Aetna sues company that sent mailings tied to HIV privacy breach

justice scales and gavel
Aetna says the "gross negligence" of a claims administrator is to blame for a privacy breach that occurred last summer.
(Getty/BrianAJackson)

Aetna is suing a company that it says should bear the brunt of the blame for sending letters to thousands of individuals accidentally revealing their HIV status.

The company in question is the claims administrator Kurtzman Carson Consultants (KCC). Last summer, KCC was contracted to send letters notifying 12,000 Aetna customers of a settlement the insurer had reached with members who challenged its policy requiring them to fill HIV medications through mail order.

The letters—which informed the customers of Aetna’s revised policy for filling HIV prescriptions—were mailed in envelopes with a see-through window. That allowed anyone handling them to see the words “HIV medications” below the recipients’ name and address, prompting complaints to pour in from people who said their privacy was breached when friends, family members, neighbors, roommates and others saw the letters.

Aetna took steps to notify customers about the breach and coordinated with two advocacy organizations to offer “immediate relief” for those affected. However, the insurer also was hit with a class-action lawsuit that it settled for $17 million in January, and it agreed to pay the state of New York a $1.15 million fine.

RELATED: In a final appeal to the Supreme Court, CareFirst warns of a ‘flood’ of data breach lawsuits

Citing those settlement costs and other expenses, including legal fees, Aetna now wants KCC to pay at least $20 million in damages. In a complaint filed Monday in federal court and obtained (PDF) by Reuters, the insurer also seeks to be held harmless from future liability and costs tied to the breach.

Aetna claims that the blame rests solely on “the acts, errors, omissions and gross negligence of KCC,” noting that the insurer wasn’t told that the mailings in question would have a see-through window.

In addition, Aetna wants the court to compel KCC to return the confidential information that the insurers’ counsel had provided to the company, which includes the names and information of plan members who received the mailings.

FierceHealthcare contacted KCC General Counsel Drake Foster for comment on the lawsuit, but as of press time he has not responded.