Accretive's stolen laptop contained patient names, Swanson says
The Minnesota Attorney General's office today leveled new allegations of wrongdoing by Accretive Health, the former debt collector for Fairview Health Services. This is the latest step in a more-than-six-month saga sparked by a laptop stolen from an Accretive employee's rental car.
Swanson's new court filing said that in addition to sensitive information on 23,000 patients, the unencrypted laptop also included the names, but no personal health information, of about 242,000 Fairview Health System patients.
The filing, an amended complaint in a federal lawsuit, cites this statement in Accretive's 2010 Annual Report: "Data and information regarding our customers' patients is encrypted when transmitted over the Internet or traveling off-site on portable media such as laptops or backup tapes."
The court documents also said there was a pattern of problems. "In response to a U.S. Senate inquiry, on May 11, 2012, Accretive indicated that nine company laptops containing patient data were stolen in 2011 alone. It further indicated that over 30 company laptops had not been encrypted."
Create a More Connected Minnesota
MPR News is your trusted resource for the news you need. With your support, MPR News brings accessible, courageous journalism and authentic conversation to everyone - free of paywalls and barriers. Your gift makes a difference.
The filing said Accretive did not alert Fairview about one laptop stolen from the back seat of an Accretive employee's rental car in the parking lot of an Old Mexico Restaurant in Roseville.
"Fairview learned of the incident about a year later ...through anonymous tips. This caused Fairview to question whether the [subsequent] loss of the laptop [with information on 242,000 patients] could have been prevented if Accretive had taken steps to alert Fairview of the incident and better train its employees not to leave laptops in plain sight in cars."
Swanson also accused Accretive of collecting debts in Minnesota for a period of time without a proper license and sending collection letters to Minnesota patients that were signed by fictitious individuals who posed as "patient financial advisors."
Swanson's amended complaint also appears to be upping the stakes in her investigation of Accretive's relationship with North Memorial another hospital company. Last month Swanson alleged Accretive and North Memorial lacked a business associate agreement required by law for sharing patient information, and that when she asked for the document last October officials for the two companies signed one but dated it from last March. Now the new court filing goes so far as to call that an act of "deception."
"At no time until the Attorney General uncovered the deception did Accretive or North Memorial advise the Attorney General that the business associate agreement was really signed in October, 2011."
In response, Accretive continues its combative tone. A statement from a communications firm identifying itself as representing Accretive said Swanson's latest charges are merely "selected allegations from an April 'Compliance Review,' which contain numerous mischaracterizations and distortions of documents and facts. The Company plans to move to dismiss the seconded amended complaint in its entirety."
Fairview declined to comment on the specifics of the amended complaint but said it continues to cooperate with Swanson's "review of these issues." North Memorial did not immediately respond to a request for comment. A court hearing in the case is scheduled for July 6 before a federal magistrate in St. Paul.