Debt collector Med-1 Solutions, LLC, attempted to recover two unpaid medical bills on behalf of Beth Lavallee's healthcare provider. The Fair Debt Collection Practices Act ("FDCPA" or "the Act") required Med-1 to disclose certain information to Lavallee about her debts within a specific time frame. 15 U.S.C. § 1692g(a). Med-1 could satisfy its § 1692g(a) disclosure obligations by including the required information in its "initial communication" with Lavallee or by sending "a written notice containing" the disclosures within five days after that "initial communication." Id.

In March and April 2015, Med-1 sent Lavallee two emails, one for each debt. The emails contained hyperlinks to a Med-1 vendor's web server. Once there, a visitor had to click through multiple screens to access and download a .pdf document containing the disclosures required by § 1692g(a). Lavallee never opened these emails. When the hospital called her in November to discuss a different medical debt, she learned about the earlier debts and was told that they had been referred to Med-1 for collection. She then called Med-1 to inquire about them, but the debt *1051 collector didn't provide the required disclosures. Nor did it send a written notice within the next five days.

Lavallee sued Med-1 for violating § 1692g(a). She alleged that Med-1 never provided the statutory disclosures, either during the November phone call or within five days as required. Med-1 responded that its March and April emails were the "initial communication[s]" and argued that they contained the mandatory disclosures. A magistrate judge, presiding by consent, 28 U.S.C. § 636 (c), granted Lavallee's motion for summary judgment.

We affirm. Med-1 concedes its failure to send Lavallee a written notice within five days of her phone call. This appeal rests on Med-1's contention that its emails were initial communications that contained the required disclosures. But the emails do not qualify under the Act's definition of "communication" because they did not "convey[ ] ... information regarding a debt." 15 U.S.C. § 1692a(2). Nor did the emails "contain" the statutorily mandated disclosures. § 1692g(a). At most the emails provided a means to access the disclosures via a multistep online process. Because Med-1 violated § 1692g(a), the judge was right to enter judgment for Lavallee.

I. Background

Lavallee incurred two debts for medical services provided by a hospital. The hospital referred the debts to Med-1 for collection. Med-1 emailed Lavallee on March 20 and April 17, 2015, sending the messages from "[email protected]" to the email address Lavallee had provided to the hospital. The emails stated that "Med-1 Solutions has sent you a secure message" and featured an embedded hyperlink inviting the recipient to "View SecurePackage":

Neither email was returned to Med-1 as undelivered, but Lavallee doesn't recall seeing them in her inbox. If Lavallee had opened either email and clicked on the hyperlink, she would have been directed via a web browser to a server operated by Privacy Data Systems, Med-1's sister company. She would have seen a screen asking *1052 her to check a box to sign for the "SecurePackage." Checking that box would have activated the "Open SecurePackage" button at the bottom of the screen, and clicking that button would have revealed a screen with "SecurePackage Display" written across the top. Had she selected the "Attachments" tab on that screen, a .pdf file would have appeared. Had she clicked on that .pdf file, she would have seen a pop-up window asking her if she wanted to open the attachment with Adobe Acrobat or save it to her hard drive. Only then could she have viewed the document or downloaded the file and then opened it.

The file contained the disclosures required by § 1692g(a), including the amount of the debt, the consumer's right to dispute the debt, and how to obtain more information about the alleged creditor. This type of notice is commonly called a "validation notice." Durkin v. Equifax Check Servs., Inc. , 406 F.3d 410 , 412 (7th Cir. 2005).

Med-1 received reports from Privacy Data Systems indicating which email recipients had downloaded validation notices. Privacy Data Systems' records show that Lavallee never clicked the "Open SecurePackage" hyperlink and thus never accessed the validation notice stored on the server.

On November 12, 2015, Lavallee received a phone call from the hospital about a different unpaid bill. During that conversation, Lavallee learned that she owed other debts that had been referred to Med-1. This was her first time hearing about the debt collector. Later that day Lavallee called Med-1 and discussed her medical debts with a Med-1 representative. Med-1 did not provide any § 1692g(a) disclosures during that phone call, nor did it send a written notice in the days that followed.

Lavallee filed this action in December 2015 alleging that Med-1 violated § 1692g(a) by failing to deliver the mandatory disclosures orally during the November telephone conversation or in writing thereafter. The case proceeded to cross-motions for summary judgment. Med-1 introduced its March and April emails and argued that they satisfied its § 1692g(a) obligations because they enabled Lavallee to obtain validation notices. The magistrate judge disagreed. She reasoned that the validation notices were never sent because Lavallee never downloaded them-a fact reflected in Med-1's own records. Moreover, Med-1's delivery method-embedding a hyperlink in an email from an unknown sender-made receipt of the notices unlikely. The judge entered summary judgment in Lavallee's favor and awarded statutory damages, costs, and attorney's fees.

II. Discussion

A. Standing

We begin, as we must, with the question of Lavallee's standing. To establish constitutionally adequate standing to sue, a "plaintiff must allege an injury in fact that is traceable to the defendant's conduct and redressable by a favorable judicial decision." Casillas v. Madison Ave. Assocs., Inc. , 926 F.3d 329 , 333 (7th Cir. 2019) (citing Lujan v. Defenders of Wildlife , 504 U.S. 555 , 560-61, 112 S.Ct. 2130 , 119 L.Ed.2d 351 (1992) ). To satisfy the injury-in-fact requirement, Lavallee must establish that she suffered an injury that is "both concrete and particularized." Spokeo, Inc. v. Robins , --- U.S. ----, 136 S. Ct. 1540 , 1548, 194 L.Ed.2d 635 (2016). And while "Congress has the power to define intangible harms as legal injuries for which a plaintiff can seek relief"-including violations of the FDCPA-it "must operate within the confines of Article III." Casillas , 926 F.3d at 333 . So a plaintiff must do more than point to a bare procedural *1053 violation; he must show that the violation harmed or "presented an appreciable risk of harm to the underlying concrete interest that Congress sought to protect by enacting the statute." Groshek v. Time Warner Cable, Inc. , 865 F.3d 884 , 887 (7th Cir. 2017) (quotation marks omitted).

Med-1 concedes that a debt collector's failure to provide a § 1692g(a) disclosure constitutes an injury in fact and instead focuses on causation. But Med-1 made that concession before our recent decision in Casillas . There we applied the injury-in-fact requirement in the § 1692g(a) context. Paula Casillas received an incomplete § 1692g(a) validation notice: It "neglected to specify that [a] notification or request [to dispute or verify the debt] must be in writing ." 926 F.3d at 332 (citing § 1692g(a)(3)-(5) ). But Casillas never explained how this omission "harmed or posed any real risk of harm to her interests under the Act." Id. at 334 . Because "there was no prospect that [Casillas] would have tried to exercise" her statutory rights, the omission of the in-writing requirement didn't constitute a concrete harm. Id. Her suit was predicated on "a bare procedural violation," id. at 339 , and her complaint never alleged how that violation affected an "underlying concrete interest," Groshek , 865 F.3d at 887 .

This case differs from Casillas in two ways. First, the alleged statutory violation is meaningfully different. Unlike Casillas, who received an incomplete validation notice, Lavallee never received any of the disclosures required by § 1692g(a). The debt collector in Casillas disclosed the consumer's statutory rights to dispute the debt and inquire into the creditor's identity; it simply failed to mention the proper procedure for exercising those rights. In contrast, here Med-1 provided Lavallee with nothing. Her right to contest or request verification of the debt-rights that Med-1 is bound by statute to disclose to every debtor-simply never came up.

Second, and significantly, Lavallee was already a defendant in a collection suit brought by Med-1 when the statutory disclosure violation occurred. During her November 12 conversation with Med-1, Lavallee learned that it had already filed a lawsuit against her to collect the relevant debts. Without the knowledge that a consumer in her position is statutorily entitled to dispute and require verification of the debt on which the lawsuit was predicated, Lavallee stood at a distinct disadvantage. If she had known about her rights, she could have disputed and sought verification of the debts-thereby requiring Med-1 to cease the collection action and obtain verification. See § 1692g(b). Because she was already a collection-suit defendant, it's reasonable to infer that she would have exercised her statutory rights, thereby halting the collection litigation, if Med-1 had provided the required disclosures.

In light of Casillas , an FDCPA plaintiff should include an allegation of concrete harm in his complaint. A bare allegation that the defendant violated one of the Act's procedural requirements typically won't satisfy the injury-in-fact requirement. But in Lavallee's circumstances, the complete deprivation of § 1692g(a) disclosures and the fact that she was sued without the benefit of mandatory § 1692g(a) disclosures lends concreteness to her injury.

So this case is distinguishable from Casillas . Med-1 raises a different standing challenge, but we can make short work of it. Med-1 maintains that because Lavallee never opened the disputed emails, she lacks standing to argue that they were inadequate. But recall that Med-1 brought the emails into this case in an effort to prove that it had satisfied its statutory obligations. Indeed, Lavallee didn't learn *1054 about the emails until this litigation was underway. Lavallee alleged in her complaint that Med-1 violated § 1692g(a) when it failed to send her a written validation notice within five days of the November 12 phone call. That failure inflicted the cognizable harm described above. Med-1 introduced the emails as evidence of its compliance with § 1692g(a). Med-1 was free to do so, but once it did, Lavallee was free to argue that the emails were deficient. Med-1's standing challenge is meritless.

B. Section 1692g(a) Violation

We review a summary judgment de novo, construing the record and drawing all reasonable inferences in Med-1's favor as the nonmoving party. Severson v. Heartland Woodcraft, Inc. , 872 F.3d 476 , 480 (7th Cir. 2017). The facts here are undisputed, so our task is to determine whether Lavallee "is entitled to judgment as a matter of law." FED. R. CIV. P. 56(a).

The judgment against Med-1 rests on its violation of § 1692g(a). Thus far we've only summarized the statute. In full, § 1692g(a) provides:

Within five days after the initial communication with a consumer in connection with the collection of any debt, a debt collector shall, unless the following information is contained in the initial communication or the consumer has paid the debt, send the consumer a written notice containing-

(1) the amount of the debt;

(2) the name of the creditor to whom the debt is owed;

(3) a statement that unless the consumer, within thirty days after receipt of the notice, disputes the validity of the debt, or any portion thereof, the debt will be assumed to be valid by the debt collector;

(4) a statement that if the consumer notifies the debt collector in writing within the thirty-day period that the debt, or any portion thereof, is disputed, the debt collector will obtain verification of the debt or a copy of a judgment against the consumer and a copy of such verification or judgment will be mailed to the consumer by the debt collector; and

(5) a statement that, upon the consumer's written request within the thirty-day period, the debt collector will provide the consumer with the name and address of the original creditor, if different from the current creditor.

The statutory disclosure obligation is triggered by an "initial communication with a consumer in connection with the collection of any debt." The FDCPA defines "communication" as "the conveying of information regarding a debt directly or indirectly to any person through any medium." § 1692a(2).

Everyone agrees that the November 12 phone conversation between Lavallee and a Med-1 employee was a "communication." And if it was the initial communication, Med-1 was required to send Lavallee a validation notice within five days. Med-1 concedes that it did not. So to prevail on appeal, Med-1 must persuade us that its March and April emails were "communications" under the FDCPA.

As we've just explained, to qualify as a "communication" under the Act, a message must "convey[ ] ... information regarding a debt." Id. Med-1's emails conveyed three pieces of information: the sender's name (Med-1 Solutions), its email address, and the fact that it "has sent ... a secure message." The emails say nothing at all about a debt.

Med-1 insists that the emails should count as communications because they contain the name and email address of the *1055 debt collector. We disagree. Though we haven't yet addressed the FDCPA's definition of "communication," the Sixth and Tenth Circuits have held that to constitute a communication under the Act, a message must at least imply the existence of a debt. In Brown v. Van Ru Credit Corp. , the Sixth Circuit held that a message that didn't "imply the existence of a debt" wasn't a communication because "whatever information [was] conveyed [could not] be understood as 'regarding a debt.' " 804 F.3d 740 , 742 (6th Cir. 2015). In Marx v. General Revenue Corp. , the Tenth Circuit considered a fax that didn't "indicate to the recipient that [it] relate[d] to the collection of a debt" or "expressly reference debt," and that could not "reasonably be construed to imply a debt." 668 F.3d 1174 , 1177 (10th Cir. 2011). The fax was therefore not a "communication" under the Act. Id.

This understanding of "communication" is firmly rooted in the statutory text. "To convey is to impart, to make known." Id. at 1182 ; accord Convey , THE AMERICAN HERITAGE DICTIONARY (2d college ed. 1982) ("[t]o communicate or make known; impart"). If a message doesn't inform its reader that it even pertains to a debt, it simply cannot "convey[ ] ... information regarding a debt." § 1692a(2). We therefore hold that a debt collector's message must at least imply the existence of a debt to meet the Act's definition of "communication." Med-1's emails were insufficient.

Med-1 argues that the Eleventh Circuit's decision in Hart v. Credit Control, LLC , 871 F.3d 1255 (11th Cir. 2017), supports its position that a message can qualify as a communication without mentioning a debt. In Hart the court considered the following voicemail: "This is Credit Control calling with a message. This call is from a debt collector. Please call us at 866-784-1160. Thank you." Id. at 1256 . The court ruled that the voicemail was a communication under the Act.

Hart does little to bolster Med-1's case. The Eleventh Circuit reasoned that the debt collector's "voicemail, although short, conveyed information directly to Hart-by letting her know that a debt collector sought to speak with her and by providing her with instructions and contact information to return the call." Id. at 1257-58 . Moreover, it "indicated that a debt collector was seeking to speak to her as a part of its efforts to collect a debt." Id. at 1258 . In sum, Credit Control implied the existence of a debt when it identified itself as a debt collector. Med-1's emails did nothing of the sort. Unlike the voicemail in Hart , the emails did not include the words "debt" or "collector."

Med-1 argues in the alternative that its emails were communications because they were intended to aid its collection efforts. This argument relies on Horkey v. J.V.D.B. & Associates, Inc. , 333 F.3d 769 (7th Cir. 2003), but that case is inapposite: It contains no analysis of the Act's definition of "communication." We looked to the debt collector's purpose solely to determine whether it engaged in harassing " conduct ... in connection with the collection of a debt" under § 1692d. Id. at 773 (emphasis added). Horkey has no bearing on the question presented here.

There is a second and independent reason why the emails don't measure up under § 1692g(a) : They did not themselves contain the enumerated disclosures. To access the validation notice, Lavallee would have had to (1) click on the "View SecurePackage" hyperlink in the email; (2) check a box to sign for the "SecurePackage"; (3) click a link to open the "SecurePackage"; (4) click on the "Attachments" tab; (5) click on the attached .pdf file; and (6) view the .pdf with Adobe Acrobat or save it to her hard drive and then open it.

*1056 At best, the emails provided a digital pathway to access the required information. And we've already rejected the argument that a communication "contains" the mandated disclosures when it merely provides a means to access them. See Miller v. McCalla, Raymer, Padrick, Cobb, Nichols, & Clark, L.L.C ., 214 F.3d 872 , 875 (7th Cir. 2000) (holding that a debt collector did not satisfy § 1692g(a) by providing a phone number that the debtor could call to obtain the required information).

Med-1 analogizes the information available through a hyperlink in an email to the information printed on a letter inside an envelope. The analogy is inapt. An envelope is merely a means of transmitting a letter bearing a substantive message. The letter in Med-1's analogy clearly "contains" the information it imparts. Conversely, Med-1's emails contained nothing more than hyperlinks-gateways to an extended process that ends in the relevant message. The proper analogue is a letter that provides nothing more than the address of a location where the message can be obtained. That hypothetical letter, like the emails here, doesn't "contain" the relevant information.

C. The E-Sign Act

The Bureau of Consumer Financial Protection submitted an amicus brief urging us to affirm on a different ground-one that Lavallee did not raise in the district court or on appeal. The Bureau draws our attention to the E-Sign Act, 15 U.S.C. §§ 7001 et seq. When a statute or regulation "requires that information ... be provided or made available to a consumer in writing," the E-Sign Act imposes conditions on the use of an electronic record to satisfy that disclosure requirement. See id. § 7001(c)(1). The Bureau maintains that Med-1's emails weren't "written notice" under § 1692g(a) because Med-1 failed to satisfy the conditions of the E-Sign Act before sending them.

Because we've resolved this appeal in Lavallee's favor on other grounds, we have no need to address the impact of the E-Sign Act. Moreover, we don't usually consider arguments introduced on appeal by an amicus. See, e.g. , Lopez v. Davis , 531 U.S. 230 , 244 n.6, 121 S.Ct. 714 , 148 L.Ed.2d 635 (2001) ; Sanders v. John Nuveen & Co. , 554 F.2d 790 , 794 (7th Cir. 1977). Appellate courts have the discretion to do so where the parties raised the issue but didn't develop it, see Toussaint v. McCarthy , 801 F.2d 1080 , 1106 n.27 (9th Cir. 1986), or where the issue was of the type that the court has the power to raise sua sponte, see Teague v. Lane , 489 U.S. 288 , 300, 109 S.Ct. 1060 , 103 L.Ed.2d 334 (1989). Neither circumstance is present here.

AFFIRMED