Rise in Use of Mental Health Apps Raises New Policy Issues

Digital behavioral health services such as mental health apps became increasingly popular especially during the pandemic, according to industry reports, when in-person health care visits were avoided to prevent the spread of COVID-19. Approximately 40% of Americans reported symptoms of depression and anxiety at the beginning of the pandemic, and there was an increased need for mental health support for consumers to address these symptoms. Additionally, industry reports found that funding of behavioral health startup companies exploded during the pandemic with $588 million invested in the first half of 2020, many funded by private equity firms.

During the PHE, many federal and state healthcare requirements were “waived” in an attempt to expand access to digital behavioral health services such as mental health apps. This Issue Brief looks at how federal PHE waivers may have expanded use of mental health apps and some of the policy issues concerning the continued use and promotion of mental health apps post-PHE.

What Are Mental Health Apps?

Mental health apps are mobile technology applications that offer clinical and non-clinical methods of offering mental health support. These vary in the scope of services they offer to consumers, from clinical services offered by a licensed behavioral health provider to treat specific conditions to services aimed at promoting general health and wellness. Users typically download an app through an app store available on smartphones and are then prompted to review and agree to an app’s privacy and technology policies prior to accessing other features on the app (e.g., intake questionnaires on symptoms and personalized treatment plans). The spectrum of available apps includes the following, with some apps including a combination of these features:

• Medical Devices: Apps defined as computerized behavioral therapy devices subject to approval by the FDA (e.g., ReSET) offer a clinician-administered version of virtual behavioral therapy that patients can utilize outside of synchronous, live sessions with their provider. These apps can be found on smartphone devices, although they may be difficult or nearly impossible to utilize without a prescription.
• Mental health apps that include telehealth features: Some apps such as TalkSpace and multi-service platforms such as Lyra offer therapy sessions with a licensed provider via live video or audio communications. Telehealth apps can also offer patients means to receive consultations and prescription drugs with a provider licensed to prescribe psychiatric medications. Telehealth apps might also include other general wellness features and are typically accessible through app stores on smartphone devices.
• Mental health “wellness” products: Other apps (e.g., Happify | Get Started, PTSD Coach App) assist consumers with general wellness (e.g., stress relief) via use of journaling tools, motivational quotes, chatbot therapy, or meditation exercises, as well as offer non-medical treatments to assist consumers in managing symptoms associated with a specific mental health condition. Some of these apps may be developed by licensed providers and offer clinician-endorsed treatments, but the line between what is actual medical care and what is non-medical care is not always clear. There are a number of general wellness apps that claim to offer medical strategies to help with certain mental health disorders, but the apps themselves might not offer treatments based on evidence. One study from 2017 found that none of the most popular apps rated highly by consumers for treating anxiety related symptoms were evidence-based treatments. On the other hand, some apps contain mental health tools and practices that have been developed or supported by licensed providers. Even these apps might contain disclaimers stating that usage of the app does not replace a consumer seeking medical care from a licensed behavioral provider, which makes it difficult for a consumer to determine if they are receiving medical treatment or not via these apps.

A consumer might be introduced to a mental health app in a variety of ways including through their health insurance coverage provider or directly from their employer separate from their health insurance. Employers or health insurers, for instance, might pay a small per member per month fee to a behavioral health vendor to make an app available to their employees, allowing them to receive care or an assessment of their mental health needs. Low or no cost direct-to-consumer options are also widely available and are often marketed to younger audiences via social media.

Federal COVID Waivers Drive Change in Guidance on Mental Health Apps

During the pandemic, federal agencies suspended some policies to increase access to digital behavioral health services. This may have facilitated the use of mental health apps as a vehicle to access these services. Multiple federal COVID waivers have played a role alongside state law changes that temporarily allowed health care providers to practice across state lines (specifically, allowing a provider in one state to provide telehealth to a patient in another state). Temporary changes in Medicare and Medicaid required coverage for telehealth services. These changes may have also resulted in more utilization of telehealth delivered through mental health apps across the health system, as more providers expanded their capabilities to provide telehealth for all of their patients, regardless of whether the patient had public or private health insurance coverage. Some flexibilities for Medicare have been made permanent through federal legislation and regulation or extended past the end of the PHE on May 11, 2023, while some states have made telehealth flexibilities permanent for those with Medicaid coverage.

For the private sector, waivers focused on promoting the use of telehealth in high deductible health plans (HDHP) and offering “stand alone” telehealth may have played a role to encourage the use of telehealth delivered via mental health apps. The Coronavirus, Aid, Relief, and Economic Security Act (CARES) allowed coverage of telehealth services before the deductible is met for Health Savings Account (HSA) qualifying HDHPs. Congress extended this pre-deductible coverage of HSA telehealth services under the Consolidated Appropriations Act of 2023 until December 2024. Additionally, in FAQ guidance (Q14), the federal government allowed large employers (generally those with 50 or more employees) to offer “stand-alone” telehealth coverage to employees without having to meet certain Affordable Care Act (ACA) and Employee Retirement Income Security Act of 1974 (ERISA) legal requirements for the duration of the PHE. This was available to employees who are not eligible for benefits under their employer’s health plan and continues until the end of the employer’s current plan year (for example, until December 31, 2023 for a calendar year plan).

Other federal waivers also may have created incentives for the use of mental health apps among consumers and providers:

• Privacy and security protections for telehealth and other remote communications. Prior to the pandemic, health care providers were required to ensure that audio-video technology utilized during telehealth sessions and any third-party apps administered by a clinician for treatment or communication purposes were HIPAA-compliant. In 2020, the US Department of Health and Human Services exercised its enforcement discretion by allowing providers to utilize audio and video technology without facing penalties for non-compliance with HIPAA’s privacy and security standards. Suspending these requirements gave providers a wider range of telecommunication tools to choose from, including use of popular apps such as Apple’s Facetime to conduct telehealth visits as well as wellness coaching.
• FDA protocols for approving computerized behavioral therapy devices. Prior to the pandemic, the FDA required developers of these devices to meet certain requirements to show that the device was safe, effective, and comparable with other products on the market. All of these requirements were loosened during the PHE and will be reinstated in November 2023. Even before the pandemic, the FDA took a less active role in regulating general wellness devices or software that may be classified as a medical device but that the FDA determined pose a low risk to consumers. In addition, due to changes in the law in 2016, the FDA’s authority to assess patient safety risks for some of these products was limited. As a result, these products did not and will not for the foreseeable future have to abide by FDA requirements post-PHE.
• Standards for prescribing of controlled substances via telehealth. Prior to the PHE, federal law generally required providers to have an in-person medical evaluation before a prescription for controlled substances was given. This includes, for example, certain medications used to treat Attention Deficit Hyperactivity Disorder (ADHD) such as Adderall, as well as buprenorphine used to treat opioid use disorder. Many of these standards were waived during the PHE by the Drug Enforcement Administration (DEA), an agency that is part of the U.S. Department of Justice, allowing providers to use telehealth (video or audio only mechanisms) to prescribe these medications, including through telehealth apps.

What to Watch Now That the PHE is Over

Before the PHE ended on May 11, some stakeholders and consumers expressed interest in making some waivers permanent, and efforts are underway to extend some of these waivers so that patients can continue to easily use digital behavioral health tools often employed via use of mental health apps permanently, or at least until the impact of the PHE waiver is evaluated. The end of the PHE now shifts the policy focus in digital health solutions to, in some cases, extending the COVID waiver policy in some areas, and in other areas has brought new government scrutiny on health policy concerns such as privacy and security of mental health apps and access to prescription drugs via telehealth.

Employer Plan Telehealth Flexibilities

Promoting easier access through virtual behavioral health was seen early on in the pandemic as a way to not only prevent the spread of COVID, but also address growing behavioral health care needs for those with employer coverage. There are proposals to make pre-deductible coverage of telehealth services for HDHPs used in conjunction with health savings accounts permanent. For example, the Telehealth Expansion Act, was introduced this year. Also, some members of Congress have proposed making stand-alone telehealth coverage permanent, allowing employers to make it available to all employees (including those eligible for their employer’s health plan) in the Telehealth Benefit Expansion for Workers Act, largely exempting the coverage from regulatory oversight. Going forward stakeholders will likely address ways to expand access to virtual behavioral health beyond just those with health savings accounts, and address design alternatives for employer coverage that incorporate telehealth as just one part of a broader set of tools to enhance coverage for the continuum of behavioral health care.

Access to Controlled Medications

The PHE changes gave patients easier access to psychiatric medications via prescribing through telehealth. However, more unrestricted access may have contributed to a shortage in prescription drugs such as Adderall. The percentage of stimulants prescribed via telehealth rose from less than two percent prior to the pandemic, up to 40% in 2022. Originally, the DEA proposed in two separate regulations reinstating some protocols for controlled substances, including mandating an in-person visit, in certain circumstances before a provider can give prescriptions. Although some speculate this might help resolve the shortage issue, reinstating this requirement could have potentially caused gaps in coverage for people who receive medication via telehealth platforms due to geographic restrictions, provider shortages, or other barriers that might prevent them from seeking in-person care. Just before the end of the PHE, the DEA issued a temporary rule that will allow virtual prescribing of controlled substances to continue until November 2024, giving providers and consumers time to adjust and regulators a chance to evaluate policy options.

Privacy Risks

Licensed providers and health plans who want to continue to use telehealth delivered via mental health apps after the PHE ends are expected to use telecommunication technology that meets HIPAA specifications. There is no checklist for what defines “HIPAA compliant technology”, however, HIPAA-covered entities are required to conduct a risk assessment of their telecommunication platforms and ensure that key risks are addressed. Some examples of the types of security protections they might address in their risk assessment include encryptions used to protect patients’ personal health data, login requirements, and verification processes used to ensure only verified users have access to the platform. Recent guidance gave providers an additional 90 days after the end of the PHE (August 9, 2023) to comply. Even with these HIPAA protections, there are growing concerns that mental health apps are being used to access sensitive health information that is then provided or sold to third parties for marketing purposes. HHS recently issued a Bulletin on guidelines HIPAA covered entities must follow when using online tracking technology. Additionally, HHS is currently investigating Cerebral, a mental health platform that offers online therapy and assessments, for selling patient data to third party advertisers via use of online tracking technologies.

HIPAA’s guidance and HHS’ enforcement powers only reach so far when it comes to mental health apps. Unless the entity offering a mental health app is considered a HIPAA-covered entity (typically a health provider, plan or insurer) or is a business associate of one of these entities, mental health apps do not have to follow federal HIPAA privacy, security and breach notice rules. HIPAA generally does not cover general wellness apps or even apps that are considered medical devices if they are not connected with a HIPAA-covered entity. Outside of HIPAA, app users’ data are often at the mercy of an app’s privacy policies, which could be written in convoluted language that a consumer may find difficult to understand or are not read by consumers at all.

Although non-HIPAA covered apps and telehealth vendors that misrepresent or do not abide by their privacy policies or mishandle patient data would not face penalties under HIPAA’s guidelines, they could face legal repercussions from the Federal Trade Commission (FTC), a federal agency that enforces federal laws that prohibit “unfair and deceptive” practices that affect commerce and oversee certain consumer protection laws. The FTC has recently announced new enforcement activity related to mishandling of patient data. For example, BetterHelp (a subsidiary of Teledoc), a popular mental health app, will have to pay $7.8 million in restitution as a result of allegedly selling patient data to third party advertisers without their permission and misrepresenting their privacy practices. Additionally, the FTC has proposed to update the Health Breach Notification Rule, which would require organizations that manage digital health apps and consumers’ personal records to inform consumers and the FTC when their personal data has been compromised. This proposal is controversial, as the FTC has claimed that it has authority to regulate all health apps that are not covered by HIPAA.

Congress is also weighing in on how data is used within mental health apps. Several senators have questioned leaders of major telehealth companies on their data sharing practices and some have introduced the Upholding Protections for Health and Online Location Data (UPHOLD) Privacy Act that would increase protection of personal health data stored in apps.

Looking Forward

Mental health apps, as well as other digital health solutions, have the potential to expand access to care, and for this reason certain rules and standards were waived or modified during the pandemic, which was also a time of heightened mental health needs. Coming out of the urgency of the pandemic, there is now an opportunity to evaluate the benefits and risks of these tools and consider what oversight might be appropriate. We can expect much more attention focused on the quality and clinical effectiveness of these tools, as well as who will pay for them.