Two telehealth companies were in the news this spring for very different reasons and at very different stages of trouble. One received an FDA warning letter as part of a broad enforcement sweep and has faced press scrutiny over its advertising. The other is in active federal litigation where the government has asked a court to freeze its assets and appoint a receiver.
I am not writing about either company because the details are dramatic. I am writing about them because the rules involved are the same rules that apply to every telehealth practice operating today, including the small ones, and because the pattern underneath both situations is the one I see most often in my own client work: growth that outran the compliance infrastructure.
A note on framing before I start. Warning letters are advisory communications, not findings of guilt, and companies routinely correct the issues identified in them. Allegations in a civil complaint are allegations. Everything below is described as what has been alleged or reported, because that is what it is.
What happened with Medvi
Medvi is a direct-to-consumer GLP-1 telehealth company that drew enormous attention in early April 2026 after a New York Times profile presented it as a proof of concept for an AI-operated business, with very large revenue figures and a very small headcount. The coverage went wide fast.
What most of the follow-on coverage left out was that on February 20, 2026, the FDA had issued the company a warning letter after reviewing its website and marketing practices. Medvi was not singled out. On March 3, 2026, the FDA issued warning letters to more than thirty telehealth companies in a single action, all concerning marketing of compounded GLP-1 products. The findings in that sweep centered on marketing language that suggested FDA approval or evaluation of compounded products, and on claims about who was compounding what.
Separate press investigations raised questions about the company's affiliate advertising ecosystem, reporting thousands of active ads, some running under apparent fictitious personas with fabricated medical credentials and AI-generated images. The company's founder has said that a portion of its marketing is affiliate-driven and that policies exist to remove non-compliant advertising. The company's own site includes a disclaimer that individuals appearing in advertising may be actors or AI-generated portrayals.
There have also been questions raised about the status of the company's LegitScript certification, which matters more than it sounds like it should. I will come back to that.
What is alleged in the Zealthy matter
Zealthy is at a different stage entirely. The Department of Justice, acting on behalf of the FTC, has been litigating against the company and its founder since 2024, and filed an amended complaint in 2026. In April 2026, the government moved for an immediate asset freeze and receivership.
The allegations in the government's filings fall into four buckets, and each one is a lesson.
On prescribing, the government alleges that prescriptions were routinely ordered by non-clinicians, including foreign call center contractors, and that the names and NPI numbers of physicians were used to order thousands of prescriptions for patients those physicians never treated, in some cases without the physician's knowledge and in some cases after the physician was no longer working with the company.
On billing, the government alleges consumers were charged without consent, billing continued after cancellation, and customer support representatives were instructed not to use the word cancel unless the customer said it first. Those claims run under the FTC Act and the Restore Online Shoppers' Confidence Act.
On payments, the government alleges that after the company lost its LegitScript certification in January 2025, having failed to disclose the pending federal lawsuit, advertising platforms and payment processors terminated their relationships, and the company responded by forming shell entities to continue processing payments under different names.
On financial reporting, the government alleges executives used company cards to purchase their own subscriptions, diluting the chargeback rate presented to banks and lenders.
The five lessons
Marketing is a regulated clinical surface, and affiliates do not create distance. The most common enforcement entry point in telehealth right now is not the clinical encounter. It is the advertisement. If someone is running ads for your service, those ads are your compliance exposure whether the person writing them is your employee, an agency, or an affiliate you have never spoken to. An affiliate program without active monitoring, documented takedown procedures, and a record of enforcement is not a compliance program, it is a hope. And portraying a person as a licensed clinician in an ad when no such clinician exists is not a gray area in any state.
Prescriber identity is an asset you have to control. Every practice should be able to answer, on demand, who ordered each prescription, under whose credentials, and on what clinical basis. That means access controls in the EMR tied to individual identity, no shared logins, immediate credential revocation at offboarding, and a periodic audit that reconciles prescriptions written under each NPI against that clinician's actual encounters. If a clinician leaves and their credentials are still capable of generating orders next month, you have a serious problem that no contract solves.
Cancellation and billing flows are where consumer protection law reaches you. ROSCA and the FTC Act do not care that you are a health care company. Negative option enrollment requires clear disclosure, express informed consent, and a simple cancellation mechanism. If your support team is trained to redirect cancellation requests, you have built the exact thing regulators look for. I wrote separately about the FTC's case against Hims and Hers, which was brought under the same authorities rather than under telehealth law, and the pattern repeats for a reason.
Certifications are load-bearing infrastructure, and they come with disclosure duties. LegitScript certification is what keeps merchant accounts open with major payment processors and keeps ads running on the large platforms. Losing it does not just create a compliance problem, it creates an immediate revenue problem, which is precisely the pressure that produces bad decisions. And certification carries ongoing disclosure obligations. In the Zealthy matter the alleged trigger for decertification was not the underlying conduct but the failure to disclose the litigation. If you hold a certification, read what you agreed to report and build a calendar around it.
Outsourcing the clinical layer does not outsource accountability. Both of these situations involve third-party clinical infrastructure to some degree, and that is worth sitting with, because a large share of the market runs on exactly that model. Contracting your clinical staffing to a vendor moves the work. It does not move the responsibility for what is prescribed under your brand to your patients. If you cannot describe your own clinical protocols, name the clinicians treating your patients, and produce the oversight record, you do not have a clinical program, you have a referral arrangement with a marketing layer on top.
The audit worth running this quarter
Pull a sample of prescriptions from the last ninety days and confirm that the ordering clinician was actively credentialed, actually conducted the encounter, and documented the clinical basis. Pull every active ad running for your brand, including affiliate ads, and check the claims and the people depicted. Walk through your own cancellation flow as a customer and time it. Confirm every certification you hold is current and list what each one requires you to disclose. Reconcile your EMR user list against your current roster. Confirm every vendor touching patient data has a business associate agreement.
None of that takes a week. All of it is cheaper than the alternative.
How I help
At Camino Strategy Group we build the compliance and operational infrastructure underneath telehealth companies: PC/MSO structure, clinical oversight documentation, marketing and advertising review, prescriber credentialing and access controls, and the quarterly attestation cadence that produces a record when someone eventually asks for one. If you are growing quickly and are not sure your compliance layer grew with you, reach out and we will walk you through it.
References
- FDA warning letters concerning marketing of compounded GLP-1 products, February and March 2026
- FDA Regulatory Procedures Manual (describing warning letters as informal and advisory)
- United States v. Zealthy, Inc. and Kyle Robertson (FTC referral; amended complaint 2026; motion for asset freeze and receivership, April 2026)
- Restore Online Shoppers' Confidence Act, 15 U.S.C. 8401 et seq.
- Federal Trade Commission Act, Section 5, 15 U.S.C. 45
- LegitScript certification standards: https://www.legitscript.com/
This article describes allegations, warning letters, and press reporting. Warning letters are advisory and are not findings of violation. Allegations in pending litigation have not been proven, and nothing here should be read as a statement about the merits.