Done's $100M Pill Mill: The First Telehealth Criminal Trial That Could Redefine Digital Prescribing

How a pandemic loophole, $40 million in deceptive ads, and an auto-refill machine turned a San Francisco startup into the DOJ's first criminal telehealth drug prosecution.

By Carry and Conquer Publications

When a federal jury in San Francisco returned guilty verdicts against Ruthia He and Dr. David Brody in November 2025, the verdict was about more than one startup's collapse. The conviction of Done Global's founder and clinical president on drug distribution and healthcare fraud charges marked the Department of Justice's first successful criminal prosecution of a digital health company for telehealth-based controlled substance distribution - a landmark that sent immediate shockwaves through a sector worth hundreds of billions in venture capital.

A Startup Built on a Pandemic Loophole

Done Global was founded in 2019 by Ruthia He, a former Facebook product designer with no medical background. The premise was simple: connect patients to ADHD diagnoses and Adderall prescriptions through a monthly subscription model. When the COVID-19 pandemic hit in early 2020, the DEA suspended its long-standing requirement that physicians must conduct an in-person visit before prescribing Schedule II controlled substances remotely. Done saw the opening and floored the accelerator.

The company's investor roster included Craft Ventures - the firm co-founded by David Sacks, now serving as the White House AI and crypto czar - as well as Dave Morin's Offline Ventures and F7 Ventures. Done raised tens of millions in venture capital as it scaled, presenting itself as a technology-powered solution to the ADHD access gap. In the United States, roughly 17 million adults live with ADHD but fewer than 30,000 psychiatrists are licensed to treat them. Done's pitch was that telehealth could bridge that divide.

The pitch worked. At its peak, Done served between 30,000 and 50,000 patients across all 50 states, according to CDC estimates at the time of the June 2024 arrests.

How the Machine Worked

According to federal prosecutors, Done was less a medical platform than a pharmaceutical distribution pipeline designed to maximize prescription volume. The business model was structured to remove clinical friction at every turn.

Initial patient consultations were capped at under 30 minutes - roughly half the time a standard psychiatric evaluation requires. Prescribers were compensated not based on consultation quality or time spent with patients, but solely on the number of patients receiving Adderall and other stimulant prescriptions. Some nurse practitioners were paid up to $60,000 per month under this arrangement. Brody, a psychiatrist and the company's clinical president and sole owner of Done Health P.C., was positioned as the medical authority underpinning the entire operation.

The company spent more than $40 million on social media advertising - not merely to attract ADHD patients, but, according to trial evidence, to specifically target drug seekers. Done also purchased targeted keyword search advertisements aimed at people seeking Adderall without a legitimate prescription. The company's internal language, introduced at trial, was explicit: He sought to place "hard limits" on clinical discretion, and wanted compensation structures designed to "dis-encourage follow-up" care.

When patients auto-enrolled in Done's refill system, prescriptions continued issuing - in some cases even after patients had died. The company had implemented an auto-refill feature that generated prescriptions monthly through an automated email system, with no requirement for any subsequent clinical contact.

From 2020 through at least February 2025, the scheme generated over 40 million pills of Adderall and other stimulants, producing more than $100 million in revenue.

Obstruction and the Flight Risk

The government's case was not just about prescribing. Prosecutors presented compelling evidence that He had anticipated criminal exposure and acted aggressively to obstruct the investigation.

When federal scrutiny intensified, He moved Done's operations to China to make personnel and evidence harder to access. She shifted communications to encrypted messaging apps using disappearing messages and deleted internal documents that encouraged providers to prescribe Adderall even to patients who did not have ADHD. She transferred over $1 million to a Chinese shell company she named Make Believe Asia. According to prosecutors, she conducted internet searches for countries without extradition treaties. Law enforcement arrested her at the airport while she was attempting to leave the country.

He was subsequently placed under house arrest following her June 2024 arrest, but was returned to custody after authorities discovered she had concealed travel documents - a condition violation that prosecutors argued illustrated her willingness to run.

The jury convicted He on one count of conspiracy to obstruct justice in addition to the drug distribution and healthcare fraud charges. Brody, who remains represented by attorney Valery Nechay - who has stated he may appeal - was convicted on all drug and fraud counts but not the obstruction charge.

The Adderall Shortage and the Collateral Damage

The Done case landed against a specific backdrop: a nationwide Adderall shortage that had persisted since 2022 and was entering its third year by the time of the indictment. DEA Administrator Anne Milgram said explicitly that Done-style platforms bore partial responsibility for exacerbating the supply crisis, noting that diverting controlled substances to patients without legitimate medical need directly depleted inventory for those who genuinely required it.

The CDC issued an emergency Health Alert Network advisory the same day as the June 2024 arrests, warning that Done's disruption could impact tens of thousands of patients who had been receiving legitimate prescriptions through the platform - a public health complication that cut against any simple narrative of the case. Even inside a pill mill, real patients were caught in the machinery.

The DEA responded in January 2025 by releasing sweeping new telehealth prescribing rules. Starting in 2026, providers seeking to prescribe controlled substances via telehealth must obtain a special registration - the so-called Special Registration for Telemedicine - at a cost of $888, plus state-level registrations. A platform operating across 20 states now faces registration fees exceeding $17,000 before seeing a single patient. The COVID-era flexibilities that enabled Done's entire business model expired December 31, 2025.

What Investors and Operators Must Now Reckon With

The broader private equity and venture capital implications of the Done verdict are significant and are still being absorbed across the digital health sector.

The Ropes and Gray law firm, analyzing the case in January 2026, concluded that the prosecution signals expanded criminal risk not just for telehealth founders but for management services organizations and their investors. The theory: if a platform's business model "improperly influences clinical decision-making" in ways that generate prescriptions without legitimate medical purpose, the platform itself - and potentially the capital structures supporting it - faces criminal and civil exposure.

Done Global the entity was indicted in December 2025, just weeks after its founders' convictions. The company, still operating under the donefirst.com brand at the time of writing, now faces a separate corporate prosecution. A superseding indictment alleged that violations continued through February 2025 - well after the original individual charges were filed.

Sentencing for He and Brody was scheduled for February 25, 2026. Both face a maximum of 20 years in prison on the controlled substance distribution counts, under Judge Charles Breyer of the Northern District of California.

The Standard Has Changed

The DOJ made its posture explicit throughout the prosecution. Acting Assistant Attorney General Matthew R. Galeotti framed the verdict as the start of a "sustained effort" targeting digital health companies that use technology to distribute controlled substances illegally. U.S. Attorney Craig Missakian put it bluntly: some drug dealers operate from corners; others use computers and social media instead.

For private equity firms and venture investors underwriting digital health platforms that touch prescription medication - particularly controlled substances - the Done case has redefined the risk calculus entirely. Growth metrics, subscriber counts, and revenue multiples now carry a new variable: whether the clinical model can survive a criminal exposure analysis. The standard that applied to a brick-and-mortar prescriber, the government has made clear, applies with equal force to a San Francisco startup with a subscription app and a $40 million ad budget.

Done built its business on the assumption that pandemic-era regulatory flexibility was a durable feature of the landscape rather than a temporary accommodation. The conviction of its founders, the indictment of the corporate entity, and the December 2025 DEA rule overhaul collectively closed that chapter. What remains is a criminal precedent, a sentencing, and an industry trying to figure out where the new line is.

For any operator in the digital health space who believed that a well-funded tech wrapper around a clinical operation immunized it from the legal frameworks governing medicine, Done's $100 million pill mill offers the clearest possible answer: it does not.