HIPAA and TCPA Intersection: Navigating Healthcare Call Exemption, Landline/Cell Phone Distinction, Scope of Consent

Transcription

1 Presenting a live 90-minute webinar with interactive Q&A HIPAA and TCPA Intersection: Navigating Healthcare Call Exemption, Landline/Cell Phone Distinction, Scope of Consent THURSDAY, NOVEMBER 5, pm Eastern 12pm Central 11am Mountain 10am Pacific Today s faculty features: Douglas G. Bonner, Partner, Womble Carlyle Sandridge & Rice, Washington, D.C. Rebecca E. Jacobs, Moderator, Womble Carlyle Sandridge & Rice, Washington, D.C. Mary Ellen Kleiman, VP, Legal Affairs and Associate General Counsel, National Association of Chain Drug Stores, Arlington, Va. The audio portion of the conference may be accessed via the telephone or by using your computer's speakers. Please refer to the instructions ed to registrants for additional information. If you have any questions, please contact Customer Service at ext. 10.

2 Tips for Optimal Quality FOR LIVE EVENT ONLY Sound Quality If you are listening via your computer speakers, please note that the quality of your sound will vary depending on the speed and quality of your internet connection. If the sound quality is not satisfactory, you may listen via the phone: dial and enter your PIN when prompted. Otherwise, please send us a chat or sound@straffordpub.com immediately so we can address the problem. If you dialed in and have any difficulties during the call, press *0 for assistance. Viewing Quality To maximize your screen, press the F11 key on your keyboard. To exit full screen, press the F11 key again.

3 Continuing Education Credits FOR LIVE EVENT ONLY In order for us to process your continuing education credit, you must confirm your participation in this webinar by completing and submitting the Attendance Affirmation/Evaluation after the webinar. A link to the Attendance Affirmation/Evaluation will be in the thank you that you will receive immediately following the program. For additional information about continuing education, call us at ext. 35.

4 Program Materials FOR LIVE EVENT ONLY If you have not printed the conference materials for this program, please complete the following steps: Click on the ^ symbol next to Conference Materials in the middle of the lefthand column on your screen. Click on the tab labeled Handouts that appears, and there you will see a PDF of the slides for today's program. Double click on the PDF and a separate page will open. Print the slides by clicking on the printer icon.

5 HIPAA AND TCPA INTERSECTION: NAVIGATING HEALTHCARE CALL EXEMPTION, LANDLINE/CELL PHONE DISTINCTION, SCOPE OF CONSENT Mary Ellen Kleiman, NACDS Douglas G. Bonner, WCSR Rebecca E. Jacobs, WCSR November 5, 2015

6 OUTLINE I. TCPA A. Type of messages covered under TCPA exemption B. Consent issues II. III. HIPAA-TCPA Intersection A. Healthcare-related messages B. Marketing as defined under HIPAA C. Terminology Best Practices A. Understanding the risks B. Overcoming the compliance challenges 6

7 PURPOSE OF THE TCPA Congress: unrestricted telemarketing can be an invasion of privacy and pose a risk to public safety. Greater protection for wireless users, who may be charged per call (or text). TCP addressed consumer issues at the time (1991). FCC regulations continue to protect wireless as subscribers grow ( cutting the cord ) The FCC s rulings attempt to balance an individual s right to privacy with the legitimate business interests of telemarketers. 7

8 WHAT THE FCC TCPA RULES COVER Telemarketing via phone calls and text messages Use of Autodialers or Automated Telephone Dialing Systems ( ATDS ) Prerecorded voice calls - including calls using an artificial voice Do-Not-Call Registries Junk Faxes 8

9 KEY TERMS Telemarketing/telephone solicitation: a call or message for the purpose of encouraging the purchase or rental of, or investment in, property, goods, or services, which is transmitted to any person. BUT EXCLUDES a call or message: (a) to a person who gives prior express consent; (b) to any person with whom caller has an established business relationship ; (c) by, or on behalf of, a tax-exempt, nonprofit organization Automatic Telephone Dialing System ( ATDS ): equipment which has the capacity (A) to store or produce telephone numbers to be called, using a random or sequential number generator; and (B) to dial such numbers. 9

10 FCC - BROAD DEFINITION OF ATDS FCC interprets ATDS to mean: any dialing equipment that has the capacity to store, or produce and dial, random or sequential numbers whether or not the equipment is used for that purpose. FCC Declaratory Ruling and Order (rel. 7/10/15) 10

11 CHANGES IN THE FCC S 2012 (ROBOCALL) TCPA ORDER Eliminates the established business relationship exemption for prerecorded telemarketing calls to residential numbers. Written consent req. d for marketing calls: (a) to wireline numbers using a prerecorded or artificial voice. (b) to wireless numbers using either an ATDS or a prerecorded or artificial voice. (Eff. October, 2013) 11

12 CHANGES IN THE FCC S 2012 (ROBOCALL) TCPA ORDER Prerecorded calls must have an interactive optout mechanism announced at the outset of the message and available throughout the call. Mechanism must add the consumer to the seller s do-not-call list and disconnect the call. This applies to calls where it is likely a called party will answer. There are different requirements for messages left on answering machines and voic . 12

13 WHAT IS PRIOR EXPRESS WRITTEN CONSENT? In writing and bearing signature of the person providing consent. (BUT it includes: an electronic or digital form of signature pursuant to the E-SIGN Act; ; website form; text message, telephone key press; or voice recording); Must specify the tel. # to which consent applies; Plainly authorizes the use of an ATDS or prerecorded message for telemarketing; Cannot make required consent a condition to purchase goods or services. 13

14 EXCEPTIONS: PRIOR EXPRESS CONSENT Prior express consent is an affirmative defense. For informational calls, prior oral or written consent or providing a wireless/landline phone number (i.e. in a credit application), are evidence of prior express consent 1992 TCPA Order; 2015 TCPA Declaratory Ruling 14

15 EXCEPTIONS: EMERGENCY PURPOSES, TAX-EXEMPT NONPROFIT, HEALTH CARE MESSAGE Emergency purposes Tax-exempt non-profit organization Health care message Made by, or on behalf of, a covered entity or its business associate As defined by HIPAA 15

16 WHAT IS PRIOR EXPRESS WRITTEN CONSENT? The FCC provided no grandfathering of consents that were obtained under the prior rules: Once our written consent rules become effective, however, an entity will no longer be able to rely on non-written forms of express consent to make autodialed or prerecorded voice telemarketing calls, and thus could be liable for making such calls absent prior written consent FCC Report and Order 68 16

17 RULES FOR ROBOCALLS Consent Required EXCEPTION: Emergency Tax-Exempt Health Care Statutory Damages: $500 per call/text ($1,500 if willful violation) FCC may assess penalties up to $16,000 17

18 ROBOCALLS TO WIRELESS NUMBERS Prohibits: 1. an artificial or pre-recorded voice or 2. an ATDS to make any call, without prior express consent to: Wireless number; Any number for which the called party is charged for the call. 18

19 ROBOCALLS TO WIRELESS NUMBERS INFORMATIONAL V. TELEMARKETING Verbal consent is sufficient for informational calls to wireless (whether using an ATDS or prerecorded/artificial voice). Written consent required for all autodialed/prerecorded telemarketing calls to wireless #s. Rules apply equally to voice calls or text messages. 19

20 ROBOCALLS TO LANDLINE (RESIDENTIAL) NUMBERS Telemarketing calls: Prior express written consent required for any telemarketing call using autodialer or artificial or prerecorded voice, except for emergency calls and calls made on behalf of a tax-exempt nonprofit. Non-Telemarketing calls: Pre-recorded nontelemarketing calls require no prior consent. ATDS calls to residential lines do not require consent. 20

21 DEBT COLLECTION CALLS Collection calls without a telemarketing element are informational calls. Residential wireline numbers: NO CONSENT Wireless numbers: WRITTEN OR VERBAL CONSENT The provision of a cell phone number to a creditor, e.g., as a part of a credit application, reasonably evidences prior express consent by the subscriber to be contacted at that number regarding a future debt. 21

22 WHAT IS THE EMERGENCY EXCEPTION? Any call that is necessary because of a situation that would affect the health and/or safety of a consumer 22

23 CONSENT REQUIRED FOR AUTODIALED CALLS Telemarketing Call/Text Wireless/Cell Written consent Residential/Landline Written Consent Informational Call/Text Wireless/Cell Consent Residential/Landline Not Required 23

24 FCC 2015 DECLARATORY RULING Consent may be given to an intermediary. Called party is actual subscriber or a customary user of that number (i.e. family member) in confirming validity of consent. Granted retroactive waiver of prior express written consent requirement from 10/16/13 to 10/10/15 to enable calling parties to update customer consents. Applies to each called number. 24

25 LIABILITY FOR THE ACTIVITIES OF THIRD PARTIES (LEAD GENERATORS) Companies cannot insulate themselves from TCPA liability by simply delegating their marketing communications to third parties. [W]e find that the seller may be held vicariously liable under federal common law principles of agency for TCPA violations committed by third-party telemarketers. In the Matter of the Joint Petition Filed by DISH Network, LLC, et al., for Declaratory Ruling Concerning the Telephone Consumer Protection Act (TCPA) Rules, et al., Declaratory Ruling, CG Dkt. No (May 9, 2013) 25

26 RECYCLED NUMBERS A.K.A. THE UNINTENDED RECIPIENT Problem: Companies face potential TCPA liability when autodialing a customer who consented but who has since switched phone numbers or been disconnected, and original number recycled to a new subscriber. No definition of called party under the TCPA statute. Courts were split on the issue. 26

27 FCC 2015 DECLARATORY RULING FCC: called party is ambiguous under TCPA, and requires the consent of current subscriber, not the intended recipient. But, callers without knowledge of reassignment have one free call after reassignment to obtain knowledge of the reassignment and any required consent. WARNING! WARNING! : caller has constructive notice of reassignment after first call postreassignment. 27

28 DO-NOT-CALL ( DNC ) REGISTRY EXCEPTIONS Calls from or on behalf of political organizations, tax-exempt non-profits, charities, and telephone surveyors are exceptions as permitted calling. EBR exception: Marketing calls are permitted. Calls can continue calls for up to 18 months after the last purchase or delivery or the last payment to it Or, 3 months following an inquiry or application to the company. BUT, if customer asks, must put number on calling party s own do-not-call list 28

29 FCC 2015 DECLARATORY RULING Porting a number (from wireline to wireless service) does not revoke express consent. BUT, consent can be revoked by any reasonable means (including verbal request) Presence of a number in a contact list does not establish consent (i.e. mobile/messaging applications) 29

30 TCPA/HIPPA INTERSECTION 30

31 NACDS FCC FILINGS Two Filings with the FCC Comments re: AAHAM Petition/Prior Express Consent for HCPs (1/16/15) Reply Comments re: Blackboard, Inc./Emergency Purposes (5/7/15) Consolidated Petitions of Review of July Order (DC Cir.): ACA Int l v. FCC, includes pharmacy 31

32 HEALTHCARE MESSAGE EXEMPTION FOR WIRELESS CALLS - FCC Calls subject to HIPAA Call/text a healthcare treatment purpose and exigent (e.g., appointment reminders/prescription notifications) Made by or on behalf of a healthcare provider 32

33 HEALTHCARE MESSAGES- HIPAA HIPAA covers communications regarding PHI by covered entities (CEs) and their business associates (BAs). FCC -- Health care defined under 45 C.F.R (preventive, diagnostic, therapeutic...; sale and dispensing of a drug... with a prescription ) FCC already recognized the unique nature of health care messages in light of HIPAA-related regulations intended to protect patient privacy ( intent and purpose concern consumers health FCC Report and Order, CG Docket No , 2/15/12 [exempting pre-recorded/auto-dialed health care calls to residential phone lines]) 33

34 MARKETING - HIPAA Defined as any communication about a product/service to encourage its use or purchase Carve-outs Remuneration 34

35 COVERED ENTITIES AND THEIR BUSINESS ASSOCIATES - HIPAA Covered Entities (CEs) health plans and HCPs who electronically transmit PHI Business Associates (BAs) perform services or functions for CEs that use PHI; subject to contracts with specific safeguards for PHI 35

36 REQUIREMENTS FOR HEALTHCARE MESSAGE EXEMPTION - FCC THRESHOLD REQUIREMENT: Robocalls and texts to wireless phones must not incur charges to the recipient, including not being counted against plan minutes or texts. Post-July 2015 Order lawsuit filed against pharmacy alleged damages due to indirect costs of calls ( loss of use and interrupted use of cell phone; nuisance; invasion of privacy; costs incurred when calls/month exceed data plan or call minutes) 36

37 ADDITIONAL CONDITIONS ON EXEMPTED HEALTHCARE CALLS Voice calls and text messages must: Only be sent to wireless number provided by patient State name and contact name of provider Not include telemarketing, solicitation, or advertising Not include accounting, billing, debt-collection, or other financial content Must comply with HIPAA privacy rules Must be concise 1 minute or less for voice; 160 characters or less for text messages HCP may only initiate one message (by voice or text) per day; max three per week HCP must offer and immediately honor opt out request 37

38 PRIOR EXPRESS CONSENT RECOGNIZED FOR HCP - FCC Provision of a telephone number to HCP = prior express consent for health care calls subject to HIPAA by CE and its BA Qualification within scope of consent ( closely related to call s purpose) and absent contrary instructions 38

39 BEST PRACTICES: UNDERSTANDING THE RISKS 39

40 FCC ENFORCEMENT FCC sends citation of the violation charged Recipient has opportunity to rebut charges Following any adverse findings: FCC publishes Citation and Order Future violations can result in monetary forfeitures, extending back to prior violations Maximum fines of $16,000 per violation + compliance plan. 40

41 RECENT FCC ENFORCEMENT LESSONS Citations: (1)PayPal (2) First National Bank and Lyft 41

42 TCPA LITIGATION CLIMATE A 54% increase in TCPA cases has been reported since August cases filed in 2014 alone (FCC Commissioner O Reilly). Some catalysts: Significant Risk for Businesses Class Actions and Defense Costs Identify your Exposure Points Ensure Compliance Be Conservative 42

43 TCPA LITIGATION CLIMATE Why has the TCPA has become a focus of the plaintiffs bar? Substantial, high-profile damage awards and settlements including a record $75.5 Million class settlement from Capital One and other defendants (approved7/29/14). Strict liability statute: each violation can result in $500 for each negligent violation and up to $1,500 for each willful or knowing violation Uncapped aggregate damages Easy to plead Limited defenses 43

44 2013 SETTLEMENTS ALLEGED ROBOCALLS/TEXT MSGS W/OUT CONSENT MAY Papa John s $16.5M Steve Madden $10M JUNE Domino s Pizza $9.75M SEPT. Bank of America $32M Discover Financial $8.7M 44

45 2014 SETTLEMENTS ALLEGED ROBOCALLS/TEXT MSGS W/OUT CONSENT MARCH Group of MMS companies $3M JULY Capital One and collection agencies $75.5M (largest cash settlement in TCPA history) AUGUST Chase Bank USA $34M 45

46 BEST PRACTICES: OVERCOMING THE COMPLIANCE CHALLENGES 46

47 BEST PRACTICES Identify and obtain proper TCPA consents Maintain records of consent Exempted healthcare calls: comply with all conditions Monitor national DNC registry Maintain/update companyspecific DNC registry Prepare written Do-Not-Call Policy and provide it on request. Train employees/verify 3 rd party vendors are trained/supervised Identify wireless/recycled wireless numbers Ensure faxes contain proper opt-out info Monitor conduct of vendors placing calls or sending texts Require vendors to have adequate TCPA liability insurance coverage and provide indemnification. Perform assessment to determine need/risk to use an ATDS. 47

48 QUESTIONS AND ANSWERS Thank You Mary Ellen Kleiman National Association of Chain Drug Stores 1776 Wilson Blvd. Arlington, VA Douglas G. Bonner Womble Carlyle 1200 Nineteenth Street NW, Suite 500 Washington, DC Rebecca E. Jacobs Womble Carlyle 1200 Nineteenth St NW, Suite 500 Washington, DC