A state attorney general needs no payer contract or federal statute to open a file on a telehealth company. State consumer protection law, the same authority used against any business that advertises and bills consumers, reaches advertising claims, subscription terms, and cancellation design on its own. A subpoena or civil investigative demand under that authority can arrive before any federal agency looks at the same practices, and it tests a different set of facts than a payer audit does.
Consumer Protection Authority, Not Payer Rules
Every state attorney general holds authority under its own unfair and deceptive acts and practices law, analogous in some ways to the FTC Act. That authority runs independent of CMS, a PBM, or any payer contract, so a state investigation can open even where no claim has reached Medicare or Medicaid. This differs from a payer audit built around a recoupment or a Unified Program Integrity Contractor (UPIC) review, and from a federal subpoena built around the False Claims Act or the Anti-Kickback Statute.
What a Subpoena or Civil Investigative Demand Typically Requests
A state attorney general's subpoena or civil investigative demand in a telehealth matter typically asks for the company's advertising and the substantiation behind each claim in it: efficacy claims, satisfaction guarantees, and any statement that a clinician reviewed each patient before treatment. It typically asks for the subscription and cancellation flow as actually built down to the timing between a renewal charge and the deadline to stop it.
It also typically asks for clinician oversight records showing who reviewed which intake form and when, and for prescribing data the company generated. Clinician oversight gaps can separately raise a corporate-practice-of-medicine question; see Telehealth Companies and the Corporate Practice of Medicine. Where prescribing volume concentrates among out-of-state clinicians, which state's rules actually governed becomes its own question; see Prescribing Across State Lines: Which State's Rules Apply. A demand usually closes with the complaints the company received directly from consumers.
A state attorney general's civil investigative demand does not wait for a federal agency to act first. It tests the advertising and billing a telehealth company actually built, not the claim it submitted to a payer.
First Decisions: Scope, Preservation, and Who Speaks for the Company
The first decisions on a civil investigative demand shape what follows. A demand drafted for a multi-state consumer business can sweep in records far beyond what the inquiry requires, and negotiating its scope early narrows the production before collection begins; see Civil Investigative Demands: Negotiating Scope. Preservation has to reach beyond email to app analytics, the cancellation-flow version history, call-center recordings, and the marketing copy live on the dates at issue. A company that redesigns its cancellation flow after the inquiry opens, without preserving the earlier version, destroys the record of what consumers actually saw. The company also needs one person authorized to speak for it, since marketing, customer service, and compliance often give different accounts of the same practice.
Coordination Between States
A telehealth company rarely hears from only one attorney general. States coordinate through multistate channels, sharing one set of document requests across participating offices and often negotiating a single resolution rather than a separate settlement in each state. Eleven states reached a coordinated 2023 settlement with the telehealth company now known as Visibly, formerly Opternative, over marketing and safety claims for an online vision test. The Federal Trade Commission, joined by Utah and California, filed a single 2026 lawsuit against Hims & Hers Health over subscription billing and the sharing of consumer health data with advertisers; see DTC Telehealth Models and Federal Enforcement.
How These Matters Usually Resolve
A state consumer protection investigation of a telehealth company can resolve through a negotiated settlement combining required disclosures, a corrected cancellation flow, restitution to named consumers, and a payment to the state. New York's attorney general recovered $4.8 million for more than 28,000 consumers in December 2024 after a telehealth company that provided dental services kept billing them after it had stopped providing services. Litigation is also a real outcome: the FTC and two states sued Hims & Hers in federal court in July 2026 rather than settling.
Why Early Legal Counsel Is Critical
It is critical that telehealth companies promptly retain experienced healthcare defense counsel upon receiving a subpoena, civil investigative demand, or other inquiry from a state attorney general. Early legal intervention can protect the company's rights, ensure an appropriate response to the demand, avoid inadvertent admissions, preserve relevant defenses, and allow counsel to communicate with the investigating office on the company's behalf. Delaying legal representation can significantly affect the outcome of a matter and expose the company to unnecessary risk.
How Health Law Alliance Can Help
Health Law Alliance has represented 2,500+ clients nationwide. If your company has received an inquiry from a state attorney general, contact Health Law Alliance's telehealth defense attorneys for a free, confidential consultation before you respond.
