NLRB Advice Memoranda, Ascension Borgess Medical Center, National Labor Relations Board, (Jan 27, 2021)

The Region submitted this case for advice as to whether Borgess Medical Center (“the Employer”), an affiliate of the Ascension Health network, failed to provide information requested by the Michigan Nurses Association (“the Union”) relating to a collaboration between Ascension and Google involving the sharing of patient health information. We conclude the Employer did not violate Section 8(a)(5) because the requested information involves matters not germane to the employee-employer or collective-bargaining relationship and, thus, is not presumptively relevant. Moreover, because the Union failed to establish the relevance of the requested information to its statutory duties as the unit employees' collective-bargaining representative, the Employer had no duty to provide it. Thus, the Region should dismiss the charge absent withdrawal.

The Employer, which is located in Kalamazoo, Michigan, is one of many hospitals affiliated with Ascension, a multi-state health care system based in St. Louis, Missouri. By mid-December 2019, Ascension had published several news articles about its project collaboration with Google. The project, internally known as “Project Nightingale,” involves the migration, integration, and consolidation of patient electronic health records (“EHRs”) scattered across different hospitals and clinics within the Ascension network onto the Google Cloud platform, and the creation of an interface for caregivers to easily search for patients' EHRs in order to better manage patient care. The project also involves using Google's artificial intelligence resources to analyze patients' health data and recommend changes to their care, with a licensed physician always making the final treatment decisions. Ascension has described its collaboration with Google as improving the patient experience as well as the caregiver experience because the project involves organizing EHRs into a centralized format. In sum, Ascension and Google's collaboration involves the use of Google's technology to create a digital search tool. It is unclear whether the Employer already has implemented this search tool at its hospital.

The Union represents a bargaining unit of approximately 600 registered nurses (“RNs”) employed by the Employer at its hospital. At all relevant times, the parties continued to operate under the terms of their 2016-19 collective-bargaining agreement (“CBA”), which they agreed to extend until one of them provided advance notice of the intent to terminate. [1] Article 8 of the CBA, the management rights clause, stated in part that the Employer has the “sole and exclusive right … to introduce new or improved methods of operation, procedures or equipment, including … the institution of technological changes,” so long as the changes do not conflict with other terms of the CBA. Article 28 of the CBA provides employees with an Ascension-affiliated health plan called SmartHealth and requires the Employer to provide the Union with advance notice of any plan design changes and an opportunity to discuss them. Enrollment in SmartHealth is not a mandatory condition of employment. It is unclear how many unit RNs have either enrolled in SmartHealth or obtained patient care by an Ascension-affiliated caregiver.

On January 2, 2020, the Union requested information about Project Nightingale, which the Union asserts is relevant and necessary to carry out its duties as the RNs' exclusive bargaining representative, citing concerns about Ascension sharing patient information with Google. More specifically, the Union expressed concerns that any patient information provided to Google could possibly violate the federal Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) and the unit employees' privacy rights. The Union requested: (1) the names of unit employees whose private health information (“PHI”) has been shared or made available to Google; (2) copies of the release of information members were asked to sign to allow for sharing of personal data; (3) a copy of the contractual agreement between Ascension and Google for the sharing of medical record data; and (4) the names of unit employees whose name may appear in patient charts which have been shared with Google.

On February 19, the Employer provided its response, objecting to each item of the Union's information request. Regarding requests (1), (2), and (4), the Employer objected on the grounds that the requests are not presumptively relevant as they are unrelated to wages, hours, and other terms and conditions of employment; that patient information is confidential; and that the sharing of patient information for the reasons provided by the Union is not permissible under HIPAA. As for the contract between Ascension and Google (request (3)), the Employer objected on the grounds that the request is not relevant because it is unrelated to wages, hours, and other terms and conditions of employment, and that the request sought an irrelevant third-party contract. The Employer invited the Union to explain the relevancy of each requested item of information and provided the Union with Ascension's news article about its collaboration with Google.

By letter dated February 24, the Union attempted to explain the relevance of the information sought. As for requests (1) and (4), the Union asserted that participation as a patient at Ascension was a condition of employment and, therefore, employees have a right to know if their PHI is being shared in violation of HIPAA and whether Google was gathering employee information contained in personnel files. Regarding request (2), the Union explained that if employees had been asked to sign individual agreements in the course of their duties, that would violate the Employer's obligation to abstain from direct dealing, and that if the execution of such releases was required to obtain patient care under the SmartHealth plan, then that would involve a unilateral change in the plan's design in violation of the CBA. The Union further argued that the requested releases would help the Union understand the extent of the sharing of information to evaluate whether it wishes to remain with SmartHealth as the insurance carrier as the parties were then in contract negotiations, and to assess whether the Employer was engaging in surveillance proscribed by the Act if the Employer receives data about its employees from Google as part of the collaboration. Lastly, regarding request (3), the Union explained that the contract between Ascension and Google is relevant to assess how the collaboration will impact the work of unit employees, and whether unit employees would violate HIPAA and put at risk their nursing licenses by logging patient PHI into charting software sanctioned by the Employer. The Union further explained it requested the contract to assess whether the collaboration involves the sharing of non-PHI information with Google and for what purpose; whether the Employer is engaging in surveillance proscribed by the Act by receiving information about its employees from Google; and whether the collaboration violates the CBA's requirements that the health plan comply with the Affordable Care Act and its requirements regarding the transmission of PHI.

By letter dated March 5, the Employer explained, in part, that participation as a patient at Ascension is not a condition of employment, the collaboration exists solely on the patient-delivery side and is unrelated to the SmartHealth insurance plan, and that no information from employee files is being shared with Google. The Employer then provided three news articles published by Ascension explaining its collaboration with Google. The Employer noted that any employee who is also a patient, and has any privacy concerns related to the collaboration, could contact the call center at the number provided.

We conclude the Employer did not violate Section 8(a)(5) because the requested information is not presumptively relevant. Moreover, because the Union failed to establish the relevance of the requested information to its statutory duties as the unit employees' collective-bargaining representative, the Employer had no duty to provide it.

In NLRB v. Acme Industrial Co., 385 U.S. 432, 435–36 (1967), the Supreme Court stated that “[t]here can be no question of the general obligation of an employer to provide information that is needed by the bargaining representative for the proper performance of its duties.” Generally, information concerning wages, hours, and other terms and conditions of employment of unit employees is presumptively relevant to the union's role as their exclusive collective-bargaining representative because such information is at the “core of the employee-employer relationship,” and an employer is obligated to provide it without the union establishing its precise relevance. Coca-Cola Bottling Co. of Chicago, 311 NLRB 424, 425 (1993) (quoting Curtiss-Wright Corp. v. NLRB, 347 F.2d 61, 69 (3d Cir. 1965)). [2] In contrast, information concerning matters outside the bargaining unit is not presumptively relevant, and an employer is not required to provide it unless the union demonstrates its relevance to the union's representational duties. Coca-Cola Bottling Co. of Chicago, 311 NLRB at 425; see also Sea-Jet Trucking Corp., 304 NLRB 67, 67 (1991) (employees' social security numbers are not presumptively relevant and, thus, need not be furnished absent a showing of their potential or probable relevance). However, the Board has adopted a liberal, discovery-type standard for information requests, and the burden of proving the relevance of nonunit information is not exceptionally heavy. See, e.g., Leland Stanford Junior University, 262 NLRB 136, 139 (1982), enfd. 715 F.2d 473 (9th Cir. 1983). As the Board has recognized, “[p]otential or probable relevance is sufficient to give rise to an employer's obligation to provide information.” Disneyland Park, 350 NLRB 1256, 1258 (2007).

A. The Information the Union Requested is Not Presumptively Relevant

Here, the Union requested information that is beyond the core of the employer-employee relationship. For example, request (1) seeks to identify employees who received patient care within Ascension's network to determine the extent to which the Employer, as a health care and insurance provider for some employees, has shared their PHI with Google. That request for information does not concern wages, hours, and other employment terms, as would have been true, for example, with a request for the unit employees' health insurance claim experience. See, e.g., North American Soccer League, 245 NLRB 1301, 1306 (1979). Indeed, none of the information the Union sought directly related to the unit employees' terms and conditions of employment. Rather, the Union's requests primarily focused on protecting the unit employees' privacy rights as patients – not as employees – of the Employer. See Sea-Jet Trucking Corp., 304 NLRB 67 (social security numbers are not presumptively relevant because “such information does not have a sufficient direct relationship on its face either to employees' terms and conditions of employment or to the administration and enforcement of the parties' collective-bargaining agreement”); Hanlon & Wilson Co., 267 NLRB 1264, 1264 fn. 3, 1267 (1983) (adopting the ALJ's finding that the employer did not unlawfully refuse to provide the union with requested safety and medical records within employee personnel files because the union did not explain the relevance of individually identifiable information), modified on other grounds, 738 F.2d 606 (3d Cir. 1984). For this reason, we conclude that the requested information is not presumptively relevant and, therefore, the Union was required to explain its relevance before a violation of Section 8(a)(5) can be found. As set forth below, the Union did not do so.

B. The Union Did Not Establish that Its Information Requests Were Relevant to Its Duties as the Unit Employees' Bargaining Representative

Initially, the Union's explanations for why the requested information is relevant involve matters outside the parties' collective-bargaining relationship. In this regard, the Union explained that the requested information is relevant to ascertain whether any of the unit employees' PHI or other information, such as place of work and contact information found in employee files, has been shared with Google possibly in violation of HIPAA. HIPAA's Privacy Rule was designed to protect the confidentiality and security of individuals' health care information, set standards for the use and disclosure of PHI by “covered entities,” and establish notice requirements and the process by which individuals can protect their privacy rights. [3] HIPAA does not contain a private cause of action, and any individual who believes their privacy rights have been violated may file a claim with the Department of Health and Human Services. See Dodd v. Jones, 623 F.3d 563, 569 (8th Cir. 2010); see also Warren Pearl Const. Corp. v. Guardian Life Ins. Co. of Am., 639 F.Supp.2d 371, 377 (S.D.N.Y. 2009) (collecting cases across multiple circuits and district courts). Reviewing HIPAA's statutory scheme, it is self-evident that the unit employees' privacy rights vis-à-vis their health care provider arise outside of and are not linked to the employer-employee relationship, nor are they germane to employees' working environment. [4] Because the Union was primarily concerned with whether the Employer's agreement with Google violated the unit employees' HIPAA rights, it failed to establish why it needed the requested information to represent the employees regarding their terms and conditions of employment.

1. The Union Did Not Establish the Relevance of Requests (1) and (4)

Requests (1) and (4), which ask for the names of employees who either have received treatment from Ascension-affiliated caregivers or have provided patient care for the Employer, regardless of whether those names have been shared with Google as part of Project Nightingale, have no connection to the unit employees' terms and conditions of employment. The Union's purpose for request (1), i.e., to ensure that Ascension – as the provider of the SmartHealth insurance plan in the collective-bargaining agreement – complied with HIPAA, strongly suggests the Union seeks that information to investigate a potential complaint with the Department of Health and Human Services, and not for any purpose within the collective-bargaining relationship. Cf. Southern California Gas Co., 342 NLRB 613, 614-15 (2004) (finding information union sought exclusively for purpose of pursuing safety-related complaint against employer before state agency was irrelevant to collective-bargaining relationship and union's role as collective-bargaining representative). In this context, the Union's assertion, which the Employer rejected, that being an Ascension patient through the SmartHealth insurance plan in the CBA is a condition of employment also does not make the requested information relevant. The Union's concerns with the privacy rights of the unit employees – as patients – are unlike other matters affecting employee privacy that the Board has found to be related to terms and conditions of employment. Cf. Colgate-Palmolive Co., 323 NLRB 515, 515-16, 519 (1997) (finding installation of hidden surveillance cameras to be mandatory subject of bargaining because it intruded upon employee privacy at work and had “serious implications for … employees' job security”); Johnson-Bateman Co., 295 NLRB 180, 183 (1989) (finding that drug/alcohol testing of current employees is a mandatory subject of bargaining because it had the “potential to affect the continued employment of employees who become subject to it”); Medicenter, Mid-South Hospital, 221 NLRB 670, 677-78 (1975) (Board majority, adopting the judge's decision, found that a polygraph examination requirement, instituted in response to worksite vandalism, was a mandatory subject of bargaining because it constituted introduction of a new employment-related rule, “disobedience to which may result in forfeiture of employment”).

The Union also explained that the purpose for request (4) was to know whether Google received information from the Employer's personnel files. But Ascension has repeatedly asserted that Project Nightingale is designed to improve patient care, and its news articles about its collaboration with Google do not indicate that employee information gathered by Ascension-affiliated hospitals or clinics as employers is being shared with Google. Indeed, the Employer specifically informed the Union that no employee information found in personnel files has been shared with Google, and the Union did not respond to the Employer with a contrary belief supported by objective evidence to suggest otherwise. Accordingly, the Union relied on mere suspicion that Ascension may be sharing non-PHI employee information with Google rather than a reasonable belief based on objective facts. See, e.g., Sheraton Hartford Hotel, 289 NLRB 463, 464 (1988) (the union failed to establish relevance of nonunit information where it merely advanced a hypothetical theory about how the information might be useful to determine whether the respondent violated the contract); Southern Nevada Builders Assn., Inc., 274 NLRB 350, 351 (1985) (finding the union was entitled to a list of association members bound to the parties' master agreement or “me-too” memorandum, but not a list of every association member; the union's suspicion that some members were engaged in double-breasted operations did not establish the relevance of the information); Bohemia, Inc., 272 NLRB 1128, 1129 (1984) (finding that the union's request for nonunit information was based on mere suspicion and not an any objective factual basis that a possible contract violation had occurred). For these reasons, we conclude the Union has not demonstrated the relevance of how the names of unit employees appearing in patient charts is relevant to the Union's duties as their bargaining representative.

2. The Union Did Not Establish the Relevance of Request (2)

The Union also failed to demonstrate the relevance of its request for copies of any release of information unit employees had to sign to allow the Employer to share their PHI with Google. By letter dated February 24, the Union clarified that if employees were asked to sign individual releases in the course of their duties as RNs, it needed copies to ascertain whether the Employer engaged in direct dealing. The Union also explained that if such releases were required as a condition for employees to receive care from an Ascension caregiver, then they arguably represented a change to the SmartHealth plan's design requiring notice and bargaining pursuant to the CBA. Similarly, the Union explained it needed this information to understand the extent to which the Employer had shared employee PHI to evaluate whether it wanted to keep SmartHealth as the insurance provider in the new CBA and assess whether the sharing of PHI complied with the then-current CBA's requirement that the SmartHealth plan be administered in accordance with the Affordable Care Act. The Union also stated it needed this information to determine if any release agreement authorized the Employer to receive reciprocal data from Google, such as unit employees' cellphone location data or internet search history, to evaluate whether the Employer created the impression of, or was indeed engaging in, surveillance proscribed by the Act.

The Board has held that a union is allowed to reasonably rely on the observations of unit employees in suspecting violations of a CBA to justify a request for information from an employer. See, e.g., Walter N. Yoder & Sons, Inc., 270 NLRB 652, 652 fn. 1, 656 & fn. 6 (1984) (finding the union established the relevance of its information request, in part, by receiving information from one of its agents, several former officials, a shop steward, and a member that the respondent was operating a double-breasted operation), enfd. in relevant part 754 F.2d 531, 534 (4th Cir. 1985). The Board has also stated that actual violations of a CBA are not required, and the information that triggered the request need not be accurate, nonhearsay, or even ultimately reliable. See Shoppers Food Warehouse Corp., 315 NLRB 258, 259 (1994); W-L Molding Co., 272 NLRB 1239, 1240 (1984). Rather, the Union is only required to show that it had a reasonable basis for suspecting a possible breach of contract by the employer. Cf. Disneyland Park, 350 NLRB at 1259 (in finding that the union failed to explain the relevance of nonunit subcontract information, the Board “conclude[d] that the union must claim that a specific provision of the contact is being breached and must set forth at least some facts to support that claim”).

Based on these principles, there is no basis for finding request (2) relevant. In clarifying its request, the Union did not assert to the Employer that it had any reason to believe, either based on information it received from unit employees or any of Ascension's news articles about Project Nightingale, that unit employees had been asked to sign individual release agreements. Consequently, the Union's explanation, standing alone, evinces that request (2) was based on mere suspicion rather than on a reasonable belief supported by objective evidence that the Employer asked any employee to sign a release authorizing the sharing of their PHI with Google. See, e.g., Sheraton Hartford Hotel, 289 NLRB at 464; Southern Nevada Builders Assn., Inc., 274 NLRB at 351; Bohemia, Inc., 272 NLRB at 1129. Similarly, the Union's reliance on Ascension's news articles about its collaboration do not describe any change in unit employees' health plan or administrators, a change in the plan's benefits, or any other change which the Board has found to be a mandatory subject of bargaining. See Prime Healthcare Centinela, LLC d/b/a Centinela Hospital Medical Center, 363 NLRB No. 44, slip op. at 2-3, 22-23 (2015) (where respondent proposed replacing its existing heath care plan, including its plan administrator and new and different network of doctors and health care facilities, the union's requests for information of pressure ulcers, rates of septicemia, or other rates of hospital-acquired infections at those facilities was presumptively relevant to enable the union to investigate the worthiness of an insurance carrier and the quality of care); Mid-Continent Concrete, 336 NLRB 258, 259 (2001) (the implementation of new health plan that resulted in a change of benefits, including higher premiums and changed coverage, is mandatory subject of bargaining), enfd. sub nom. NLRB v. Hardesty Co., 308 F.3d 859 (8th Cir. 2002); Seiler Tank Truck Service, 307 NLRB 1090, 1100 (1992) (“The identity of the health insurance carrier is as much a mandatory subject of bargaining as is the level of benefits to be enjoyed by employees”); Connecticut Light & Power Co., 196 NLRB 967, 968-969 (1972) (an employer must bargain regarding the benefits which may be provided under a health insurance program, as well as the manner in which the program will be administered, and the selection of the insurance carrier), enf. denied 476 F.2d 1079 (2d Cir. 1973). Finally, the Employer responded by letter dated March 5 that the sharing of PHI is not a condition of obtaining patient care by an Ascension-health care provider. Based on the preceding, we conclude that the Union has not demonstrated why copies of any releases of information would be relevant to its representational duties.

3. The Union Did Not Establish the Relevance of Request (3)

Finally, because the third-party contract between Ascension and Google is nonunit information, the Union has the burden of demonstrating its relevance. The Union argues that a copy of the contract will help it assess whether (1) the collaboration impacts the work of unit employees; (2) unit employees would violate HIPAA and put at risk their nursing licenses by logging patient PHI into charting software; (3) the collaboration involves the sharing of non-PHI employee information with Google and for what purpose; (4) the Employer is engaging in surveillance proscribed by the Act by receiving information about its employees from Google; and (5) the collaboration violates the CBA's requirements that the health plan comply with the Affordable Care Act and its requirements regarding the transmission of PHI.

The Union did not establish that the Ascension-Google contract is relevant to its representational duties based on the reasons listed above. First, the record does not establish that the Ascension-Google collaboration has or will have any effect on how unit work is performed. However, even if it did, the Employer explicitly reserved in the mutually-extended CBA's management rights clause, the right “to introduce new or improved methods of operation, procedures, or equipment, including … the institution of technological changes.” Because the CBA grants the Employer the right to act unilaterally, the requested information is not relevant to the Union's representational role on this matter. See, e.g., ADT, LLC d/b/a ADT Security Services, 369 NLRB No. 31, slip op. at 1 & fn. 2 (2020) (citing, among other cases, Emery Industries, 268 NLRB 824, 824-25 (1984)).

Moreover, although the Union has concerns that Ascension's contract with Google may require unit employees to violate HIPAA's Privacy Rule by disclosing patient PHI to a noncovered entity and thereby jeopardize their nursing licenses, this argument is not based on a reasonable belief supported by objective evidence. Moreover, this justification for request (3) is premised on a finding that Project Nightingale violates HIPAA, the enforcement of which would not involve a matter within the parties' collective-bargaining relationship. See Southern California Gas Co., 342 NLRB at 614-15.

As explained previously, the Union's concerns that the Employer is sharing non-PHI information from employee personnel files with Google and possibly receiving information from Google about unit employees that would constitute unlawful surveillance are not reasonable beliefs based on objective evidence. The evidence shows that the Union's concerns are based on mere speculation about the nature of the collaboration with Google rather than on information it obtained from unit employees, Ascension, or the Employer, the latter of which specifically informed the Union that no information from employee personnel files had been shared with Google. Similarly, the Union's concern that the collaboration violates the CBA's requirement that the health plan comply with how the Affordable Care Act requires PHI to be managed is also based on mere speculation rather than a reasonable belief supported by objective evidence. In short, the Union has not provided a valid justification for why request (3) is for information relevant to its role representing the unit employees.

Based on the preceding analysis, the Employer did not have an obligation to provide the Union the requested information. Thus, the Region should dismiss the charge absent withdrawal. This email closes this case in Advice. Please contact us if you have any questions.

Sincerely,

​     ​