Coalition files federal complaint against parent company of St. Rose, alleging patient records used in negotiations

The Health Services Coalition, which represents a consortium of groups in hospital contract negotiations, has filed a federal complaint against the parent of St. Rose, making the startling allegation that Dignity Health used records to contact patients to leverage a better deal.

The complaint, filed with the civil rights division of the federal health and human services department, is something else, alleging after bargaining broke down, the company took extreme measures:

This complaint is being filed to request that the Department of Health and Human Services,

Office of Civil Rights (the “Office”) initiate an immediate investigation into Dignity Health-St. Rose

Dominican Hospital’s ("St. Rose”) inexcusable use of patient names and addresses in an effort

to gain leverage in a business dispute with the Nevada Health Services Coalition (“Coalition”), a

coalition of 19 Member Group organizations of self-funded employer based and/or union affiliated

health plans representing over 230,000 lives in Southern Nevada. Dignity Health-St. Rose

Dominican hospitals ("St. Rose”) is a Covered Entity in Las Vegas, Nevada.

In January 2014, through information obtained from former patient’s medical records, St. Rose,

used PHI to segregate the identities and addresses of hundreds (if not thousands) of patients

(“Former Patients”) who are members of Coalition plans formerly under contract with St. Rose.

Having used PHI to identify these Former Patients, St. Rose sent them letters in an attempt to

persuade those patients to take action with their health plans, favorable to St. Rose, to pressure

on the Coalition to re-contract with St. Rose. This was not a general communication about a

St. Rose product or service for treatment or healthcare operations. Nor was it made for case

management or care coordination. Instead, St. Rose accessed and used PHI in a lobbying effort

designed to enlist the Former Patients to put pressure on their health plans in relation to those

plans’ contractual relationships with St. Rose, all for St. Rose’s pecuniary gain.

The undersigned request that the Office take immediate action to investigate this incident to

determine whether it is a violation of HIPAA’s Privacy Rule. If so, St. Rose should be disciplined

pursuant to the applicable rules. In any event, the Office should issue guidance making clear

that the use of PHI for what amounts to a hospital group’s political campaign over health plan

contractual negotiations is improper and unethical, so that St. Rose and all other Covered Entities

will be on notice that such misuse of PHI will not be tolerated.

The Coalition is a nonprofit entity that negotiates hospital contracts for discounted healthcare

service rates for 19 member group organizations, totaling approximately 230,000 Nevada

residents, who participate in various forms of employer-based and/or union affiliated self-funded

employee group health plans, including both private and public sector plans. Through the

Coalition, these self-funded plans, and therefore hundreds of thousands of Nevada residents,

save millions of dollars every year on hospital services.

The Coalition and St. Rose were not able to reach agreement on hospital service rates during

2013 negotiations. St. Rose simply would not agree to overall reimbursement rates that were

reasonable. The result is that St. Rose is now out-of-network under the Coalition’s member plans.

In response, St. Rose has launched a very public attack on the Coalition, claiming this change not

only “inconveniences” plan participants, but also alleging it is “dangerous” to them. Samples of

St. Rose’s form letters, sent to hundreds if not thousands of patients, are attached.

St. Rose claims their actions were simply to “be informative.” Perhaps, if the St. Rose letters

merely informed the Formerly Covered Members that St. Rose was now out-of-network for the

Coalition member plans, the letters could be characterized as merely “informative,” and might

not give rise to concerns regarding the potential misuse of PHI. However, these letters say and

do much more than inform. Through these letters, St. Rose attempts to make its patients and

former patients (including babies and young children) its bargaining agents – going so far as to

provide a form letter to send to the health plans in order to bring pressure on the Coalition to re-
enter a provider agreement relationship that would be extremely lucrative to St. Rose.

Obviously, these letters pertain directly to a patient or former patient, using each one’s specific

name and address to identify and mail the letters. In turn, the letters are explicit in referring to

each patient’s use of St. Rose in the past for medical care, doing so under a Coalition contract.

Thus, this information relates to individuals’ past physical condition (hospitalized), the provision

of health care (at a St. Rose facility), and to payment for provision of the healthcare (under

Coalition contracts). Further, the use of the Former Patients’ names and addresses is the

quintessential use of identifiable information.

Based upon the Privacy Rule (45 C.F.R. § 160.103) and prior guidance from the Office,

an immediate investigation into whether St. Rose’s conduct was a violation and should be

sanctioned is warranted. Notwithstanding the general rule that “disclosures” of PHI are

generally permitted when the patient is the recipient of that disclosure (See 45 C.F.R. §

164.502(a)(1)), “use” for a covered entity’s own pecuniary gain or, as here, to obtain leverage

in a business dispute, should not be – and are not – insulated. Indeed, the Office has issued

guidance and regulations pertaining to marketing by Covered Entities which are applicable here.

The Privacy Rule generally prohibits targeted commercial communications to patients (referred

to as “marketing” in the Privacy Rule), unless the Covered Entity obtains individual authorization.

See 45 C.F.R. § 164.508. St. Rose’s communications to its Former (and non-contracted) Patients,

constitute a lobbying campaign against the Coalition. Such communications were made for St.

Rose's pecuniary gain, not for any legitimate healthcare benefit to its Former Patients.

Marketing is defined as a communication about a product or service that encourages recipients of

the communication to purchase or use the product or service. See 45 C.F.R. § 164.501. There is

an exception to the required authorization rules that allows hospitals to, for example, announce

new equipment or specialty groups to patients for treatment and health care operations purposes

(45 C.F.R. § 164.501), but that is not what happened here. St. Rose is not trying to promote its

services or products. To the contrary, its letters mention nothing about new services its patients

haven’t already accessed. Instead, it is trying to wear down and pressure its opposing party in a

business dispute – and St. Rose is using PHI to do so. Nothing in the Privacy Rules’ permitted uses

or marketing exceptions is intended to allow this highly invasive and offensive use of PHI.

The Coalition requests that HHS and its Office of Civil Rights initiate and immediate investigation

to determine whether St. Rose’s conduct was a violation of the applicable rules. If so, St. Rose

should be reprimanded and fined pursuant to the rules. Otherwise, the Coalition urges the

Office to further review this course of conduct and issue appropriate guidance to ensure that St.

Rose, and others similarly situated, will never engage in such an inappropriate use of PHI in the