Following a $17 million settlement earlier this year, Aetna has agreed to pay three states nearly $650,000 to resolve investigations into a 2017 incident in which it disclosed members’ HIV status.
The insurance giant will pay fines to Connecticut, Washington, New Jersey and the District of Columbia where attorneys general were investigating an improper disclosure of patient information. In July 2017, Aetna sent mailings to 12,000 members that inadvertently revealed their HIV status through a transparent window in the envelope.
In a separate incident two months later, Aetna mailed letters to 1,600 individuals about a study for patients with atrial fibrillation, inadvertently revealing their diagnosis.
New Jersey Attorney General Gurbir Grewal negotiated the largest civil penalty totaling more than $365,000. Aetna will pay $175,000 to D.C. and nearly $100,000 to Connecticut (PDF). Washington's attorney general office was involved in the investigation but had not yet returned a request for the sum of its settlement. Earlier this year, Aetna agreed to pay a $1.15 million fine to the state of New York.
“Companies entrusted with individuals’ protected health information have a duty to avoid improper disclosures,” said Attorney General Grewal in a statement. “Aetna fell short here, potentially subjecting thousands of individuals to the stigma and discrimination that, unfortunately, still may accompany disclosure of their HIV/AIDS status. I am pleased that our investigation has led Aetna to adopt measures to prevent this from happening again.”
RELATED: Aetna will pay $17M to settle HIV privacy breach lawsuit
As part of the settlements, Aetna agreed to implement new policies, protocols and training reforms aimed at safeguarding patient information. The company will also hire an independent consultant to monitor privacy compliance.
“Through our outreach efforts, immediate relief program and recent settlements we have worked to address the potential impact to members following this unfortunate incident,” and Aetna spokesperson said in a statement. “In addition, we are implementing measures designed to ensure something like this does not happen again as part of our commitment to best practices in protecting sensitive health information.”
Last year’s incident gained significant attention and prompted a class-action lawsuit, which Aetna settled for $17 million. The insurer later sued the company that sent the mailings as well as the consumer advocacy groups that initiated the lawsuit.