer of average intelligence?
2. Does the language misrepresent the products or services in any manner — either overtly or through omission?

Annual website audits by the company’s product and legal teams can be particularly helpful in mitigating risk and can allow for early identification of problematic language prior to a regulatory investigation. When conducting a website audit, put yourself in the consumer’s shoes and analyze whether any language may be deceptive, ambiguous, or inflated.

Second, healthtech companies must develop easy processes and procedures for consumers to cancel their subscription plans and to ensure such cancellations are honored. The FTC has made clear its intent to ramp up enforcement actions against illegal dark patterns that trick consumers into purchasing (or prevent them from leaving) subscription services.¹⁵ Healthtech companies should develop and implement cancellation processes that are as easy to use as the original subscription methodology. For example, if a consumer could purchase a subscription online, an online subscription cancellation is recommended. By developing clear policies and procedures around subscription cancellations, healthtech companies can ensure that their workforces are appropriately trained to handle such cancellation requests. Moreover, healthtech companies should develop a method of documenting cancellation requests and follow-up actions.

3. Compliance Lessons​

Finally, from a compliance perspective, it is essential that healthtech companies encourage open lines of communication that encourage employees to report potential legal violations. Many federal investigations are the result of whistleblowers, who felt unheard by senior management when they attempted to voice concerns about the company’s business practices. Developing open lines of communication, including anonymous methods of reporting, can alert company leadership to non-compliance before it is reported to the federal government. For open lines of communication to work, the healthtech company must also develop and enforce a non-retaliation policy so that employees feel safe reporting suspected misconduct. Following up on complaints is highly recommended, as it shows employees that their concerns have been taken seriously.

Conclusion

The Cerebral investigations represent the tip of the iceberg for federal scrutiny into the business practices of healthtech companies. The largely unregulated boom in healthtech driven by the COVID-19 pandemic is now drawing increased interest from regulators and lawmakers who are devoted to protecting patient safety. As the healthtech industry presents itself for inspection, there are many healthtech companies that have failed to comply with current laws, regulations, and best practices. The Cerebral investigations serve not only as a warning for what is to come in the healthtech industry but also as an opportunity for change and growth for those healthtech companies that are willing to embrace the lessons Cerebral has to offer.  

References

1. About, Cerebral, https://cerebral.com/about-cerebral (last accessed Jan. 23, 2023).
2. Rolfe Winkler & Joseph Walker, Startups Make it Easier to Get ADHD Drugs. That Made Some Workers Anxious, Wall St. J. (Mar. 26, 2022), https://www.wsj.com/articles/startups-make-it-easier-to-get-adhd-drugs-that-made-some-workers-anxious-11648267205.
3. Rolfe Winkler et al., Startup Cerebral Soared on Easy Adderall Prescriptions. That Was Its Undoing, Wall St. J. (June 8, 2022), https://www.wsj.com/articles/cerebral-adderall-adhd-prescribe-11654705250.
4. Heather Landi, Ex-Cerebral Executive Files Lawsuit Claiming the Startup Overprescribed ADHD Meds, Fierce Healthcare (Apr. 29, 2022), https://www.fiercehealthcare.com/health-tech/former-cerebral-executive-files-lawsuit-alleging-unsafe-prescribing-practices.
5. Heather Landi, Cerebral Under Federal Investigation for Possible Violations of Controlled Substances Law, Fierce Healthcare (May 7, 2022), https://www.fiercehealthcare.com/health-tech/cerebral-under-federal-investigation-possible-violation-controlled-substances-law; Shelby Livingston & Blake Dodge, The DEA is Investigating the Mental-Health Startup Cerebral as the $4.8 Billion Mental Health Startup Faces Growing Scrutiny, Business Insider (May 4, 2022), https://www.businessinsider.com/dea-cerebral-questions-license-issues-2022-5.
6. Ananya Mariam Rajesh et al., Walmart, CVS to Halt Filling Prescriptions for Controlled Substances by Cerebral, Done, Reuters (May 26, 2022), https://www.reuters.com/business/healthcare-pharmaceuticals/walmart-cvs-halt-filling-prescriptions-controlled-substances-by-cerebral-done-2022-05-26/; Rebecca Torrence, Major Insurers are Kicking Cerebral Out of Network as the Mental Health Company Faces Scrutiny, Business Insider (June 13, 2022), https://www.businessinsider.com/unitedhealthcare-optum-aetna-cerebral-insurers-out-of-network-2022-6.
7. Heather Landi, FTC Investigating Mental Health Startup Cerebral’s Business Practices, Fierce Healthcare (June 15, 2022), https://www.fiercehealthcare.com/health-tech/ftc-investigating-mental-health-startup-cerebrals-business-practices-media-report.
8. Katie Jennings, Getting A Refund From Mental Health Startup Cerebral Can Take Its Own Toll on Customers, Forbes (Feb. 18, 2022), https://www.forbes.com/sites/katiejennings/2022/02/18/getting-a-refund-from-mental-health-startup-cerebral-can-take-its-own-toll-on-customers/?sh=6a94db4b1cc6.
9. Andrew Mendez, Telehealth Unicorn Cerebral Lays Off 20% of Staff for ‘Operational Efficiencies’, TechCrunch (Oct. 24, 2022), https://techcrunch.com/2022/10/24/telehealth-unicorn-cerebral-lays-off-20-of-staff-for-operational-efficiencies/.
10. Anna Werner & Jessica Kegu, Young Man’s Death Leads to Questions About an Adderall Prescription Obtained Online, CBS News (Dec. 6, 2022), https://www.cbsnews.com/news/adderall-online-prescription-cerebral-mental-health-elijah-hanson/.
11. Rolfe Winkler, DEA Investigating ADHD Telehealth Provider Done, Wall St. J. (Sept. 16, 2022), https://www.wsj.com/articles/dea-investigating-adhd-telehealth-provider-done-11663239601.
12. Rolfe Winkler, Harlan Band’s Descent Started With an Easy Online Adderall Prescription, Wall St. J. (Aug. 19, 2022), https://www.wsj.com/articles/harlan-bands-descent-started-with-an-easy-online-adderall-prescription-11660916158.
13. 21 U.S.C. § 829(e).
14. Anastassia Gliadkovskaya, Walmart Has a New Policy Denying Some Telehealth Prescriptions for Controlled Drugs. It’s Implicating Patients in Recovery, Fierce Healthcare (Aug. 9, 2022), https://www.fiercehealthcare.com/digital-health/new-policy-walmart-denies-telehealth-prescriptions-without-person-visit.
15. FTC to Ramp up Enforcement against Illegal Dark Patterns that Trick or Trap Consumers into Subscriptions, FTC (Oct. 28, 2021), https://www.ftc.gov/news-events/news/press-releases/2021/10/ftc-ramp-enforcement-against-illegal-dark-patterns-trick-or-trap-consumers-subscriptions.

About The Author:

Bethany Corbin is a healthcare innovation and femtech attorney dedicated to empowering healthtech startups to achieve their goals with legal counsel and strategic guidance. She is an Advisory Board Member for the Women’s Health Innovation Summit Series and serves as a mentor to multiple health technology accelerator programs, including FemTech Lab. You can learn more about Corbin at www.femtechlawyer.com or connect with Corbin on LinkedIn.