Aetna Mailed 11,875 Letters Through Windows That Showed the Words “HIV Medications”

On July 28, 2017, a mailing vendor working for Aetna sent letters to members about options for filling HIV medication prescriptions. The envelopes had a large transparent window. Through it, along with the name and address, the first lines of the letter were visible, including the words “HIV Medications.” The Legal Action Center and the AIDS Law Project of Pennsylvania sent Aetna a demand letter on Aug. 24, 2017, after members reported that relatives, roommates and mail carriers had read the disclosure.

Aetna put the affected population at about 12,000. Settlement papers later specified that 13,487 members’ names were sent to the vendor and 11,875 received the windowed envelope. A second mailing on Sept. 25, 2017, about an atrial fibrillation study showed the study’s name through the same kind of window to about 1,600 people.

The corpus draws a line between exposure that can be remediated by reissuing something and exposure that cannot. HIV status is on the far side of that line. The people who learned it from an envelope were not attackers with a database to sell; they were the people in a member’s life, and the harm was immediate and specific. Members described being outed to family, losing housing and facing hostility at work.

The class action, Beckett v. Aetna in the Eastern District of Pennsylvania, settled for $17,161,200 in January 2018 and received final approval that October. Every affected member received an automatic payment of $75 or $500 depending on whether the envelope was received, with claims of up to $10,000 available for documented harm.

State attorneys general followed. New York settled for $1.15 million on Jan. 23, 2018, citing the state public health law and HIPAA. New Jersey, Connecticut and the District of Columbia settled in October 2018 for $365,211, $99,959 and $175,000. California settled for $935,000 on Jan. 30, 2019, and required three years of privacy risk assessments. No federal health-privacy resolution was announced.

Aetna later sued the mailing vendor, Kurtzman Carson Consultants, and the law firm that had engaged it, over who bore responsibility for the envelope. The dispute is the sector’s standard shape: the organisation that held the data and the organisation that handled it were different, and the member whose status was disclosed had a relationship with only one of them.