A man who once tried to extort over $100 million from a Hollywood producer, several energy industry tycoons, and a Silicon Valley darling is now operating a scheme that’s draining thousands of dollars out of the digital health industry. 

At a legal event we attended recently, a group of lawyers in digital health was giggling amongst themselves about receiving a demand letter from Vivek Shah. Letters and lawsuits from Shah have apparently become so ubiquitous that his name has become an inside joke among lawyers.

Six corporate lawyers told Second Opinion that Shah is one of the most prominent litigants suing thousands of corporations for allegedly violating the California Invasion of Privacy Act. Shah is using California’s 1960s-era wiretapping law, which has a private right of action, to accuse companies of violating his privacy for sharing his web data with marketers and other entities. CIPA wasn’t designed for the internet epoch, and lawyers are advising many companies to ignore demand letters from Shah. But it’s not that simple for digital health companies, which manage sensitive health information.

Several lawyers say they are advising digital health companies to pay the fee in some cases. Second Opinion has viewed a copy of two of the letters, one of which threatens the filing of an attached complaint. We incorporated a copy of the letter below for our premium subscribers.

Shah did not respond to a request for comment.  

Reserve Your Spot for Upcoming Webinars!

An ongoing legal debate

The CIPA demand letters, which demand statutory damages for using web trackers without consent, strike at the center of an ongoing legal debate about patients' personal health information, or PHI, and how it’s legally protected. Federal and state regulators, as well as courts, have become increasingly preoccupied with protecting health data that is not covered by federal health privacy laws.