Headway, a popular online therapy platform, says it will require clients and providers to undergo biometric scanning, and there’s no way to opt out other than leaving the platform.
On April 3, Headway sent an email to clients informing them of the upcoming requirement: “To make sure Headway stays a safe and reliable place to get care, you'll soon be asked to verify your identity by taking a picture of a valid government-issued photo ID in your portal,” the email said, which a user shared with 404 Media. “As part of this process, you'll also be asked to take a clear photo of your face to confirm your identity. The facial image is never used for anything but identity verification.” The facial scan involves using your devices’ camera and moving your head from side to side.
The email said that the platform was asking clients to verify their identity “proactively” so that they’d have “plenty of time to complete this,” but didn’t specify when identity verification would be required. “We're not asking you to verify because of any specific behaviors or concerns,” Headway said in the email. “It's a requirement for anyone seeking medication management on Headway.”
Headway says identity verification for patients “is rolling out in waves over the coming weeks, starting with patients of prescribers,” but eventually all providers will be required to undergo facial scanning. Providers and clients I spoke to told me they haven’t yet needed to do this step, and the uncertainty of when they’ll be required to hand over their biometric data—and if they don’t, lose access to the platform and their clients or care—is adding to their concern about the process.
Many mental health providers or the practices they work for use Headway to help them get credentialed with insurance companies and process billing and other administrative tasks. Through Headway, providers can be in-network with a much wider variety of insurance plans.
Headway is telling clients in customer support chats and emails that it will use the third-party vendor Persona to verify identities, according to emails viewed by 404 Media. Persona is part of the portfolio of Founder's Fund, Peter Thiel’s investment firm, according to Founder’s Fund’s website. Earlier this year, Discord ended its extremely short-lived contract with Persona, but many other platforms use it, including Doordash, Uber, and Roblox.
In its biometric data policy, Headway states that when processing biometric data, it will “Inform each User in writing of the manner in which the User may opt out of the collection, processing, storage or usage of their Biometric Data.” But last month, 404 Media asked Headway if users can opt out. “No, identity verification is currently a required safety step for patients seeing prescribers as part of our commitment to safe, verified care,” a Headway spokesperson said. “We’ve let patients know they can contact Headway support for a manual review in extenuating circumstances.”
Users and providers haven’t been able to get a straight answer about when this requirement is starting or how opting out works other than not using Headway at all. A customer support person at Headway told one client that they can choose not to undergo identity verification, but if they do, they won’t be able to meet with a prescriber on Headway, according to copies of the chat viewed by 404 Media.
"Do I give up my privacy or do I burn all my progress and then just go to a different company and try and find somebody else, and start over?"
Headway said in an email to providers that sessions “may be auto-cancelled if verification is incomplete,” and “providers in your group will be unable to confirm sessions without completing their own identity verification.”
One client who’s used Headway for several years and sees providers for both medication management and talk therapy told me that “opting out” as Headway defines it isn’t as simple as switching platforms. “It's not just a consumer choice thing,” they said. “Healthcare is a totally different thing. I've talked to my providers, and they're not on any alternative [platforms]. It's possible that your provider is also on some alternative, but that's not the case for me.” Switching providers would mean starting over, finding new providers that could be a good fit and take their insurance, and hoping there’s no lapse in treatment in the meantime.
“It's just not a good situation,” they said. “It’s a rock and a hard place. Do I give up my privacy or do I burn all my progress and then just go to a different company and try and find somebody else, and start over?”
The client I spoke to said they were especially concerned in light of Health Secretary Robert F. Kennedy Jr.’s intentions to link databases of autism patients using federal health insurance programs including Medicare and Medicaid. Kennedy has also said the Center for Disease Control is “finally confronting the long-taboo question of whether SSRIs and other psychoactive drugs contribute to mass violence,” and has recently targeted antidepressants, which psychiatrists say is a dangerous oversimplification of millions of Americans’ experiences with mental health and medications.
Headway is also informing providers—whether they prescribe medication or not—that facial scanning and identity verification is coming soon, and is coaching them on how to talk to clients who are wary of handing over their biometric data, to convince them to go through with it.
The platform is also telling providers who haven’t gone through identity verification themselves that their payments might be restricted. “We’re reaching out because our payment processor let us know that your account is missing information that will soon impact and restrict your payouts from Headway,” an email Headway sent to one provider said. It directed them to use a link to update their payment information to become verified, but the link in the email didn’t go to a verification process, the provider who received it told me. The platform hasn’t informed providers or patients about when identity verification or facial scans will start being required.
Headway did not respond to my questions about when specific groups would be required to undergo identity verification or if verification status will affect provider’s payments.
A spokesperson for Headway told 404 Media: “Confirming that Headway has recently started to enforce identity verification to our network. To clarify—today, we require identity verification for patients receiving prescriptions through Headway, as prescribers have a heightened obligation to confirm they are treating a verified patient before writing a prescription, and this process helps them meet that standard. It also protects patients by ensuring that prescriptions, medical records, and billing are tied to the right person.”
“Identity verification is currently a required safety step for patients seeing prescribers as part of our commitment to safe, verified care. We’ve let patients know they can contact Headway support for a manual review in extenuating circumstances,” the spokesperson added.
The Headway spokesperson said identity verification “is run through a HIPAA-compliant, SOC 2-certified platform,” and identity data “is stored in a centralized, encrypted, access-controlled record with detailed audit logs.”
Headway’s site says the new requirements are “similar to showing your ID at the front desk of a doctor's office.” But facial scanning and biometric data isn’t the same as presenting identification at the doctor or at a store. Privacy experts agree that online identity verification systems like those now required to access adult content and age-restricted material in many places around the world pose new and different risks, including the possibility of breaches, third-party sellers, and invasive tracking. Headway says it won’t use this data for marketing, and that it will protect it from hacks. Users are forced to take the platform’s word for it.
The Headway spokesperson claimed that the response from users to the new requirements has been “mostly positive.” But providers I spoke to said they’re concerned and considering leaving the platform because of it. One provider I spoke to, who is a psychotherapist and doesn’t prescribe medication but received emails from Headway informing them of the impending changes anyway, told me they feel “frankly afraid” because there’s no option to opt-out other than severing care, especially for patients. “When I initially got the email indicating that they would be rolling out biometric scanning, my stomach dropped,” they said. “The email indicated that they would start with prescribers and their clients and then move onto everyone else. My mind started racing, what are the ethics around this? Where is this data going? The only time I've had to do a biometric scan is to do something for the IRS. This is not common practice in my field.”
They said they’re not sure yet if they’ll stay on Headway. “It feels values-inconsistent to continue to work them for a variety of reasons, but this perhaps is the nail in the coffin for me,” they said. “In some ways I don't have a choice because I am not independently credentialed with all of the plans that I am credentialed with through Headway. Meaning, I cannot see those clients outside of Headway. I do not (and will not) want to abandon those clients.”
Another provider I spoke to said that although there’s a lot of conversation happening among providers about leaving the platform, it’s easier said than done. “So many of us need this for our income, so it's a real sacrifice” to stop using Headway at this point, they said. “That's kind of the dilemma people are in.”
Joseph Cox contributed reporting.
