FTC Settles with Accretive Health, Says ER is No Place for Debt Collection

On December 31, 2013, the Federal Trade Commission (“FTC”) announced a settlement had been reached with medical billing firm Accretive Health Inc. The lawsuit stemmed from a 2011 incident in which a laptop containing 23,000 consumers personal information, including sensitive health related data, was stolen from an employee’s rental car while parked in a restaurant lot in Minnesota. Accretive Health was charged with violations under the FTC Act for failure to employ reasonable and appropriate measures to protect personal information against unauthorized access. The proposed settlement resolves the agency’s charges and calls for Accretive Health to establish a comprehensive information security program to protect sensitive information. The program will be evaluated by a third party when it is created, and that third party will evaluate the program every two years. According to the FTC, the settlement will be in force for the next 20 years.