Advocate Health Avoids FCRA Claims in Data Breach Class Action

The Seventh Circuit recently rejected the argument that Advocate Health and Hospitals Corporation qualifies as a consumer reporting agency under the Fair Credit Reporting Act (FCRA). The suit, stemming from a July 2013 data breach, hinged on the plaintiffs’ ability to satisfactorily plead that Advocate was a consumer reporting agency and that it was distributing consumer reports.

The plaintiffs claimed that Advocate violated the FCRA by willfully and negligently failing to maintain reasonable procedures to ensure that it did not furnish their consumer reports to unauthorized third parties. The court was brief in explaining that the information compiled by Advocate does not constitute a consumer report, noting the FCRA’s definition expressly excludes reports that solely contain information about a consumer’s experiences or transactions with the entity. Information Advocate sends to third parties such as medical diagnoses is limited to its experiences with the consumer, so it falls under the exception, the court held. That decision alone was enough to affirm the dismissal of the plaintiff’s FCRA allegations. However, the court opted to provide an in-depth discussion of why Advocate, a healthcare provider, is not a consumer reporting agency.

Under FCRA, an entity is a consumer reporting agency if it compiles information about consumers for the purpose of furnishing consumer reports to third parties either for fees or on a non-profit basis. The Seventh Circuit agreed that Advocate compiles information about consumers, but found the plaintiffs failed to sufficiently plead that Advocate is compensated for the purpose of compiling the information and distributing it as a consumer report. Nor was it doing it for non-profit purposes. Instead, the court noted, Advocate collects and transmits patient information to third parties so Advocate can obtain payment for its health care providers. 

TIP: While the Seventh Circuit declined to classify Advocate as a consumer reporting agency, this case was fact-specific and noted that there are entities besides just the major credit reporting bureaus that could fit into the FCRA’s definition.