You might have heard about the recent takedown of online telehealth ADHD prescribing platform Done, whose founders were arrested on criminal charges you can read about here.

  • On June 13, Ruthia He and David Brody were arrested for allegedly distributing Adderall illegally and committing healthcare fraud. They exploited telemedicine during the pandemic to distribute over 40 million pills and earned over $100 million in doing so. The scheme involved false claims to insurers and obstructing justice. If convicted, they face up to 20 years in prison.

I’ve unexpectedly been in conversation with multiple sources close to Done, and I have the full inside story of what went wrong (spoiler: a lot) and the latest ongoing developments internally.

So with that backdrop, today, we’re diving into how one founder – Ruthia He – exploited well-meaning people, created a culture of gaslighting and deceit, and built one of the worst-acting pill mill enterprises to date. Done is a terrible example of exploiting patients, providers, and even internal employees – for pure profit.

It’s as if Cerebral and Theranos had a baby, and out came Ruthia He with Done. Oh, and then she sent your patient data to China.

So, my hope with this story – on behalf of the sources I talked to – is to make sure Ruthia He and anyone else involved is held to account.

Let’s dive in.

“The first person who goes to jail because of this gets a Tesla.” Ruthia He announced.

The Done founder was in deep debate with her team of early employees. Many were pushing back on Done’s clinical protocols, like wanting to offer longer appointment times for initial patient evaluations. They thought 30 minutes plus an initial, 1-minute intake form wasn’t enough to make a full diagnosis for ADHD. But subtly, even then, the team knew Ruthia’s crass quip meant the topic was no longer open to debate.

Fifteen or so others on the early Done team laughed uncomfortably, as if reassurance of getting a $40,000 Model 3 were worth the price of incarceration. It had to be a joke…right? Besides, they were all there to change healthcare during the pandemic, and wanted to get accessible medications to patients during a time of crisis.

They didn’t know it at the time, but Ruthia having the final word – on all aspects of the business – would remain as a common theme in an otherwise toxic and volatile environment. What Ruthia says, goes. And if you disagree, you’re gone. Many learned this cold truth the hard way.

Whether the issue was clinical or operational was irrelevant for Ruthia. It didn’t matter if you were a board-certified physician bringing up a valid concern around patient safety, or a Day 1 employee on the ops side asking for a functional HR software. Ruthia controlled everything.

And with that full control, this greed and pursuit of profit dictated every decision she made ultimately led to creating a fraudulent $100M pill mill and of course, resulted in her arrest a few short days ago.

I suppose she and Dr. Brody will have to fight over the Tesla.

The Origins of a Great Business Opportunity gone Sour

If there’s anything you take away from this article, it’s the following:

  • Done is a pill mill
  • Ruthia He was in control of everything, siloed teams from one another, and created a culture of deceit. She used the company – and therefore patients – as a vehicle for personal wealth creation
  • As a corporate entity, Done forced providers’ hands on countless clinical decisions
  • Done’s Chinese team blatantly violated HIPAA by sharing patient health information via WeChat and manually reviewing claims data
  • Done conducted a number of other illegal healthcare activities knowingly, and pushed out anyone who sounded the alarm on harmful patient decisions

So how’d we get here? Let’s back up for just a second.

As with most dynamics in healthcare and the economy in 2024, the pandemic had a massive effect on the mental health market. By loosening up several regulations around telehealth prescribing of controlled substances and provider state licensure requirements, vast business opportunities opened up in the world of online prescribing.

Many players like Ro and Hims, or Amazon Clinic, are focused on a variety of conditions (most recently GLP-1s). But the biggest boom happened in the world of mental health with strong tailwinds: a big societal push in destigmatizing mental health conditions and a huge (and growing) base of individuals in need of access to mental health coincided with the largest de-regulatory period in healthcare ever. As a result, investors in the free money, low interest rate environment couldn’t throw money fast enough into the space.

Done and Cerebral were two of many telemental health startups formed during this pivotal time.

The business was a slam dunk. Spend marketing dollars on Tik Tok, Instagram, and elsewhere with ads exuding calmness and trust. Acquire patients. Incentivize ADHD diagnoses and prescriptions to create sticky patient relationships and boost long-term customer value. And repeat.

Below is a timeline of major events for both Done and Cerebral during and post-pandemic:

But where much of Done’s early team (and I imagine Cerebral’s, too) saw the firm as a huge opportunity to expand access to patients during a time of crisis and turmoil, Ruthia He saw a market opportunity – and a loophole – to generate some serious cash flow at patient expense.

How Done Pushed Profits over Patients

When hearing about everything Done…did…it’s a perfect example of how a company can set up perverse financial incentives to maximize business results over everything else.

Done’s flywheel was simple, yet ruthlessly effective: get new patients in the door, start them on the monthly subscription fee, and refill the prescriptions with as little follow-up from clinicians as possible. Follow-up appointments were considered an opportunity cost for clinician time, since that time could be better spent on new patients, or refilling scripts.

Here were just a few examples of Done’s conduct (perpetuated by Ruthia and passed through via Dr. Brody) over the years:

30 minutes, no follow-ups please. Done reimbursed clinicians for an initial patient visit of just 30 minutes – claiming that the intake form (advertised to consumers to take ~1 minute) was sufficient for diagnosis, stating the average patient time spent with the clinician was below 30 minutes. Done also did not reimburse for follow-up visits. Instead, Done paid clinicians at 1/14th of an hourly rate per patient on the panel

Working around state oversight to maximize panel sizes. Done had an interesting tactic for getting around state pharmacy reviews. The firm held a clinician to a 500 patient panel size in certain states to ensure the clinician was able to continue prescribing legally / wasn’t flagged by the pharmacies. Once they reached that threshold, Done would license the clinician in a new state and repeat the process until that provider had ~1,500 patients across 3 states.

Clinical Coaching for ‘bad apples.’ For any clinician who would push back or for any providers who were under an unspoken ‘prescribe-to-visit’ threshold, Done would send these individuals to coaching. Providers who held a low patient retention rate or scores (’score’ characterized by my sources as a sort of internal clinician NPS)

Pharmacy Workarounds. After the first WSJ investigative report led to Walgreens and CVS ceasing prescription fills for Done, Done would target independent pharmacies using services including RX Outreach and Scriptx. In any market, Done representatives would call up to 15+ pharmacies in the area to find a pharmacy willing to fill the prescription

Implementing an ‘urgent refills’ feature internally. Done created a new ‘Urgent Refills’ protocol, meaning once 24 hours has passed since a patient requested a refill, the request would move to that ‘urgent refill’ status. Since Done reimburses providers on refills with no regard for follow-up visits, any clinician could then fulfill the refill request and get paid for doing so. Done also docked pay for the patient’s original provider if another provider had to step in to fill that urgent request. Opportunity costs, am I right?

App Nudges. On the consumer-facing app side, Done developed nudge features allowing a patient to to click a button to request an ADHD refill without any sort of follow-up or clinical safety protocol. Providers were essentially dis-incentivized to conduct follow-up visits as that would take away time from the opportunity of getting paid more to see new patients.

Based on Done’s internal reports, fewer than 1% of patients were receiving follow-up visits per month.

Done’s Chinese Ties Led to Blatant HIPAA Violations

Extreme Patient Data Breaches to mainland China. Blatant HIPAA violations.

You thought we were done with the bad stuff, but it gets worse. As it turns out, while the U.S. operations team departed from the firm, Ruthia was replacing these individuals with Chinese counterparts. Many operating documents are written in Mandarin. And this Chinese-based team of around 35-40 individuals have been blatantly violating U.S. law around patient data sharing regulations.

While Done is headquartered in San Francisco, the pill mill employs 15 or fewer U.S. workers. (the number used to be 40+ U.S. based workers, but the company has a culture for firing anyone who doesn’t say “yes”). The rest – around 35+ on the operations and analytics side – are based in China. This includes Done’s head of Legal, who is in fact a legal consultant based in China and according to sources, isn’t licensed to practice law in the U.S. Done has no U.S.-based internal counsel. When attrition occurs, any U.S.-based worker is replaced with a Chinese counterpart.

These Chinese ‘consultants’ (as Done characterized them) were using China’s popular messaging service WeChat to openly send and share EHR claims data with one another – patient health information from the U.S.

Chinese-based analytics teams would then manually comb individual patient records to look for trends or insights to exploit in order to tighten up Done’s ‘flywheel.’ I think we can all draw the logical conclusion around Chinese individuals using a Chinese-run messaging app and whether government officials gain access to that information, too.

While I’m writing this, according to my sources, the Chinese-based team is actively logged into Ruthia He’s account, sending and carrying out her directives, and deleting potentially damaging files.

In real time, Done is attempting to delete its paper trail.

Done’s Brazen Disregard for Healthcare Law and Regulatory Bodies

Blatantly disregarding and actively circumventing U.S. Healthcare Law. Over the years, Done held a brazen disregard and disdain for both regulatory bodies (FDA regulations around ADHD prescribing levels, for instance) and attempting to pay for referrals.

Along with patient data sharing violations, my sources indicate Done engaged in the following behavior:

  • Done would purposefully target smaller PCPs within practices to attempt to induce referrals into its service (PCPs would shut down courting efforts from Done, and it’s not clear if Done actually ever paid a clinician for referrals to its service).
  • Dr. Brody at one point, in a reviewed Slack message, exclaimed “f**k the FDA guidelines” – declaring the FDA was a biased political body. Completely brushing off the FDA, Dr. Brody and Done created their own harm inducing guidelines around what they considered to be proper patient care and levels of ADHD meds. Consequently, Done prescribed dosages in certain circumstances orders of magnitude above FDA guidelines
    • “The FDA is obviously not god [sic], and intimidating though they may possibly be, I will take the risk of saying that their promulgations sometimes simply don’t make sense.”

A Culture of Secrecy, Gaslighting, and Deception

I couldn’t help but think of Theranos, and how siloed and compartmentalized each team was, when hearing about Done’s culture and intercompany communication. Ruthia He (and Dr. Brody, by extension) created a culture of fear, gaslighting, and deception. No team at Done (well, I can’t speak for the Chinese team!) truly knew what was going on. When the Wall Street Journal and federal investigations began, Ruthia told the team internally the investigation had concluded, and the result was a simple monetary punitive fine for Done. When the Done team heard news Ruthia and Dr. Brody had been arrested, they were completely shocked and blindsided.

Adding to this, if it’s not clear enough already, Done as a corporation inserted itself into clinical decision making. Internal teams would witness Ruthia strong-arming clinicians – acting antagonistic toward any healthcare provider internally who would push back on Done’s prescribing tactics or other ill-thought measures created to maximize profits over patients. To nobody’s surprise, those clinicians would find the exit door either by choice or by force.

In one instance, a provider was caught by the state of Texas for supervising a number of nurse practitioners writing a couple thousand prescriptions of stimulants a month, and was asked to come before the medical board to potentially strip his license. When this provider asked Done for legal fees for representation purposes, Ruthia He offered to represent the provider in front of the board herself rather than pay the legal fees. Suffice to say that provider sought legal counsel elsewhere.

Turning to the operations side, the U.S. team often raised eyebrows at each other as they received messages related to Done from external channels, which were then deleted at a later date. They noticed mistreatment of contractors and vendors, who would never be paid for services rendered. They were told money was tight when witnessing Done’s Head of HR and U.S.-based legal team being fired. When requesting a meager 4-5% raise to cover inflationary pressure felt by the entire economy, Ruthia flatly denied the request, claiming money was tight. It comes as quite the surprise to most internal employees, then, to see Done had succeeded in generating $100M+ in revenues on the back of 40 million Adderall & other prescriptions.

Most team members working there either had a connection to someone with a serious mental illness, or struggled with mental health themselves. That’s why they were there. Many of the earliest employees did not even see 6-figure salaries, and many of these same employees were let go conveniently right before equity vesting and other bonus dates.

Inside Done’s Turmoil Today

As mentioned, Done’s U.S. team was blindsided by the arrest. Right before it happened, someone deleted the entirety of Done’s email groups. Providers, press, clinical leadership, payroll, HR, media, provider support, and more. You might see online people are trying to reach anyone within Done. The fact of the matter is that nobody internally – outside of China – has any clue what’s going on.

Providers have resigned en masse, leading to the potential for significant patient harm (something the CDC even had to issue a warning about this week).

And finally, nobody is communicating with patients at all. They’re not being told what’s going on, or what’s going to happen, and to me and my sources, it implies that everything going on in the headlines signals the truth.

What can we learn from Done?

Clearly Done is one of the worst actors in healthcare and health tech in 2024, and there’s plenty that we can learn from Ruthia’s misdeeds and exploitation:

De-regulating healthcare is generally good to create a better consumer experience for patients, but loosening up rules comes with consequences.

  • For instance, lots of patients were able to get prescriptions a lot easier and more quickly than traditional methods. When done correctly, this dynamic is great. And even Done and Cerebral provided great, expanded access to patients who needed services. There are plenty of other examples today of telehealth and hybrid tech enabled services companies providing clinically rigorous, responsible care for patients in hard-to-reach areas.
  • But this dynamic also opens the door to bad actors who can and will exploit our healthcare system for pure financial gain, with no regard or empathy for patients. And this is why we can’t have nice things.

Clinical voices need to be the strongest in any healthcare services or tech-enabled services firm, and internal corporate governance needs to reflect this need. It needs to actually hold teeth when clinicians are pushing back on dangerous protocols affecting patient care within a company.

99% of the healthcare industry is working for patient good and access, but the 1% of bad actors actively looking for exploits (hackers, greed) drags the system down.

As for Done’s founders? Let ‘em rot. And I hope Ruthia’s defense collected a retainer up front.

Notes and Resources:

CDC Health Alert Network: Increased availability of fentanyl combined with xylazine.

Blake Madden
Created By
Blake Madden
Join the thousands of healthcare professionals who read Hospitalogy

Subscribe to get expert analysis on healthcare M&A, strategy, finance, and markets.

This field is for validation purposes and should be left unchanged.

No spam. Unsubscribe any time.