On June 14, 2021, the US Court of Appeals for the 11th Circuit issued an order withholding issuance of the mandate for its April 21, 2021, holding in Hunstein v. Preferred Collection and Management Services, Inc. In Hunstein, the 11th Circuit held that a debt collector faces potential liability under the Fair Debt Collection Practices Act (FDCPA) for transmitting a consumer’s personal information to any third party, including a mailing service used by the debt collector to send dunning letters when attempting to collect on a debt. The withholding of the mandate provides at least some temporary relief for debt collectors, which routinely outsource mailing and other activities as part of their debt collection services to merchants and other creditors and have faced an onslaught of FDCPA class action lawsuits based on the Hunstein rationale related to their use of commercial mail services and other outsourced service providers since the April decision. The full 11th Circuit is expected to reconsider the Hunstein decision, as the defendant debt collector requested on May 25, 2021.

Yet the ultimate impact of Hunstein is unpredictable. New cases and events are happening almost daily, and the uncertainty may last for months or years. The time period in which Hunstein may be finally resolved, and whether Hunstein will be adopted or rejected by the full 11th Circuit or in other circuits, is not clear. Companies are adopting a variety of strategies based on this uncertainty, as outlined in this On the Subject.

IN DEPTH

On June 14, 2021, the US Court of Appeals for the 11th Circuit issued an order withholding issuance of the mandate for its April 21, 2021, holding in Hunstein v. Preferred Collection and Management Services, Inc., that a debt collector faces potential liability under the Fair Debt Collection Practices Act (FDCPA) for transmitting a consumer’s personal information to any third party, including the debt collector’s subcontractors, in connection with collection of a debt unless expressly permitted by the FDCPA. The withholding of the mandate may provide at least temporary relief for debt collectors, which routinely outsource mailing and other activities as part of their debt collection services to merchants and other creditors and have faced almost 300 FDCPA individual and class action lawsuits related to their use of outsourced service providers since the April decision.

Consistent with the internal operating procedures of the 11th Circuit, the order delays the return of jurisdiction over the case to the district court but does not affect the binding nature of the decision on courts in the 11th Circuit. However, the full 11th Circuit is expected to consider the Hunstein decision en banc as requested by Preferred Collections & Management Services, Inc., the defendant debt collector, on May 25, 2021.

Further briefs were filed with the 11th Circuit recently based on a footnote in the new Supreme Court of the United States case TransUnion LLC v. Ramirez, stating that giving customer information to a mail vendor is not “dissemination” and therefore is not an injury in fact. Other amicus briefs assert commercial free speech grounds and a variety of other challenges.

Yet the ultimate impact of Hunstein is unpredictable. New cases and events are happening almost daily, and the uncertainty may last for months or years. The time period in which Hunstein may be finally resolved, and whether Hunstein will be adopted or rejected by the full 11th Circuit or in other circuits, is not clear. Companies are adopting a variety of strategies based on this uncertainty.

This On the Subject discusses the relevant provision of the FDCPA, the district court and 11th Circuit decisions in Hunstein, and implications and suggested next steps for debt collectors and other revenue cycle management companies. In particular, revenue cycle management companies subject to the FDCPA that send dunning letters and other communications through third-party service providers should consider the feasibility of insourcing these functions or other contingency plans, particularly those revenue cycle management companies located or conducting activities in the 11th Circuit, which includes Alabama, Florida and Georgia.

FDCPA Disclosure Prohibition

The FDCPA regulates the debt collection practices of persons that meet its definition of a “debt collector.” The FDCPA broadly defines “debt collector” to mean any person who uses any instrumentality of interstate commerce or the mails in any business the principal purpose of which is the collection of any debts, or who regularly collects or attempts to collect, directly or indirectly, debts owed or due or asserted to be owed or due another. The definition includes exceptions for entities that collect debts owed to themselves rather than a third party. Thus, the definition may include, for example, revenue cycle management companies that send account statements for debts owed by patients to healthcare providers and debts owed by other consumers to merchants that do not require payment in full at the time that a good or service is delivered.

With limited exceptions, section 1692c(b) of the FDCPA broadly prohibits debt collectors from communicating a consumer’s personal information, such as an individual’s status as a debtor and the amount of the debt, with anyone other than the consumer in connection with the collection of a debt. The FDCPA defines “communication” broadly to mean the conveying of information regarding a debt directly or indirectly to any person through any medium. The definition does not expressly distinguish between the conveyance of information to a debt collector’s service providers and other persons. Further, the FDCPA’s communication prohibition does not include an express exception for disclosures to service providers, unlike the disclosure pathways for service providers under the Gramm-Leach-Bliley Act (GLBA), service providers under California Consumer Privacy Act, business associates under the Health Insurance Portability and Accountability Act (HIPAA), or processors under the European Union’s General Data Protection Regulation.

In practice, however, debt collectors, like other businesses, routinely outsource functions to mail vendors or other third-party service providers, and often need to communicate specific information regarding debtors to such service providers to receive the benefit of the outsourced services.

Hunstein District Court Decision

The plaintiff in Hunstein incurred a debt to a hospital arising out of his son’s medical treatment. The hospital assigned the debt to Preferred Collections, which in turn hired a third-party mail vendor to send letters and handle the collection. The plaintiff argued that the debt collector violated the FDCPA’s communication prohibition when it electronically transmitted the plaintiff’s name, outstanding balance and information regarding the source of debt to the mail vendor. The district court dismissed Hunstein’s action for failure to state a claim after concluding that Preferred Collections’ conveyance of information to the mail vendor did not qualify as a communication made “in connection with the collection of any debt.”

Hunstein Court of Appeals Decision

The 11th Circuit reversed the district court’s decision dismissing Hunstein’s complaint on April 21, 2021. In reversing the district court, the appellate court looked no further than the plain meaning of the phrase “in connection with the collection of any debt” and held that the defendant’s transmittal of specific information to the mail vendor was sufficiently related to its debt collection activity and therefore constituted a communication in connection with the collection of a debt for purposes of the FDCPA’s communication prohibition. While the court recognized that its ruling would upset the status quo in the debt collection industry and was unlikely to materially enhance consumer privacy protections, it nevertheless determined that its role was to interpret the law as written, regardless of whether the resulting implications were sensible or desirable.

On May 25, 2021, Preferred Collections requested that the full court reconsider its decision en banc. On June 14, 2021, the court issued the order withholding issuance of a mandate for its April 21, 2021, decision. We are monitoring docket activity in the 11th Circuit for a decision regarding whether the court will reconsider its ruling en banc.

NEXT STEPS

This decision by the 11th Circuit appears to require a significant change in existing operations of revenue cycle management companies that meet the definition of a debt collector under the FDCPA. While the court of appeals may rehear the case en banc, it is not clear that a different reading of the FDCPA will result. Thousands of debt collection communications will be sent to debtors in the interim, which, depending on the en banc case outcome, will arguably allow the one-year statute of limitations under the FDCPA to continue to run.

For now, debt collectors face the risk of FDCPA class action lawsuits if they outsource functions to third-party service providers and communicate debtors’ personal information as part of the outsourcing. Accordingly, some debt collectors subject to the FDCPA are considering bringing such functions (or at least some of them) back in-house for collection activities, particularly if they are located or conduct activities in the 11th Circuit, which includes Alabama, Florida and Georgia. Key to any plan is identifying each of the third-party relationships of the debt collector, the technologies and information transmitted to each third party, and the creditor agreements that impact or protect such transmissions.

Debt collectors may wish to consider the following options:

1. Do nothing different and wait for the final outcome of Hunstein.

2. Bring third-party vendors’ services in-house, where feasible and not overly costly or disruptive.

3. Adopt a multi-pronged approach, which can be adjusted over time as events unfold, that includes the following potential steps:

   • Identify relevant data flows, pathways, and other transmission features or technologies from the debt collector to any third parties, to better develop the factual analysis and defense arguments. Debt collectors should understand which transmissions to third-party service providers are automated communications, with no human “eyes on” viewing or processing of debtor personal information. Debt collectors may be able to successfully assert a defense that there is no “invasion of privacy” (as referenced by the 11th Circuit in the Hunstein opinion) because no person at the service provider actually views the debtor’s personal information.

   • Suspend, adjust or terminate relationships between the debt collector and service providers, at least temporarily. This step might involve leasing or licensing third-party equipment, processes and/or employees of the service provider, if feasible. If relevant third-party activities are curtailed, this may also help limit the one-year statute of limitations under FDCPA.

   • Identify and compile existing individual consent language in customer/client agreements and notices. The consent language may support the defense of debtor consent, which is an exception to the FDCPA’s communication prohibition. To be effective, such consent of the debtor must be communicated directly to the debt collection agency.

   • Compile relevant agreements between the debt collector and its customers to determine how customer agreements allow transmission to the debt collector and the legal justifications for same. The agreements, including HIPAA Business Associate Agreements for debt collectors serving HIPAA covered entities, may support arguments that other laws, such as HIPAA or GLBA, allow transmission of the identical personal information to service providers, including debt collectors, as long as certain precautions are in place. The agreement review should also identity privacy and security precautions regarding data transmission to third parties.

We will continue monitoring developments in the 11th Circuit and any federal legislation proposing amendments to the FDCPA to address debt collectors’ use of service providers.