Minnesota has suspended the collection license of Accretive Health Inc., a Chicago-based company that lost a laptop computer containing medical records for thousands of patients at two Minnesota hospital systems last summer.
Minnesota Attorney General Lori Swanson's office is also suing Accretive Health for allegedly violating health privacy laws and state consumer protections. The lawsuit claims an investigation showed Accretive had access to patient data through contracts and used that data to assess patients' risk of becoming hospitalized.
The case revolves around a medical privacy security breach that occurred when an Accretive company laptop was stolen from a parked car in Minneapolis. The computer, which has not been recovered, contained personal information records for 23,500 Minnesota patients of Fairview Health Services and North Memorial Health Care.
Both hospital systems had contracts with Accretive to cut costs and increase revenues. The lawsuit accuses Accretive of "slicing and dicing'' the medical data for business purposes without patient consent. The suit includes allegations that Accretive violated state collection laws in some cases, including accusations that collectors provided false or misleading information.
Accretive has said its security procedures have been enhanced since the laptop was stolen and that the company will work with the attorney general's office to resolve the lawsuit.
The cease-and-desist order issued Friday by Minnesota Commerce Commissioner Mike Rothman demands that Accretive disclose the identities of all collectors who have had contact with Minnesota debtors. The firm also was ordered to turn over all letters, notices and other written documents used to collect debt in the state.
Accretive has agreed not to fight the regulatory action. The Commerce Department is conducting its own investigation but the information in the attorney general's suit was enough for Rothman to suspend the company's collections license for at least 20 days, officials said. Reinstatement will depend on the company meeting all conditions, including providing debt collector training materials and "all policies and procedures for protecting and safeguarding of consumers' personal information,'' Rothman said.