FTC Health Data Rules for Med Spas and Telehealth (2026)

The FTC vs. Hims & Hers: What Actually Happened

On July 29, 2026, the FTC filed suit against Hims & Hers in the U.S. District Court for the Northern District of California, joined by the Utah Division of Consumer Protection and by Los Angeles County acting on behalf of the People of the State of California. The complaint alleges the telehealth company promised discretion to subscribers while third-party tracking pixels and SDKs on its site transmitted user interactions with health-related content to Meta, Snap, and other advertising platforms. A second set of claims concerns subscription billing and cancellation — the FTC alleges refills were charged about ten days earlier than customers would expect, with a cancellation window that closed two days before that.

Three details matter for how you read this:

• It is a lawsuit, not a settlement. The FTC opened its probe in 2023, communicated findings to the company in April 2026, and entered settlement talks that did not resolve. No court has made any findings, and the allegations remain allegations.
• The claims run on Section 5 of the FTC Act — unfair or deceptive practices — along with the Restore Online Shoppers' Confidence Act for the billing conduct. The Health Breach Notification Rule is not the vehicle here.
• The cost lands before any verdict does. Hims disclosed a $15.0 million accrual for estimated probable losses as of March 31, 2026, then recorded a further $47.5 million legal contingency charge in Q2, leaving an accrual of roughly $60 million for the matter as of June 30, 2026 — before any court has ruled on anything.

That last point is the practical one. Defending a data-practices inquiry is expensive whether or not the agency ultimately prevails.

This Is Not an Isolated Case

The FTC's 2023 action against GoodRx was the agency's first enforcement under the Health Breach Notification Rule, and it established the core idea: sharing health-related data with ad platforms can be actionable on its own terms, with no breach required. Since then the agency has worked the same theory across telehealth and consumer health apps, increasingly through Section 5 rather than the Rule itself. For elective-care owners, the through-line is simpler than the statutes: if your site collects health-related signals and hands them to advertisers while your privacy policy implies otherwise, the gap between those two facts is the exposure.

Why Med Spas and Telehealth Clinics Are in the Crosshairs

Med spas and telehealth clinics sit at an uncomfortable intersection: they collect sensitive health data, and they spend heavily on digital advertising. That combination has drawn direct FTC scrutiny. These practices routinely feed patient data into ad networks through tracking pixels, use browsing behavior to retarget prospective patients, and share appointment or condition data with third-party vendors. They also make outcome claims in their advertising, which is a second, separate line of FTC exposure most owners never connect to the first. And they tend to run without dedicated compliance staff, so the person who installed the pixel is often the person who wrote the privacy policy — two decisions made months apart that a regulator will read side by side.

What to Do Before the FTC Comes Calling

The enforcement pattern is clear. What follows is a compliance review any practice can run before a regulator runs it for you.

• Audit every third-party script on your website and patient-facing pages. If a pixel fires during booking or intake, document exactly what data it captures and where it goes.
• Settle your covered-entity status in writing before anything else, because it determines which of the rules below actually bind you.
• If you are a covered entity, confirm which vendors have signed Business Associate Agreements. Most ad-tech vendors will refuse, and a refusal is itself the answer about whether that data should be flowing to them.
• Compare your privacy policy to your actual data practices. The FTC targets aspirational language that doesn't match real behavior, and outright deception is far from the only trigger.
• Obtain written, HIPAA-compliant authorization for every patient photo or testimonial before it appears in any ad or post.
• Build a substantiation file for every outcome claim before the ad runs, not after a complaint arrives.
• Train your marketing team on FTC disclosure requirements. Staff-generated content and influencer posts both count, even when unpaid.

The goal is defensible marketing, not less marketing.

How Tracking Pixels Become a Patient Data Problem

When a prospective patient visits your med spa website and browses a treatment page, the Meta Pixel or Google Tag embedded in your site captures that visit and ties it to their identity. If that person later books a consultation, you've effectively disclosed a health-seeking behavior to a third-party advertiser without their explicit consent.

Whether that is actionable, and under which law, is where practices get it wrong. In June 2024, a federal court in American Hospital Association v. Becerra vacated the part of HHS's tracking-technology guidance that treated an IP address plus a visit to an unauthenticated public webpage about a health condition as protected health information. HHS withdrew its appeal that August. So the simplest version of this theory — a pixel on your public treatment page automatically creates a HIPAA violation — is not the law. What the court left standing is everything else: tracking on logged-in patient portals, and other combinations of identifiable health information on public pages.

That is why the FTC's route matters more than the HIPAA one for most elective-care practices. Section 5 does not ask whether the data was PHI. It asks whether you told patients one thing and did another. For telehealth clinics running retargeting campaigns, that gap is usually invisible until someone reads the privacy policy against the network tab.

First Answer This: Are You Even a HIPAA Covered Entity?

Most compliance advice written for med spas skips this question, and it decides everything that follows. A health care provider is a HIPAA covered entity only if it transmits health information electronically in connection with a HIPAA covered transaction — insurance claims, eligibility checks, and the like. A purely cash-pay med spa that never bills a payer may not be a covered entity at all.

Practices tend to guess wrong in both directions, and both errors are expensive:

• If you are a covered entity — you bill insurance for any part of your services — HIPAA governs, and the FTC Act applies on top of it. The Health Breach Notification Rule does not apply to you. It was written for the businesses HIPAA misses, and it expressly excludes covered entities and their business associates acting as such.
• If you are not a covered entity — cash-pay only, no covered transactions — HIPAA may not reach you at all. That is not the relief it sounds like. It means the FTC Act is your primary federal exposure, plus state health-privacy law, and you lose the "we're HIPAA compliant" answer that owners reach for first.

The trap is assuming a HIPAA compliance program is a ceiling. Section 5 of the FTC Act prohibits unfair or deceptive practices whether or not the data is technically protected health information, and it applies to both groups above. A practice can be fully HIPAA compliant and still be sued for telling patients its site was discreet while a pixel said otherwise. That is the Hims theory in one sentence.

FTC Advertising Rules Every Practice Must Know

The FTC's advertising rules hit med spas and telehealth clinics on two fronts: endorsements and health claims. Under the updated Endorsement Guides, every paid testimonial or influencer post must carry a clear disclosure, and before-and-after photos used in ads must reflect typical results, not outliers. Practices that let patients post glowing reviews in exchange for discounts are already in violation.

On health claims, the FTC requires that any stated benefit be substantiated with competent and reliable scientific evidence. Vague promises about "rejuvenation" or "optimal wellness" may seem harmless, but regulators have cited far subtler language in enforcement actions.

• Disclosures must be clear and conspicuous, placed where consumers will actually see them, not buried in captions or fine print.
• Typical-results standards apply to visuals too, meaning stock-style photos that imply outcomes your average patient won't achieve can trigger liability.
• Health claims require documented evidence on file before the ad runs, not after a complaint surfaces.

The Rise of Coordinated Federal-State Enforcement

The Hims & Hers complaint was not solely a federal action. The Utah Division of Consumer Protection and Los Angeles County — the latter suing on behalf of the People of the State of California — joined as co-plaintiffs with their own consumer-protection claims alongside the FTC's. State and local consumer-protection offices are active partners in health data enforcement now, not bystanders, and the Los Angeles County posture is the detail worth holding onto: the office that brings the state-law claim need not be a state attorney general. One set of facts, several plaintiffs, different statutes, different remedies.

Be precise about what private plaintiffs can actually do, because this gets overstated constantly. California's CCPA has a private right of action, but a narrow one — it covers certain data breaches caused by failure to maintain reasonable security, not privacy violations generally; the rest is enforced by the state. Washington's My Health My Data Act is the broader consumer threat, because it is enforceable through the state's Consumer Protection Act, which does give individuals a path to sue.

For telehealth clinics operating across state lines, this compounds quickly. The same pixel firing on a booking page carries different statutory exposure in California versus Washington, and the FTC may be involved regardless. Practices in multi-state markets need to treat compliance as a layered obligation that follows their patients across state lines.

Where a Practice Platform Helps, and Where It Doesn't

Worth being direct about this, because most vendor content in this category is not: your EMR cannot fix the problem this post describes. The pixel lives on your marketing website. Removing it, gating it behind consent, and rewriting your privacy policy to match are jobs for whoever owns that site. No practice management platform, Decoda included, reaches into your WordPress theme and takes the Meta Pixel out.

What a platform does change is how far patient data travels after the visit. The common pattern behind these cases is not one bad decision — it is a chain of syncs. Patient records land in a CRM, the CRM feeds a marketing tool, the marketing tool builds an audience, and the audience goes to an ad network. Every hop is a place where health-related data can end up somewhere nobody intended.

Keeping patient communications, records, and membership billing in one system removes hops from that chain, and the AI scribe keeps clinical documentation inside it rather than in a side tool someone integrated once and forgot about. That is a narrower claim than "we make you FTC compliant," and it is the honest one. The pixel audit is still yours to run.

Final Thoughts on FTC Advertising and Data Compliance for Elective Care Practices

The FTC's recent actions aren't a warning that something might happen. They're a signal that it already is happening to practices that look a lot like yours. A pixel audit, a clear-eyed review of your privacy policy, and a clean process for patient consent go a long way. Grab a quick call with us if you want to see how Decoda supports compliant operations without adding friction to your day.