The Department of Justice has secured prison sentences against Done Global Inc. founder Ruthia He and former clinical president David Brody in a telehealth fraud case that turns a digital health growth model into a boardroom compliance warning.
Ruthia He was sentenced on July 7, 2026 to six years in prison and fined $1 million over what prosecutors described as a scheme using Done’s technology platform, clinical protocols and subscription model to distribute more than 37 million Adderall pills, defraud insurers of more than $12 million and obstruct the federal investigation.
Brody was sentenced separately to two years in prison and fined $1 million. The case gives prosecutors, regulators and in-house legal teams a concrete example of how platform design, marketing spend and clinician incentives can become evidence in a criminal case, not merely background to a compliance review.
Practitioners now face a harder question over how federal prosecutors will read a company’s internal systems. The Justice Department said Done spent more than $40 million on social media advertising, promoted easy access to ADHD medication and used auto-refill processes that reduced clinical review after an initial diagnosis.
Prosecutors said some clinicians were paid up to $60,000 a month while signing prescriptions rapidly, and that Brody personally wrote prescriptions for 394,324 Schedule II stimulant pills for 6,559 Done members without evaluating them. Those facts will be uncomfortable reading for counsel advising telehealth platforms, private equity sponsors, health-tech founders and digital pharmacy partners.
The Northern District of California prosecution also shows why compliance evidence cannot be treated as a presentation exercise after a regulator, pharmacy chain or insurer raises concern. According to the Department of Justice, He and Brody were convicted in November 2025 of conspiracy to distribute controlled substances, distribution of controlled substances and conspiracy to commit health care fraud.
He was also convicted of conspiracy to obstruct justice. Prosecutors said the investigation involved the DEA, HHS-OIG, Homeland Security Investigations and IRS Criminal Investigation, with the case prosecuted by the Justice Department’s Health Care Fraud Unit and the U.S. Attorney’s Office for the Northern District of California.
In-house legal teams should treat the sentencing as a sign that telemedicine risk now reaches well beyond prescribing policy. The record described by prosecutors included clinical protocols, advertising decisions, prior authorisation submissions, pharmacy blocks, encrypted messaging, disappearing messages, overseas operations and alleged asset movements.
Legal teams reviewing digital health products should expect investigators to test whether growth targets, product features and reimbursement practices were built around medical necessity or volume.
The sentencing also gives law firm management a practical reason to pull health care fraud, controlled-substances compliance, data retention, employment incentives, investor disclosure and crisis response advice onto the same timetable once prosecutors begin treating a technology platform as the mechanism of the offence.
The Department of Justice, DEA and HHS-OIG now give digital health advisers a clear benchmark for testing whether telehealth governance can withstand a criminal investigation.