Aetna accidentally exposed customer HIV statuses (12,000 customers)

[Jim Allen]

Its a terrible mistake and unfortunately stupid mistakes do happen. I say that however do keep in mind that it does not excuse what has happen or the impact it can have on peoples lives and confidence 

Jim

https://www.washingtonpost.com/news/morning-mix/wp/2017/08/25/aetna-accidentally-exposed-customer-hiv-statuses-in-clear-envelope-windows/?utm_term=.c64bcb9d7f1b

Health insurance company Aetna “stunned” some of its customers last month when it accidentally made their HIV statuses visible from the outside of envelopes, two legal groups said Thursday.

The letters, which contained information about changes in pharmacy benefits and access to HIV medications, were sent to about 12,000 customers across multiple states, Aetna confirmed in a statement.

For some of these customers, a plastic window on the envelope exposed not only the patient’s name and address, but also a reference to filling prescriptions for HIV medications. This meant that whoever picked up the mail that day — a family member, a friend, a postal worker — would have been able to see the confidential information, according to the Legal Action Center and the AIDS Law Project of Pennsylvania. It is not known exactly how many customers were affected.

Attorneys from both legal groups wrote to Aetna on Thursday demanding that the company immediately stop sending customers mail that “illegally discloses that they are taking HIV medication.” It also demanded that the insurer take necessary measures to make sure such a breach doesn’t happen again.

[leatherman]

wonder if this ever happens with other health issues? Are diabetics outed by exposed letters discussing insulin price increases? It's such a shame that discrimination, prejudice, and stigma (real and perceived) are so associated with HIV.

after looking at the image, I think the mistake is not that someone ordered the envelope with too large of a window, or that the letter was mis-formatted allowing HIPAA protected patient information to be exposed; but that an envelope with a window was used at all for mail which discussed private patient health information.

there is a flipside to this issue that gets no press though. Several South Carolina state agencies (especially Ryan White ADAP -AIDS Drug Assistance Program) that I work with as a HIV+ consumer representative have been going to great lengths to work around this kind of stigma issue. They are updating all their forms, scrubbing any references to "ADAP", "Ryan White", "HIV". They have changed phone and fax numbers so they don't "look" like other DHEC (Dpt of Health and Environmental Control, the SC state health dpt) contact numbers. References to any medications has been replaced with references to a separate "formulary list". Mail correspondence has always been sent in secure envelopes with unnamed PO Box #s for the return address.

[Wade]

Long story,  but I have no respect nor anything nice to say about Aetna.

[mecch]

This.

I also fear that a VP Pence and god forbid a POTUS Pence will happily requests "lists", sloppily protect the privacy, and there will be, with a Republican congress, a return to persecuting people with health issues such as HIV for their "lifestyle" choices.

That was all over the arguments for dumping ACA and putting in a "Trump care".  Why should patriotic insured Amuricans pay the expenses of slutty depraved STD carriers?

[metekrop]

Please read below :

http://www.cnn.com/2017/08/24/health/aetna-hiv-status/index.html

[Ptrk3]

Metkrop:  I've merged your post with another thread that also discusses the Aetna exposure of HIV status of some of its insured customers in order that the issue be discussed in a single thread.

[metekrop]

Thank you so much! 

I did not know that there was same topic already opened before that of mine.

[harleymc]

I work for an organisation that has large mail-outs to our clients.

We don't do the mail-outs, that is outsourced. I'd find it very surprising if aetna's letters were sent out in house. The  liability may sit with the mailing company.

Before we leap to any conclusions we would need to know if the envelope, the folding of the letter or the formatting have in any way been changed since previous mail-outs that did not cause this distress.

[mecch]

Well obviously there was a massive screwup in the physical handling of the mail.

[zach]

In 90 days I'll be on Aetna, my landlord receives the mail and passes it out.

I may need a PO Box

[zach]

Long story,  but I have no respect nor anything nice to say about Aetna.

Mind telling that story?

[Wade]

No I don't...
I was on an Aetna group policy with the guys I worked with in Key West from the mid to later 80s. Our premium was around 200$ each per month. Our premium jumped to over 700 a month out of the blue. A lot of money in the 80s !

I called and asked why the huge raise thinking it was just a mistake and was told it was because of our age bracket and the geographical location we lived in.
Quite a few had died there by this time.
None of us could afford it and we were all all left uninsured at the height of the epidemic.

There were few rules to play by with AIDS back then.

[Jim Allen]

The update:

January 18, 2018 • By Trenton Straube
https://www.poz.com/article/aetna-pay-17m-mailed-envelopes-revealing-hiv-info

Aetna to Pay $17M Because It Mailed Envelopes Revealing HIV Info
Many of the 12,000 clients reported significant harm—including vandalism and the loss of a home.

[kentfrat1783]

I still feel bad for all of those that had their information released.

But I see these issues everyday at my work. They just let the system print the envelopes and put it in the mail. We’ve pulled so much stuff out that didn’t have a zip code, state or even a mailing address. Automation with no human logic isn’t good for any of us.

I know the money won’t make the news go away but I do hope they can move on and enjoy their lives.

[jcelvis]

Does anyone know how this will work? I was one of these 12,000 people but I have never received any communication.

[Jim Allen]

No idea but settlement would be only a few bucks per person.

Those involved in the class action case will receive a base payment of either $75 or $500 and may seek additional money, according to a press release posted by The AIDS Law Project of Pennsylvania, a nonprofit firm working on the case along with the Legal Action Center and Berger & Montague, PC.

BTW here is the latest update:

https://www.poz.com/article/aetna-responsible-hiv-privacy-breach-says-new-lawsuit

Remember this headline from last month: “Aetna to Pay $17M Because It Mailed Envelopes Revealing HIV Info”? Well, that may not be the last word on the matter. As Reuters reports, the health insurer is now suing its claims administrator Kurtzman Carson Consultants, alleging that KCC is at fault for the privacy breach.

[jcelvis]

So I looked at the case. The payment starts at $500 and goes up to $10000 based on how the individual responds to a series of questions. Each question is rated. Once all initial monies have been sent to victims if there is money left they the remaining amount will be distributed to everyone. I contacted the law office who will be handling the distribution and this is what they’ve said:

As you may know, we have reached a settlement with Aetna.   For more information about the settlement, please read our announcement at
http://www.aidslawpa.org/wp-content/uploads/2018/01/Aetna-HIV-Privacy-News-Release-1-17-2018-revised.pdf

If you received the letter,  you are part of the class.  You don't need to take any action, except update your address with us, if you have moved in the last year.

The settlement has been presented to the Court for approval. If the Court issues preliminary approval of the settlement, you will be sent a written Notice of Settlement by the settlement administrator.    We will continue to post updates about this case on our website  www.aidslawpa.org.

We  are also  in the process of implementing a new settlement website, that is not yet active. It will  become active and accessible when formal written notice of the settlement is issued to the settlement class members. The settlement website address will be www.beckettprivacyclassaction.com.
 
If you have additional questions, please feel free to contact us at 215-587-9377 or by email at aetnaclass@aidslawpa.org.

[Jim Allen]

17 Million ... Relatively speaking I just feel its not a lot considering the scope of the breach.

https://www.poz.com/article/aetna-pay-365k-penalty-new-jersey-revealing-private-hiv-data

Aetna to Pay $365K Penalty in New Jersey for Revealing Private HIV Data
This is in addition to the $17 million settlement the insurer reached with nearly 12,000 customers nationwide.

Health insurer Aetna reached a settlement with New Jersey for potentially disclosing the private health information of nearly 1,000 customers in the state. The case involves two separate mailings—one to people with HIV and another to those with a heart condition. As NorthJersey.com reports, as part of the settlement, Aetna will take steps to safeguard its customers’ privacy and pay a $365,000 penalty.

This is in addition to a $17 million–plus settlement reached with nearly 12,000 individual customers in several states.

That case stems from a class-action suit filed by customers with HIV over whether they were allowed to fill their prescriptions at brick-and-mortar stores as opposed to mail-order pharmacies. Aetna agreed that customers could get their meds at local pharmacies, but when a third-party administrator mailed customers a notification to that effect, it used envelopes with glassine windows that, in some cases, revealed the phrase “HIV Medication.”