In Tierney v. Advocate Health & Hosps. Corp. (No. 14-3168, 2015 U.S. App. LEXIS 13966 (Aug. 10, 2015)), the Seventh Circuit recently upheld a district court’s dismissal of a proposed class action accusing a hospital of violating the Fair Credit Reporting Act by failing to secure health data maintained on four desktop computers that were stolen from its administrative offices.  The Court held that the hospital was not a consumer reporting agency for FCRA purposes.

The FCRA defines a “consumer reporting agency” as “[a]ny person which for monetary fees, dues, or on a cooperative nonprofit basis, regularly engages in whole or in part in the practice of assembling or evaluating consumer credit information or other information on consumers for the purpose of furnishing consumer reports to third parties … .”  15 U.S.C. §1681a(f).

The Court held that because the hospital was not assembling information “for monetary fees,” it was not a consumer reporting agency under the FCRA.  It found that although the hospital transmitted patient information to insurance companies in order to receive payment, such payment was directly related to “health care services,” and the payment was not related to assembling patient information. 

The Court further reasoned that in order to qualify as a consumer reporting agency as defined by the FCRA, the entity must assemble information “for the purpose of furnishing consumer reports to third parties.”  As set forth in 15 U.S.C. § 1681a(d)(1), the definition of a consumer report includes any communication “bearing on a consumer’s credit worthiness” which is used to establish the consumer’s eligibility for credit, insurance, or other listed purposes.”  Excluded from the definition of a consumer report under the FCRA is “any report containing information solely as to transactions or experiences between the consumer and the person making the report.”

While the information transmitted by the hospital to its insurers had been sent to third parties, and may have been used to determine eligibility for insurance coverage, the information concerned the hospital’s experiences with its own patients and, therefore, falls under the § 1681a(d)(2)(A)(i) exclusion.

While under these circumstances, the hospital was not deemed to be a consumer reporting agency for FCRA purposes, the Court did note that its conclusion does not “confine the Act’s reach to the nation’s three major credit bureaus, as the plaintiffs suggest.  Other entities outside that mold may act in ways that satisfy the statutory definition of ‘consumer reporting agency.’”

The Court’s ruling further supports the position that the applicability of the FCRA involves a factually-specific analysis of how consumer information is handled.