The Health Services Coalition, which represents a consortium of groups in hospital contract negotiations, has filed a federal complaint against the parent of St. Rose, making the startling allegation that Dignity Health used records to contact patients to leverage a better deal.
The complaint, filed with the civil rights division of the federal health and human services department, is something else, alleging after bargaining broke down, the company took extreme measures:
This complaint is being filed to request that the Department of Health and Human Services,
Office of Civil Rights (the “Office”) initiate an immediate investigation into Dignity Health-St. Rose
Dominican Hospital’s ("St. Rose”) inexcusable use of patient names and addresses in an effort
to gain leverage in a business dispute with the Nevada Health Services Coalition (“Coalition”), a
coalition of 19 Member Group organizations of self-funded employer based and/or union affiliated
health plans representing over 230,000 lives in Southern Nevada. Dignity Health-St. Rose
Dominican hospitals ("St. Rose”) is a Covered Entity in Las Vegas, Nevada.
In January 2014, through information obtained from former patient’s medical records, St. Rose,
used PHI to segregate the identities and addresses of hundreds (if not thousands) of patients
(“Former Patients”) who are members of Coalition plans formerly under contract with St. Rose.
Having used PHI to identify these Former Patients, St. Rose sent them letters in an attempt to
persuade those patients to take action with their health plans, favorable to St. Rose, to pressure
on the Coalition to re-contract with St. Rose. This was not a general communication about a
St. Rose product or service for treatment or healthcare operations. Nor was it made for case
management or care coordination. Instead, St. Rose accessed and used PHI in a lobbying effort
designed to enlist the Former Patients to put pressure on their health plans in relation to those
plans’ contractual relationships with St. Rose, all for St. Rose’s pecuniary gain.
The undersigned request that the Office take immediate action to investigate this incident to
determine whether it is a violation of HIPAA’s Privacy Rule. If so, St. Rose should be disciplined
pursuant to the applicable rules. In any event, the Office should issue guidance making clear
that the use of PHI for what amounts to a hospital group’s political campaign over health plan
contractual negotiations is improper and unethical, so that St. Rose and all other Covered Entities
will be on notice that such misuse of PHI will not be tolerated.
The Coalition is a nonprofit entity that negotiates hospital contracts for discounted healthcare
service rates for 19 member group organizations, totaling approximately 230,000 Nevada
residents, who participate in various forms of employer-based and/or union affiliated self-funded
employee group health plans, including both private and public sector plans. Through the
Coalition, these self-funded plans, and therefore hundreds of thousands of Nevada residents,
save millions of dollars every year on hospital services.
The Coalition and St. Rose were not able to reach agreement on hospital service rates during
2013 negotiations. St. Rose simply would not agree to overall reimbursement rates that were
reasonable. The result is that St. Rose is now out-of-network under the Coalition’s member plans.
In response, St. Rose has launched a very public attack on the Coalition, claiming this change not
only “inconveniences” plan participants, but also alleging it is “dangerous” to them. Samples of
St. Rose’s form letters, sent to hundreds if not thousands of patients, are attached.
St. Rose claims their actions were simply to “be informative.” Perhaps, if the St. Rose letters
merely informed the Formerly Covered Members that St. Rose was now out-of-network for the
Coalition member plans, the letters could be characterized as merely “informative,” and might
not give rise to concerns regarding the potential misuse of PHI. However, these letters say and
do much more than inform. Through these letters, St. Rose attempts to make its patients and
former patients (including babies and young children) its bargaining agents – going so far as to
provide a form letter to send to the health plans in order to bring pressure on the Coalition to re-
enter a provider agreement relationship that would be extremely lucrative to St. Rose.
Obviously, these letters pertain directly to a patient or former patient, using each one’s specific
name and address to identify and mail the letters. In turn, the letters are explicit in referring to
each patient’s use of St. Rose in the past for medical care, doing so under a Coalition contract.
Thus, this information relates to individuals’ past physical condition (hospitalized), the provision
of health care (at a St. Rose facility), and to payment for provision of the healthcare (under
Coalition contracts). Further, the use of the Former Patients’ names and addresses is the
quintessential use of identifiable information.
Based upon the Privacy Rule (45 C.F.R. § 160.103) and prior guidance from the Office,
an immediate investigation into whether St. Rose’s conduct was a violation and should be
sanctioned is warranted. Notwithstanding the general rule that “disclosures” of PHI are
generally permitted when the patient is the recipient of that disclosure (See 45 C.F.R. §
164.502(a)(1)), “use” for a covered entity’s own pecuniary gain or, as here, to obtain leverage
in a business dispute, should not be – and are not – insulated. Indeed, the Office has issued
guidance and regulations pertaining to marketing by Covered Entities which are applicable here.
The Privacy Rule generally prohibits targeted commercial communications to patients (referred
to as “marketing” in the Privacy Rule), unless the Covered Entity obtains individual authorization.
See 45 C.F.R. § 164.508. St. Rose’s communications to its Former (and non-contracted) Patients,
constitute a lobbying campaign against the Coalition. Such communications were made for St.
Rose's pecuniary gain, not for any legitimate healthcare benefit to its Former Patients.
Marketing is defined as a communication about a product or service that encourages recipients of
the communication to purchase or use the product or service. See 45 C.F.R. § 164.501. There is
an exception to the required authorization rules that allows hospitals to, for example, announce
new equipment or specialty groups to patients for treatment and health care operations purposes
(45 C.F.R. § 164.501), but that is not what happened here. St. Rose is not trying to promote its
services or products. To the contrary, its letters mention nothing about new services its patients
haven’t already accessed. Instead, it is trying to wear down and pressure its opposing party in a
business dispute – and St. Rose is using PHI to do so. Nothing in the Privacy Rules’ permitted uses
or marketing exceptions is intended to allow this highly invasive and offensive use of PHI.
The Coalition requests that HHS and its Office of Civil Rights initiate and immediate investigation
to determine whether St. Rose’s conduct was a violation of the applicable rules. If so, St. Rose
should be reprimanded and fined pursuant to the rules. Otherwise, the Coalition urges the
Office to further review this course of conduct and issue appropriate guidance to ensure that St.
Rose, and others similarly situated, will never engage in such an inappropriate use of PHI in the
The Health Services Coalition, which represents a consortium of groups in hospital contract negotiations, has filed a federal complaint against the parent of St. Rose, making the startling allegation that Dignity Health used records to contact patients to leverage a better deal.
The complaint, filed with the civil rights division of the federal health and human services department, is something else, alleging after bargaining broke down, the company took extreme measures:
This complaint is being filed to request that the Department of Health and Human Services,
Office of Civil Rights (the “Office”) initiate an immediate investigation into Dignity Health-St. Rose
Dominican Hospital’s ("St. Rose”) inexcusable use of patient names and addresses in an effort
to gain leverage in a business dispute with the Nevada Health Services Coalition (“Coalition”), a
coalition of 19 Member Group organizations of self-funded employer based and/or union affiliated
health plans representing over 230,000 lives in Southern Nevada. Dignity Health-St. Rose
Dominican hospitals ("St. Rose”) is a Covered Entity in Las Vegas, Nevada.
In January 2014, through information obtained from former patient’s medical records, St. Rose,
used PHI to segregate the identities and addresses of hundreds (if not thousands) of patients
(“Former Patients”) who are members of Coalition plans formerly under contract with St. Rose.
Having used PHI to identify these Former Patients, St. Rose sent them letters in an attempt to
persuade those patients to take action with their health plans, favorable to St. Rose, to pressure
on the Coalition to re-contract with St. Rose. This was not a general communication about a
St. Rose product or service for treatment or healthcare operations. Nor was it made for case
management or care coordination. Instead, St. Rose accessed and used PHI in a lobbying effort
designed to enlist the Former Patients to put pressure on their health plans in relation to those
plans’ contractual relationships with St. Rose, all for St. Rose’s pecuniary gain.
The undersigned request that the Office take immediate action to investigate this incident to
determine whether it is a violation of HIPAA’s Privacy Rule. If so, St. Rose should be disciplined
pursuant to the applicable rules. In any event, the Office should issue guidance making clear
that the use of PHI for what amounts to a hospital group’s political campaign over health plan
contractual negotiations is improper and unethical, so that St. Rose and all other Covered Entities
will be on notice that such misuse of PHI will not be tolerated.
The Coalition is a nonprofit entity that negotiates hospital contracts for discounted healthcare
service rates for 19 member group organizations, totaling approximately 230,000 Nevada
residents, who participate in various forms of employer-based and/or union affiliated self-funded
employee group health plans, including both private and public sector plans. Through the
Coalition, these self-funded plans, and therefore hundreds of thousands of Nevada residents,
save millions of dollars every year on hospital services.
The Coalition and St. Rose were not able to reach agreement on hospital service rates during
2013 negotiations. St. Rose simply would not agree to overall reimbursement rates that were
reasonable. The result is that St. Rose is now out-of-network under the Coalition’s member plans.
In response, St. Rose has launched a very public attack on the Coalition, claiming this change not
only “inconveniences” plan participants, but also alleging it is “dangerous” to them. Samples of
St. Rose’s form letters, sent to hundreds if not thousands of patients, are attached.
St. Rose claims their actions were simply to “be informative.” Perhaps, if the St. Rose letters
merely informed the Formerly Covered Members that St. Rose was now out-of-network for the
Coalition member plans, the letters could be characterized as merely “informative,” and might
not give rise to concerns regarding the potential misuse of PHI. However, these letters say and
do much more than inform. Through these letters, St. Rose attempts to make its patients and
former patients (including babies and young children) its bargaining agents – going so far as to
provide a form letter to send to the health plans in order to bring pressure on the Coalition to re-
enter a provider agreement relationship that would be extremely lucrative to St. Rose.
Obviously, these letters pertain directly to a patient or former patient, using each one’s specific
name and address to identify and mail the letters. In turn, the letters are explicit in referring to
each patient’s use of St. Rose in the past for medical care, doing so under a Coalition contract.
Thus, this information relates to individuals’ past physical condition (hospitalized), the provision
of health care (at a St. Rose facility), and to payment for provision of the healthcare (under
Coalition contracts). Further, the use of the Former Patients’ names and addresses is the
quintessential use of identifiable information.
Based upon the Privacy Rule (45 C.F.R. § 160.103) and prior guidance from the Office,
an immediate investigation into whether St. Rose’s conduct was a violation and should be
sanctioned is warranted. Notwithstanding the general rule that “disclosures” of PHI are
generally permitted when the patient is the recipient of that disclosure (See 45 C.F.R. §
164.502(a)(1)), “use” for a covered entity’s own pecuniary gain or, as here, to obtain leverage
in a business dispute, should not be – and are not – insulated. Indeed, the Office has issued
guidance and regulations pertaining to marketing by Covered Entities which are applicable here.
The Privacy Rule generally prohibits targeted commercial communications to patients (referred
to as “marketing” in the Privacy Rule), unless the Covered Entity obtains individual authorization.
See 45 C.F.R. § 164.508. St. Rose’s communications to its Former (and non-contracted) Patients,
constitute a lobbying campaign against the Coalition. Such communications were made for St.
Rose's pecuniary gain, not for any legitimate healthcare benefit to its Former Patients.
Marketing is defined as a communication about a product or service that encourages recipients of
the communication to purchase or use the product or service. See 45 C.F.R. § 164.501. There is
an exception to the required authorization rules that allows hospitals to, for example, announce
new equipment or specialty groups to patients for treatment and health care operations purposes
(45 C.F.R. § 164.501), but that is not what happened here. St. Rose is not trying to promote its
services or products. To the contrary, its letters mention nothing about new services its patients
haven’t already accessed. Instead, it is trying to wear down and pressure its opposing party in a
business dispute – and St. Rose is using PHI to do so. Nothing in the Privacy Rules’ permitted uses
or marketing exceptions is intended to allow this highly invasive and offensive use of PHI.
The Coalition requests that HHS and its Office of Civil Rights initiate and immediate investigation
to determine whether St. Rose’s conduct was a violation of the applicable rules. If so, St. Rose
should be reprimanded and fined pursuant to the rules. Otherwise, the Coalition urges the
Office to further review this course of conduct and issue appropriate guidance to ensure that St.
Rose, and others similarly situated, will never engage in such an inappropriate use of PHI in the
future.
Comments: