Telehealth buyers cannot treat prescription volume, prior authorizations, and patient growth as clean SaaS-style metrics. The Done case shows how a controlled-substance platform’s commercial model, clinical workflow, and claims process can become the core of a federal criminal prosecution — and why those same elements must be treated as transaction evidence in any acquisition or investment.
By Noah Green CPA CFE
This article is general due diligence education for buyers, investors, lenders, and operators. It is not legal advice. Enforcement posture, docket status, restitution, and sentencing can change. Verify current posture against primary sources before publication or reliance.
The Short Version
A federal jury convicted Done’s founder and CEO, Ruthia He, also known as Rujia He, and the company’s clinical president, David Brody, on November 18, 2025, following a June 2024 indictment. DOJ described the scheme as a \$100 million unlawful Adderall and stimulant distribution and health care fraud conspiracy. Sentencing appears continued to July 7, 2026, but root docket verification is required before that date is treated as final.
The diligence lesson is direct: in a controlled-substance telehealth business, prescription volume is not a growth metric. It is a compliance artifact. Prescribing patterns, prior authorization templates, pharmacy rejection history, provider incentive structures, and duplicate-account controls are core quality-of-earnings evidence. A buyer who prices revenue without testing those elements is pricing a risk it has not measured.
Related SPP reading: DOJ healthcare fraud diligence guide, Cerebral controlled-substance case study, and The FTC Franchise Rule guide.
Public Posture
DOJ charged the case on June 12, 2024. The indictment is publicly available as a PDF from the DOJ USAO-NDCA. DOJ announced the jury conviction on November 18, 2025, through the USAO-NDCA press office. The conviction release identifies Ruthia He and David Brody by name and describes the jury’s findings in terms of unlawful stimulant distribution and health care fraud conspiracy.
Sentencing posture: the public source materials reflect that sentencing appears continued to July 7, 2026. That date has not been independently verified against the live docket. Before publication or any reliance on sentencing posture, verify the current status through PACER or an updated USAO release.
Allegation discipline: use convicted language only for the counts and defendants described in the DOJ conviction release. Use alleged language for indictment details that were not separately described as jury findings. Do not treat DOJ’s description of the scheme size as a final restitution figure. Restitution has not been verified in the public sources.
Mechanism and Diligence Problem
DOJ’s public materials describe an unlawful Adderall and stimulant distribution and health care fraud conspiracy. According to DOJ, Done submitted false prior authorizations and used telehealth infrastructure to expand stimulant prescribing. The jury convicted on the controlled-substance distribution counts under 21 U.S.C. 846 and 21 U.S.C. 841 and on the health care fraud conspiracy count under 18 U.S.C. 1349. He also faced an obstruction count according to the public source materials.
The mechanism matters for diligence because it shows how a platform’s commercial design can become criminal evidence. The issue is not telehealth as a delivery channel. Telehealth is a legitimate and regulated care model. The issue is whether the platform’s growth incentives, clinical workflow, and claims process pushed controlled-substance prescribing beyond what medical necessity and applicable law support.
In a conventional SaaS or subscription business, growth metrics like monthly active users, churn rate, and average revenue per user are generally neutral. In a controlled-substance telehealth business, the analogous metrics — prescriptions issued per clinician, refill rates, prior authorization approval rates, and patient retention tied to medication continuity — are not neutral. Each of those metrics can reflect either sound clinical practice or a system designed to maximize prescribing regardless of patient need. A buyer cannot tell which is true without testing the underlying clinical records, provider incentives, and compliance controls.
The Done case illustrates the specific risk that prior authorization submissions can be fabricated or reused without patient-specific support. Prior authorizations are supposed to reflect individualized clinical judgment. When they are templated, copied, or submitted without chart support, they become false statements to payers. In a diligence context, a sample of prior authorization submissions that cannot be traced back to patient-specific clinical documentation is a red flag that requires escalation before signing.
The case also illustrates the pharmacy rejection risk. When a pharmacy declines to fill a controlled-substance prescription, that rejection is a compliance event. It may reflect a pharmacist’s professional judgment that the prescription does not meet legal or clinical standards. A platform that treats pharmacy rejections as operational friction to be routed around — rather than as signals to be reviewed by clinical leadership — is building a compliance liability into its revenue model.
Warning Signs for Buyers and Investors
The following warning signs are drawn from the public source materials and from the public enforcement record and the diligence categories discussed in this article. They are not exhaustive. They are the starting points a buyer should test before pricing a controlled-substance telehealth business.
Prescription volume growing faster than documented clinical capacity. If the number of controlled-substance prescriptions issued per month is increasing faster than the number of licensed clinicians, documented visits, and clinical hours, the gap needs an explanation. The explanation may be legitimate — efficiency gains, asynchronous care models, or expanded clinician hours. Or it may reflect prescribing that is not supported by adequate clinical contact. The buyer needs to know which is true.
Prior authorization language reused across patients without patient-specific support. Pull a sample of prior authorization submissions and compare the clinical language to the underlying patient charts. If the same phrases appear across multiple patients without variation, and the charts do not support the specific statements made in the prior authorization, that is a documentation integrity problem.
Pharmacy rejection notices treated as operational friction. Ask for all pharmacy rejection correspondence for the past three years. Ask how rejections were logged, who reviewed them, and what clinical or compliance action followed. A platform that has no systematic process for reviewing pharmacy rejections has a gap in its controlled-substance diversion controls.
Provider compensation or retention metrics tied to prescription continuity. Map the compensation structure for prescribing clinicians. If bonuses, retention payments, or performance ratings are tied to prescription volume, refill rates, or patient retention in a medication program, that structure creates an incentive that may conflict with independent clinical judgment. It is also a fact pattern that appears in multiple DOJ healthcare fraud prosecutions.
Duplicate accounts, patient reassignment, or identity controls that are weak under controlled-substance rules. Controlled-substance prescribing requires that the prescriber have a legitimate patient-provider relationship and that the patient’s identity and history be accurately known. Weak duplicate-account controls or patient reassignment practices that allow patients to cycle through multiple clinicians without continuity of records are a diversion risk.
Clinical protocols that changed after payer, pharmacy, or law-enforcement pressure. Ask for the version history of clinical protocols, prescribing guidelines, and prior authorization templates. If protocols changed materially after a payer audit, a pharmacy access block, a DEA inquiry, or a subpoena, the timing of those changes is relevant to understanding what the prior practice was and why it changed.
Subpoena history and litigation-hold records that are incomplete or unavailable. A controlled-substance telehealth platform that has operated at scale should have a documented history of any government inquiries, subpoenas, civil investigative demands, or litigation holds. If that history is unavailable, incomplete, or inconsistent with what the company’s legal counsel describes, that is a diligence gap that must be resolved before closing.
Diligence Tests Before Signing or Before the Wire
The following tests are organized by document category. Each test is designed to produce a specific finding that either supports or undermines the revenue and compliance posture of the target.
Prescribing Metrics and Clinical Staffing Reconciliation
Pull controlled-substance prescribing data by clinician, diagnosis code, patient source, state of licensure, visit type, refill interval, and pharmacy denial rate. Build a per-clinician prescribing profile for at least the past 24 months. Compare the prescribing volume to documented clinical hours, visit records, and state licensure status for each prescribing period.
The reconciliation should answer three questions. First, is there a clinician whose prescribing volume is inconsistent with the documented visit count? Second, are there states where the platform was prescribing controlled substances during periods when its clinicians were not licensed in those states? Third, are there diagnosis codes that appear at rates inconsistent with the patient population’s documented clinical history?
If the prescribing data cannot be reconciled to clinical staffing and visit records, the buyer is pricing revenue it cannot verify.
Prior Authorization Sample and Chart Trace
Select a random sample of at least 50 prior authorization submissions from the past 24 months, weighted toward high-volume payers and high-volume clinicians. For each submission, pull the underlying patient chart and compare the clinical statements in the prior authorization to the chart documentation.
The test should answer whether each prior authorization statement is supported by a patient-specific chart entry made before the submission date. If a material portion of the sample shows prior authorization language that is not traceable to contemporaneous chart documentation, that is a documentation integrity finding that must be disclosed to the buyer’s legal counsel before closing.
Pharmacy Rejection and PDMP Review
Request all pharmacy rejection correspondence for the past three years. Ask for the platform’s PDMP access policies, PDMP query logs, and any internal escalation records tied to PDMP findings. Ask whether the platform has ever received a letter from a state pharmacy board, a DEA field office, or a payer’s pharmacy benefit manager regarding prescribing patterns.
Review the PDMP policies for each state where the platform operates. Confirm that the policies require PDMP queries before issuing controlled-substance prescriptions and that the query logs are consistent with the prescribing volume.
Provider Incentive Structure and Performance Review Records
Obtain the compensation agreements, bonus structures, and performance review records for all prescribing clinicians for the past three years. Map each compensation element to the clinical metrics it is tied to. If any element is tied to prescription volume, refill rates, patient retention in a medication program, or prior authorization approval rates, document that element and assess whether it creates an incentive inconsistent with independent clinical judgment.
Ask whether the compensation structure was reviewed by legal counsel or a compliance officer before implementation. Ask whether it changed after any government inquiry or payer audit.
Duplicate Account and Patient Identity Controls
Request the platform’s duplicate-account detection policies and the technical controls that implement them. Ask for a report of any accounts flagged as potential duplicates in the past three years and the resolution of each flag. Ask how the platform handles patient reassignment when a clinician leaves and whether the reassignment process includes a clinical handoff review.
For a controlled-substance platform, weak identity controls are not just a fraud risk. They are a diversion risk that can attract DEA and DOJ attention independent of any billing fraud.
Subpoena, Litigation Hold, and Government Inquiry History
Ask for a complete list of all subpoenas, civil investigative demands, government inquiry letters, and litigation holds received by the platform in the past five years. Ask for the legal counsel who managed each matter and whether any matter remains open. Ask whether the platform has produced documents to any government agency in connection with a healthcare fraud or controlled-substance investigation.
If the platform’s legal counsel cannot produce a complete and consistent account of this history, that is a diligence gap that must be resolved before closing.
How to Read the DOJ Indictment and Conviction Release
The Done indictment PDF is publicly available from DOJ. A buyer’s diligence team should read it not as a legal brief but as a map of the government’s theory of the case. The indictment will identify the specific conduct alleged, the time periods covered, the payers involved, and the clinical and operational practices the government characterized as unlawful.
Compare the indictment’s description of Done’s practices to the practices of the target being acquired. If the target uses similar prior authorization templates, similar provider incentive structures, or similar patient acquisition channels, those similarities are diligence findings that require explanation.
The conviction release is shorter and more summary. It confirms the jury’s findings and the counts of conviction. Use the conviction release to establish what has been proven at trial. Use the indictment to understand the full scope of the government’s allegations, keeping in mind that indictment allegations are not proof of guilt for any party other than the convicted defendants.
By the Numbers
| Metric | Public Figure or Posture | Why It Matters for Diligence | Source |
|---|---|---|---|
| Charging date | June 12, 2024 | Establishes the original indictment posture and the period of alleged conduct | DOJ indictment, USAO-NDCA |
| Conviction announcement | November 18, 2025 | Jury verdict; use convicted language only where tied to the DOJ conviction release | DOJ conviction release, USAO-NDCA |
| Scheme size described by DOJ | \$100 million | DOJ-described scheme size; treat as alleged scope, not final restitution, which has not been verified | DOJ conviction release |
| Sentencing status | Appears continued to July 7, 2026 | Needs root docket verification before this date is treated as final or published | Public source posture note; PACER verification required |
| Core statutes | 21 U.S.C. 846, 21 U.S.C. 841, 18 U.S.C. 1349, obstruction count for He | Shows both controlled-substance distribution and health care fraud exposure; obstruction count adds litigation-hold diligence relevance | DOJ public materials |
| Defendants convicted | Ruthia He (founder and CEO) and David Brody (clinical president) | Both the business founder and the clinical leadership were convicted; not a rogue-employee fact pattern | DOJ conviction release |
| Restitution | Not yet verified in public sources | Final restitution figure is a sentencing-stage determination; do not treat scheme size as restitution | Public source posture note |
Source footer: Figures and posture are drawn from the public primary sources listed below. Verify current posture before publication or reliance.
Buyer and Investor Takeaway
A controlled-substance telehealth business that shows strong prescription growth, high prior authorization approval rates, and low patient churn is not necessarily a well-run clinical operation. Those metrics can reflect sound care. They can also reflect a prescribing model that will not survive payer audit, pharmacy review, or DOJ scrutiny.
The Done case is not a warning about telehealth as a sector. It is a warning about what happens when a platform’s commercial incentives are not tested against its clinical and compliance controls. A buyer who prices revenue without testing the prescribing data, prior authorization files, pharmacy correspondence, and provider incentive structure is pricing a risk it has not measured.
The practical standard for a controlled-substance telehealth acquisition is this: before signing, the diligence team should be able to answer the following questions from documentary evidence, not from management representations.
First, can every controlled-substance prescription in the sample period be traced to a documented clinical visit with a licensed prescriber who had a legitimate patient-provider relationship at the time of prescribing?
Second, can every prior authorization submission in the sample period be traced to patient-specific chart documentation that predates the submission?
Third, does the provider compensation structure contain any element that rewards prescribing volume, refill rates, or patient retention in a medication program in a way that could be characterized as an incentive to prescribe beyond medical necessity?
Fourth, has the platform received any government inquiry, subpoena, or civil investigative demand related to its prescribing practices, and if so, what is the current status of that matter?
If the diligence team cannot answer all four questions from documentary evidence, the transaction is not ready to close.
SPP Bottom Line
A telehealth platform can present as a growth company and still carry a claims-origin risk that is not visible in the revenue line. In controlled-substance diligence, SPP treats prescribing data, prior authorization files, pharmacy correspondence, provider incentive structures, and government inquiry history as transaction evidence, not back-office detail. The Done case is a concrete illustration of why that standard exists. The jury’s verdict on November 18, 2025 confirmed that the government’s theory of the case — that a telehealth platform’s commercial model drove unlawful stimulant distribution and false claims — was sufficient to support criminal conviction of both the business founder and the clinical president. That fact pattern should be in the room at every controlled-substance telehealth diligence kickoff.