Lawsuit: Debt collector broke patient privacy laws
MINNEAPOLIS — Minnesota Attorney General Lori Swanson sued a debt collection agency on Thursday, saying it failed to protect the confidentiality of health care records for thousands of state residents and did not reveal the extent of its involvement in their health care.
The lawsuit says Accretive Health Inc., a Chicago-based company that works with hospitals to maximize revenue, gained access to patient data through contracts with two Minnesota hospitals, then scored patients’ risk of becoming hospitalized. Swanson said the agency then shared its activities with investors on Wall Street “without the knowledge or consent of patients who have the right to know how their information is being used and to have it kept confidential.”
A spokeswoman for Accretive, part of a New York private equity fund, did not immediately return messages seeking comment.
The lawsuit claims Accretive violated state and federal health privacy laws, state debt collection laws and state consumer protection laws. It seeks an order that would require Accretive to tell patients what information it has on them, what information it lost, where it sent the information, and why it has the information in the first place.
It also seeks an injunction that would hold Accretive accountable and restrict how Accretive treats and uses patient data in the future.
The lawsuit comes after an Accretive agent lost a laptop in July in Minneapolis that contained the data of 23,500 patients of Fairview Health Services and North Memorial Health Care. The laptop was stolen.
According to a “screen shot” that was sent to a patient who requested it, the laptop contained identifying information such as the patient’s name, address, birthdate and Social Security number. It also included a checklist noting whether a patient has 22 different chronic medical conditions, ranging from HIV to seizure disorders.
The screen shot included numeric scores to predict the complexity of a patient’s needs and the probability of hospitalization.
Swanson said Accretive gained access to the data through contracts with the hospitals. Swanson said as part of the contracts, Accretive largely controls and manages the “revenue cycles” of the two hospitals — including things like scheduling, registration and billing — then receives compensation and incentive pay for helping hospitals boost revenue or cut costs.