A hospital calls the cell phone number on file for a patient to remind her of an upcoming appointment. Months later, the hospital receives a class action complaint stating that by making the call, it violated the Telephone Consumer Protection Act.
What happened?
The TCPA, passed in 1991, restricts how physicians, hospitals and others in the healthcare space (and other sectors) can use modern technologies to communicate with patients and insureds. It imposes consent requirements for certain phone calls, and violations can be incredibly costly – the minimum statutory damages are $500 per call or text, increased to $1,500 per call or text for knowing or willful violations.
The TCPA also allows for class actions, and there have been plenty of six, seven, and eight-figure TCPA settlements hitting the news in recent years. Our firm's TCPA Working Group has handled dozens of TCPA class actions, where we have secured dismissals and nominal settlements for clients.
Due to recent legal developments, the TCPA now poses additional compliance obstacles and class action litigation risks for organizations of all sizes. Let's walk through some of the key TCPA requirements and challenges, as well as steps that you can take to help protect your organization against TCPA liability.
Consent
Generally speaking, unless it is an emergency, a caller must obtain "prior express consent" from the called party to use an "automatic telephone dialing system" (an "autodialer") or a prerecorded voice (the robots) to call a wireless telephone number. This requirement applies even to non-marketing, informational calls. And the FCC and a number of courts have interpreted the term "call" to include text messages as well as voice calls.
So how do you get consent? Even though the TCPA does not define "prior express consent," the Federal Communications Commission ("FCC"), which implements the TCPA, has stated that the provision of a telephone number within the context of a transaction confers "prior express consent" for some prerecorded or autodialed non-marketing calls, assuming the individual does not instruct you otherwise. But the full scope of the consent depends on the facts.
To compare, obtaining the telephone number from third-party sources does not normally suffice for "prior express consent."
In a July 2015 decision, the FCC stated that the provision of a phone number by a consumer to a "healthcare provider" (not defined) constitutes "prior express consent" for healthcare calls subject to HIPAA "by a HIPAA-covered entity and business associates" acting on its behalf, within the context of the transaction.
The FCC's rules also state that "prior express written consent" is normally required for any autodialed or prerecorded voice call to a wireless number that "includes or introduces an advertisement or constitutes telemarketing." The same applies to prerecorded voice calls to landline numbers. Certain health care calls under HIPAA, and certain non-profit calls, qualify for the lower "prior express consent" standard even if they might otherwise involve advertising or telemarketing.
To obtain "prior express written consent," an organization must acquire a signed written agreement from each party it seeks to call. This agreement must include "clear and conspicuous" disclosures that the consumer consents to receive autodialed calls or texts at a specific number, and that the provision of consent is not a condition to purchasing any goods or services. In comparison to obtaining "prior express consent," obtaining "prior express written consent" is a heavier burden, essentially requiring healthcare organizations to carefully craft written agreements with stand-alone opt-in "checkboxes."
What is an autodialer?
Under the TCPA, an autodialer is defined as "equipment which has the capacity: to store or produce telephone numbers to be called using a random or sequential number generator; and to dial such numbers."
In the July 2015 TCPA decision, the FCC emphasized that the "capacity of an autodialer is not limited to its current configuration but also includes its potential functionalities." The FCC has also stated that a core function of an autodialer is the system's ability to dial thousands of numbers without human intervention in a short period of time, even if changes to the system are needed to enable such ability.
The FCC's interpretation creates significant ambiguity and has been appealed to the D.C. Circuit.
"Free-to-end-user" healthcare treatment exemption
In that same 2015 decision, the FCC created an exemption from the "prior express consent" requirement for healthcare entities. I represented the petitioner that had requested this exemption, and our victory helps compliance-minded organizations avoid abusive TCPA litigation.
The exemption applies to autodialed or prerecorded calls and text messages that are initiated "by or on behalf of a healthcare provider," and are sent free to the end-user. No fees and no impact on the user's cell phone plan (you have to pay the wireless carriers for the messages).
Additional conditions apply:
• The call or text can only be sent to the wireless number provided by the patient.
• The caller must provide the name and contact information of the healthcare provider.
• The healthcare provider may send one call or message per a day, and may not make more than three calls or messages per week.
• The calls must be concise (normally one minute or less for voice calls, and 160 characters or less for texts).
• The healthcare provider must offer recipients an easy way to opt-out from receiving calls and texts, and opt-out requests must be honored immediately.
• The calls must be limited to only the healthcare "purposes" recognized by the FCC in the decision (see below), must comply with HIPAA privacy rules, and may not include any billing or debt collection content.
The FCC expressly identified the following allowable "purposes" for healthcare-related calls: prescription notifications, wellness checkups, appointment and exam confirmations and reminders, lab results, home healthcare instructions, hospital pre-registration instructions, pre-operative instructions and post-discharge follow-up intended to prevent readmission.
It is important to note that the scope of the term "healthcare provider" and its implications for the TCPA exemption and HIPAA remains an open issue. The FCC did not define the term, but noted that healthcare providers can include "hospitals, emergency care centers, medical physician or service offices, poison control centers, and other healthcare professionals."
Consent revocation and calls to reassigned numbers
TCPA consents can be revoked at any time through any reasonable means. Moreover, if any patients change their telephone number, callers may be liable for autodialed or prerecorded calls to the new subscriber at the old number, even if the caller had previously obtained consent from the prior subscriber.
What you can do
These are just a few examples of the many recent TCPA developments and challenges for organizations in the healthcare ecosystem.
Companies should take a fresh look at their TCPA compliance strategies, including by reviewing intake and account forms, calling scripts, and other consent channels for adequate disclosures – and to make sure that the telephone number "type" (mobile, home) is specified. Privacy policies may also need to be supplemented.
Callers should also review their calling policies and manuals and prepare training modules for employees. In addition, companies will want to evaluate how they manage telephone number changes and identify ways to keep the calling database as accurate and up-to-date as possible.
Finally, it is increasingly critical to monitor for TCPA developments in court and at the FCC, as a single decision can have a significant impact on day-to-day compliance efforts.
The author thanks Roma Nandwani for her help in preparing this article.
The views, opinions and positions expressed within these guest posts are those of the author alone and do not represent those of Becker's Hospital Review/Becker's Healthcare. The accuracy, completeness and validity of any statements made within this article are not guaranteed. We accept no liability for any errors, omissions or representations. The copyright of this content belongs to the author and any liability with regards to infringement of intellectual property rights remains with them.