State sues over lost health data: Attorney general says firm that lost laptop violated patient privacy & consumer protection law

The consulting firm that lost a laptop computer with medical data on 23,500 Minnesotans last summer has been sued by Minnesota Attorney General Lori Swanson, who says it violated health privacy laws and state consumer protections.

Swanson said Accretive Health Inc., hired by two Twin Cities hospitals, was compiling individual medical checklists that included a "frailty'' evaluation, a "complexity" score of patients' physical condition and a prediction of whether a person would be hospitalized.

"Why should anyone other than a doctor have such basic and personal and intrusive information about a patient?'' Swanson said at a news conference in her State Capitol office.

Her lawsuit, filed Thursday in U.S. District Court, seeks an order requiring Accretive to inform Minnesota patients what information it has, how it has been used and where it has been sent.

"No corporation, especially a debt collector, should secretly slice and dice patients' medical statistics in such a way without ... full disclosure to patients,'' Swanson said.

Chicago-based Accretive, a cost and revenue consultant, issued a statement saying it has enhanced its security procedures and will cooperate with Swanson's office to resolve the lawsuit. Company spokeswoman Francesca Luthi said there is no evidence any patient data has been improperly accessed. She declined to answer questions.

The lawsuit stems from an investigation into an unencrypted laptop that was stolen July 25 in Minneapolis from the parked rental car of an Accretive employee.

The computer contained sensitive information on 23,500 Minnesota patients of two Minnesota hospital systems, Fairview Health Services and North Memorial Health Care. Both organizations had contracts with Accretive to help cut costs and boost revenues. Fairview's contract is even deeper, giving Accretive a management role in Fairview's "total cost of care.''

Hospitals respond:

Fairview released a statement saying it is "redoubling'' its efforts to safeguard patient health information.

North Memorial CEO Larry Taylor said his company has systems in place to protect patient information and that Accretive's lost North Memorial files did not include Social Security numbers, credit card numbers, health policy numbers or home addresses.

Swanson's lawsuit alleges that Accretive's loss of the information violates federal and state patient privacy and informed-consent laws. The company also violated state consumer fraud and deceptive trade practices statutes by concealing from patients the extent of its involvement in their health care, the lawsuit alleges.

Asked if Fairview and North Memorial will be sued, Swanson did not answer.

Although it has consulting contracts with local hospitals, Accretive is a licensed debt collector in Minnesota. The lawsuit alleges that the company at times masked its true identity during collection calls and has not complied with all disclosure and registration requirements.

Swanson noted that Accretive Health is part of the New York private equity fund Accretive LLC. In 2009, Swanson's office filed a consumer lawsuit that broke up an affiliation between a major debt collection enterprise involving Accretive LLC and the National Arbitration Forum, then the nation's largest consumer credit arbitration company.