DC Circuit shuts down effort to limit TCPA liability for communicating health information

The U.S. Court of Appeals for the D.C. Circuit, on March 16, 2018, struck a blow to healthcare industry efforts to exclude certain communications subject to the Health Insurance Portability and Accountability Act (HIPAA) from liability under the Telephone Consumer Protection Act of 1991 (TCPA). In its unanimous decision in ACA International v. Federal Communications Commission,¹ the D.C. Circuit affirmed the Federal Communications Commission’s (FCC) holding in its 2015 Declaratory Ruling and Order (2015 Order)² exempting certain exigent healthcare-related calls from the TCPA’s consent requirement, but leaving callers subject to TCPA liability for “billing- and account-related” healthcare calls made to wireless numbers.³

The FCC’s 2015 Order left healthcare-related “billing- and account-related” calls subject to the TCPA prior consent requirement 

The TCPA generally prohibits the use of an “automatic telephone dialing system” to call wireless numbers without prior express consent. 47 U.S.C. § 227(b)(1)(A). The FCC may exempt from this statutory consent requirement calls that are “not charged to the called party,” subject to whatever conditions the FCC prescribes as “necessary” in the interest of consumer privacy rights. § 227(b)(2)(C). Parties aggrieved by a TCPA violation can recover US$500 in damages for each violation (i.e., each call), and treble damages for willful or knowing violations. § 227(b)(3). 

Under HIPAA, covered entities and their business associates generally may not use or disclose protected health information (PHI) except for “treatment, payment, or health care operations.” 45 C.F.R. § 164.502(a)(1)(ii). 

In its 2015 Order, the FCC exempted from the prior express consent requirement “certain non-telemarketing, healthcare calls” made to wireless numbers that are not charged to the called party.⁴ The FCC accepted that these types of calls—for instance, appointment and exam confirmations and reminders—are the kind of communications that consumers “desire, expect, and benefit from.”⁵ The FCC declined, however, to exempt from the consent requirement other healthcare-related calls including telemarketing, soliciting, advertising, billing, debt collection, or “other financial content.” The FCC reasoned that for these calls, “[t]imely delivery” is not “critical to a called party’s healthcare, and they therefore do not justify setting aside a consumer’s privacy interests in favor of an exemption.”⁶ 

The D.C. Circuit affirmed the FCC’s healthcare exemption 

Petitioner Rite Aid challenged the 2015 Order, arguing that the FCC’s exemption for select healthcare-related calls conflicts with HIPAA and is arbitrary and capricious. Specifically, Rite Aid argued that the exemption should cover all healthcare-related calls, including calls with telemarketing, solicitation, advertising, accounting, billing, debt-collection, and other financial content. Rite Aid argued that HIPAA, together with applicable regulations and guidance from the U.S. Department of Health and Human Services (HHS), is “the exclusive source of federal law” with regard to the disclosure of PHI. As the D.C. Circuit noted, Rite Aid essentially argued that any partial exemption of healthcare-related calls from the TCPA consent requirement is unlawful because HIPAA supersedes the TCPA when it comes to the communication of healthcare information.⁷ The D.C. Circuit rejected this argument, finding that there is “no obstacle to complying with both the TCPA and HIPAA[,]” as “the two statutes provide separate protections.”⁸ 

The D.C. Circuit also rejected Rite Aid’s argument that the 2015 Order was arbitrary and capricious because it afforded a narrower exemption for healthcare-related calls made to wireless numbers than a 2012 FCC exemption for all prerecorded healthcare-related calls made to residential lines that are subject to HIPAA.⁹ While the D.C. Circuit agreed that the 2012 exemption “swept more broadly” than the 2015 exemption,¹⁰ the court nevertheless concluded that disparate treatment between calls to wireless and residential numbers was justified, noting that the TCPA itself “presupposes . . . that calls to residential and wireless numbers warrant differential treatment,”¹¹ and that “calls to wireless numbers ‘tread [more] heavily upon . . . consumer privacy interests.’”¹² As the D.C. Circuit noted, consumer privacy concerns “directly informed the 2015 [healthcare] exemption’s scope,” evidenced by the FCC’s finding that the timely delivery of account- and billing-related calls is “not critical” to a called party’s healthcare, and therefore does “not justify setting aside a consumer’s privacy interests.” Thus, there was “nothing inherently contradictory about easing restrictions on certain kinds of calls to landlines, but not to cellular phones.”¹³ 

Implications for Healthcare Companies 

Perhaps most significantly, ACA International leaves unaddressed certain practical concerns raised by Rite Aid, including that the FCC’s exemption is based on terms that have not been defined by the FCC and are not used in HIPAA or TCPA regulations, and that healthcare companies now must comply with “a confusing patchwork of regulations on healthcare communications.”¹⁴ The D.C. Circuit gave only a cursory dismissal of Rite Aid’s emphatic warning that HIPAA covered entities face a “Hobson’s choice of complying with HIPAA or coming within the cross-hairs of TCPA litigation bounty hunters.”¹⁵ 

Of particular interest to healthcare providers and other HIPAA covered entities (e.g., employer health plans) may be the D.C. Circuit’s implicit finding that HIPAA is not the “exclusive source of federal law on the disclosure of protected health information.” The D.C. Circuit essentially permitted the FCC to impose limitations on the use and disclosure of PHI that go further than HIPAA. This is a significant precedent because federal agencies have historically been reluctant to enter into the realm of HHS as it relates to the oversight of HIPAA and the use and disclosure of PHI. This ruling may embolden the FCC, and other agencies, to regulate PHI. Going forward, HIPAA covered entities that previously needed to look only to HIPAA with respect to their compliance obligations regarding the use and disclosure of PHI, may need to consider other agency regulations as well. 

Footnotes 

_{1) No. 15-1211, 2018 WL 1352922 (D.C. Cir. Mar. 16, 2018).
2) In the Matter of Rules & Regs. Implementing the Telephone Consumer Prot. Act of 1991, 30 FCC Rcd. 7961 (2015).
3) ACA Int’l, 2018 WL 1352922, at *20.
4) 30 FCC Rcd. at 8030 ¶ 143.
5) Id. at 8030–31, ¶ 145.
6) Id. at 8031, ¶ 146.
7) ACA Int’l, 2018 WL 1352922, at *20.
8) Id. (quoting Mais v. Gulf Coast Collection Bureau, Inc., 768 F.3d 1110, 1125 (11th Cir. 2014)).
9) ACA Int’l, 2018 WL 1352922, at *20.
10) In formulating the 2012 exemption, the FCC used the term “health care” as defined in HIPAA regulations, which includes the “sale” of a “drug.” The D.C. Circuit assumed that the 2012 exemption of prerecorded “health care” messages to residential numbers would include messages “relate[d] to ‘billing,’” which the 2015 Order “did not exempt from the consent requirement.” ACA Int’l, 2018 WL 1352922, at *21.
11) ACA Int’l, 2018 WL 1352922, at *20.
12) Id. (quoting In re Rules and Regulations Implementing the Telephone Consumer Protection Act of 1991, 27 FCC Rcd. 1855 ¶ 63 (2012)).
13) ACA Int’l, 2018 WL 1352922, at *21.
14) See, e.g., Feb. 24, 2016 Final Reply Br. for Petitioner Rite Aid Hdqtrs. Corp., filed in ACA Int’l v. Fed. Commc’ns Comm’n (Dkt No. 1600695) at 1.
15) Feb. 16, 2016 Reply Br. for Petitioner Rite Aid Hdqtrs. Corp., filed in ACA Int’l v. Fed. Commc’ns Comm’n (Dkt No. 1599038) at 2–3.}