A Greek philosopher notably observed that the only constant in life is change. And so goes the collection industry. Just when collection agencies thought they could breathe a collective sigh of relief after implementing Regulation F, new state and federal statutes and regulations have come to the fore which potentially impact collection agencies. This article will focus on two areas of change which are underfoot and should be carefully monitored for further developments.
A growing number of states are turning their attention to consumer data privacy. As of June 2022, five states have enacted such legislation: California, Colorado, Connecticut, Virginia, and Utah. Additionally, nine states are considering have pending legislation and more are likely on the horizon. Collection agencies should pay close attention to ascertain their impact and what changes may be necessary to data privacy policies and notices.
Coverage for the acts vary but generally, if an entity conducts business and processes a threshold amount of personal consumer data within a state with a data privacy act, it can be subject to legislative requirements. Such requirements generally include both consumer rights and affirmative obligations on parties who use and house data. Generally speaking, consumers are provided with the following rights: (a) the right to know and access their data; (b) right to correct, delete, or obtain a copy of their personal data; and (c) the right to determine whether a business may share or sell their personal information. Additionally, those controlling data are generally required to: (a) provide a secure and reliable way for consumers to exercise their rights; (b) have a written information security program in place which limits the collection of personal data to what is adequate, relevant, and reasonably necessary; and (c) provide consumers with a reasonably accessible, clear, and meaningful privacy notice.
While most data privacy acts do not include a private right of action, they are subject to enforcement by the state. Generally, this requires advance notice of a violation and between a 30 and 60 day right to cure before any action is taken. In some states, violations are treated as deceptive trade practices and will carry substantial fines and penalties.
Collection agencies should be attentive to data privacy legislation and, if covered, review and adjust their policies and procedures accordingly.
|States with Enacted Consumer Data Privacy Statutes||Statute||Effective Date|
|California||Cal. Civ. Code §§ 1798.100 et seq.||1/1/20|
|Colorado||C.R.S. §§ 6-1-1301 et seq.||7/1/23|
|Connecticut||2022 Ct. SB 6||7/1/23|
|Virginia||Va. Code §§ 59.1-571 et seq.||1/1/23|
|Utah||Utah Code §§ 13-61-101 et seq.||12/31/23|
The No Surprises Act took effect January 1, 2022 and establishes patient protections against surprise medical bills and particularly, those associated with emergency services. 42 U.S.C. §300gg et seq. The No Surprises Act is directed to healthcare providers and prohibits the collection of balance bills or out-of-network cost-sharing for emergency care, non-emergency care from out-of-network providers at certain in-network facilities, or air ambulance services from out-of-network providers. Id. The Act additionally prohibits the collection for uninsured consumers or those not using insurance, such amounts where either: (a) no good faith estimate was provided to the consumer and the consumer did not opt out; or (b) the bill exceeds the good faith estimate by more than $400.
While debt collectors are not subject to the No Surprises Act, in January 2022, the CFPB issued Bulletin 2022-1 which “reminded” debt collectors and consumer reporting agencies of their obligations under the FDCPA and FCRA, including when collecting, furnishing information and reporting medical debts covered by the No Surprises Act. Specifically, the CFPB Bulletin opines that the FDCPA’s prohibition on false representations as to the “character, amount or legal status of any debt” includes misrepresenting that a consumer must pay a debt stemming from a charge that exceeds the amount permitted by the No Surprises Act. Since then, the CFPB has issued a couple of reports focusing on the collection and credit reporting of medical debts, making it clear the CFPB is invested in this space.
On the heels of the No Surprises Act, state legislatures have taken up the mantle, as well. A number of states have either passed or are considering legislation which addresses similar billing issues. Some of these go a step further and are directed to collection agencies collecting medical debt. Collection agencies with a multi-state footprint should be tracking medical debt legislation and determining the import on their collection practices. For instance, Vermont’s Patient Financial Assistance Act (the “Act”) (which was enacted in May and takes effect July 1, 2022) requires certain disclosures in all written and oral communications and, for those patients who qualify for financial assistance, requires a payment plan with monthly payments that do not exceed 5% of the patient’s gross monthly household income. See 18 V.S.A. §§ 9483 and 9484. Similarly, Colorado’s Healthcare Billing for Indigent Patients Act, while only directed to healthcare providers, limits the indirect and direct collection efforts by providers and requires that certain conditions precedent are met prior to collection. C.R.S. § 25.5-3-501 et seq.
Other states are considering similar legislation. For instance, North Carolina’s House is considering a bill which aligns with the No Surprises Act by placing additional restrictions on “large health care facilities” by requiring that they: (a) implement a written medical debt mitigation policy which contains a financial assistance policy for emergency and medically necessary procedures, the eligibility criteria for financial assistance, and a billing and collections policy; (b) screen patients, particularly uninsured patients, to determine their eligibility for financial assistance; and (c) provide access to translation services for limited English proficient patients. See H1039. (to be codified as N.C.G.S. §§ 131E-214.23-214.26). Additionally, the bill proposes billing and collection rules. Id.
Those collecting medical debt should continue to monitor state and federal legislation and review and adjust their policies and procedures accordingly. The No Surprises Act alone necessitates compliance departments look for ways to mitigate risk as the CFPB has made clear that seeking to collect amounts which exceed those allowed by the No Surprise Act violate the FDCPA.
Collection agencies collecting medical debt should, at a minimum,
- UNDERSTAND their healthcare clients’ billing and collection procedures and what, if any, changes are being made to conform with state and federal legislation.
- REVIEW AND AMEND their Collection Services Agreements with impacted healthcare providers as appropriate. Such amendments might include requiring the provider provide a copy of their current billing and collections policies and continue to provide updates as made and include certain warranties, such as:
- that the amounts being forwarded for collection have been reviewed by the provider and are within the amounts allowed pursuant to all pertinent state and federal statutes and that all financial assistance eligibilities have been reviewed and exhausted; and
- that the health care provider has complied with all state and federal statutes prior to undertaking any collection efforts on covered accounts.
- REVISE scripts and letters as appropriate to ensure that any state or federally mandated notices are included.
- ANALYTICS should be run on disputed accounts. Disputes stemming from complaints that the amounts billed do not comply with the limitations set by state or federal law should be reviewed carefully. Regular reports should be run to identify any clients with high volume billing disputes to determine whether there is a systemic issue.
Collection agencies should continue to monitor both federal and state legislation outside the traditional debt collection realm for changes which may impact their processes and procedures. While data privacy and medical collections are on the forefront in part because of technology and the pandemic, other changes are also likely as we proceed forward. Collection agencies should continue to assess and evaluate their policies and procedures to ensure compliance with all federal and state law and adjust as needed.