Until at least July 2011, Accretive failed to provide reasonable and appropriate security for consumers' personal information it collected and maintained by engaging in a number of practices that, taken together, unreasonably and unnecessarily exposed consumers' personal data to unauthorized access. Among other things, Accretive Health created unnecessary risks of unauthorized access or theft of personal information by:

a. Transporting laptops containing personal information in a manner that made them vulnerable to theft or other misappropriation;

b. Failing to adequately restrict access to, or copying of, personal information based on an employee's need tor information;

c. Failing to ensure that employees removed information from their computers for which they no longer had a business need; and

d. Using consumers' personal information in training sessions with employees and failing to ensure that the information was removed from employees' computers following the training. [6]

[E]stablish and implement, and thereafter maintain, or continue to maintain a comprehensive information security program reasonably designed to protect the security, confidentiality, and integrity of personal information collected from or about consumers. Such program ...shall contain administrative, technical, and physical safeguards appropriate to respondent's size and complexity, the nature and scope of respondent's activities, and the sensitivity of the personal infonnation collected from or about consumers, including:

(1) The designation of an employee or employees to coordinate and be accountable for the information security program;

(2) The identification of material internal and external risks to the security, confidentiality and integrity of personal information that could result in the unauthorized disclosure, misuse, loss, alteration, destruction, or other compromise of such information, and the assessment of the sufficiency of any safeguards in place to control the risks. At a minimum, this risk assessment should include consideration of the risks in each relevant area of operations, including but not limited to: (a) employee training and management; (b) information systems, including network and software design, information processing, storage, transmission, and disposal; and (c) prevention, detection, and response to attacks, intrusions, and other system failures;

(3) The design and implementation of reasonable safeguards to control the risks identified through risk assessment and regular testing and monitoring of the effectiveness of the safeguards' key controls, systems, and procedures;

(4) The development and use of reasonable steps to select and retain service providers capable of appropriately safeguarding personal information they receive from respondent, and requiring service providers by contract to implement and maintain appropriate safeguards; and

(5) The evaluation and adjustment of the information security program in light of the results of the testing and monitoring required by [this Order], any material changes to operations or business arrangements, or any other circumstances that Defendant knows or has reason to know may have material impact on the effectiveness of the information security program. [7]

• The FTC Consent Order requirements may track HIPAA requirements, including undertaking a risk assessment.

• The FTC appears to be requiring Accretive to undertake some sort of vetting process of subcontractors to ensure that they are "capable of appropriately safeguarding personal information they receive from" Accretive, in addition to entering into business associate agreements.
  

• In some respects, it would have been better for Accretive if it was OCR that brought an action because OCR's resolution agreements are generally for about 5 years. But, the FTC's agreement is for 20 years.