Aetna hit with lawsuit over HIV-status privacy breach

Aetna is facing a class-action lawsuit filed on behalf of customers who claim their privacy was breached when they received a letter containing a reference to filling HIV medications that was visible through a window in the envelope. 

The issue came to light last week when two advocacy groups—the Legal Action Center and AIDS Law Project of Pennsylvania—issued a statement outlining the complaints they’ve received from Aetna customers who claim the mailings were seen by family members, roommates and neighbors. 

In response, Aetna issued a public apology and said it is “undertaking a full review of our processes to ensure something like this never happens again.” The insurer had also sent a letter to the 12,000 members who received the letters notifying them of the breach and their rights.

Now, though, the gaffe is a legal matter. Philadelphia-based law firm Berger & Montague filed a complaint (PDF) against Aetna on Monday in the U.S. District Court for the Eastern District of Pennsylvania, demanding that the company cease the practice, reform its procedures and pay damages. The lead plaintiff in the case, according to an announcement (PDF), is a Bucks County, Pennsylvania, man whose sister learned from seeing an Aetna letter that her brother was taking medications to prevent acquiring HIV. 

Aetna letter
This photo, provided by the Legal Action Center, shows a redacted mailing
sent to an Aetna member, which the group says revealed the member's HIV
status through the window of the envelope.

“My law firm and the nonprofit legal organizations with whom we are working believe that the best way to ensure a remedy for the people who received the letters, and suffered harm, is to file a class action suit,” said Sarah Schalman-Bergen, a Berger & Montague shareholder. “We are committed to prosecuting this matter and making sure that this never happens again.”

Indeed, the lawsuit noted that this isn’t the first time Aetna customers have complained about privacy issues related to their HIV prescriptions. Previously, the insurer settled cases brought by members who claimed its policy requiring them to fill HIV medications through mail order, rather than at a pharmacy, jeopardized their privacy. 

Thus, Aetna changed its policy and notified the affected members. But in doing so, it used a third-party mailing vendor, which sent the notices in an envelope with a “large transparent glassine window,” which in some cases made the instructions for how to fill HIV medications visible without having to open the letter.

These actions, the lawsuit said, “carelessly, recklessly, negligently and impermissibly" revealed HIV-related information of Aetna's current and former members to their "family, friends, roommates, landlords, neighbors, mail carriers and complete strangers.”

When reached by email, an Aetna spokesman said the company had no comment on the lawsuit.

At least one state official, meanwhile, has also expressed concern about the privacy breach. New York Attorney General Eric Schneiderman tweeted last week that he sent a letter to Aetna asking for more information: