Minnesota AG Sues Debt Collection Agency For Alleged HIPAA Violations

The Minnesota Attorney General recently filed suit against a company that served as both a debt collection agency and revenue cycle management service provider for hospitals, alleging it violated the federal Health Insurance Portability and Accountability Act (HIPAA) and the Minnesota Health Records Act by failing to protect private patient information it obtained through contracts with two Minnesota hospital systems. The complaint alleges that Accretive Health Inc., the debt collection agency/revenue cycle management service provider, failed to implement policies and procedures to, among other things, (a) prevent, detect, contain and correct security violations, (b) ensure appropriate access to electronic protected health information and prevent access by unauthorized workforce members, (c) train workforce members to maintain security of protected health information, (d) identify and respond to suspected or known security incidents and mitigate harmful effects known to it, and (e) limit physical access to electronic information systems. The violations came to when a laptop computer that contained protected health information on roughly 23,500 individuals was stolen from an employee's car. Although the laptop was password protected, its hard drive was not encrypted. The ability for state Attorneys General to bring cases under HIPAA is relatively new, and has not been a power AGs have exercised frequently. 

TIP: Business associates of healthcare entities should ensure proper policies and procedures are in place to safeguard such information in compliance with HIPAA and to recognize that the hard drive of a laptop that contains protected health should be encrypted to standards set by the Department of Health and Human Services. We likely will see more enforcement for security failures from state Attorneys General in the future as well as the Department of Health and Human Services.