Table of Contents
Aetna, Inc.’s agreement to pay $17 million to settle a federal class action lawsuit involving a faulty mailing that disclosed the use of HIV medications of thousands of members came swiftly and involved a smaller settlement amount than some observers might have expected.
However, health care entities eyeing the results of this lawsuit—and mindful of any potential OCR settlement that still could come from it—should at a minimum re-examine their mailing practices along with business associate agreements executed with certain vendors, experts say.
“Although errors are bound to happen, organizations need to have safeguards in place,” says Richelle Marting, an attorney with the Forbes Law Group in Overland Park, Kan. “In the case of mailings, you can have a quality check process to look at the window envelopes to ensure only names/addresses are visible. You can have a well-defined process for reviewing third-party business associate relationships to ensure BAAs [business associate agreements] are in place. You can periodically remind staff about common sources of human error and ways to prevent them, or remind them about policies or trending issues.”
Medication Names Were Visible
The lawsuit, filed by the AIDS Law Project of Pennsylvania, New York-based Legal Action Center and the Philadelphia law firm Berger & Montague, P.C. in U.S. District Court for the Eastern District of Pennsylvania, states that information about HIV medication taken by addressees was clearly visible through envelope windows.
Papers filed in support of the settlement allege that Aetna improperly transmitted to its legal counsel and a mail vendor the names of 13,487 customers who had been prescribed HIV medications, and that large, transparent window envelopes revealing confidential HIV-related information were sent to 11,875 of them.
The lead plaintiff in the lawsuit, identified by the pseudonym Andrew Beckett, said his sister learned he was taking HIV medication on July 31 when their mail included an envelope from Aetna addressed to Beckett containing instructions, visible through a large, transparent envelope window, on how to fill his HIV medication prescription. Beckett actually does not have HIV, the lawsuit says, but is taking the medications as a prophylactic measure to prevent being infected.
Plaintiffs who received letters that disclosed their HIV status will receive a minimum payment of $500. In addition, those plaintiffs who allege that Aetna shared their protected health information (PHI) with its legal counsel and a settlement administrator will receive $50.
As part of the settlement, Aetna also agreed to implement a new best practices policy to prevent similar incidents from occurring in the future. Aetna will pay attorneys’ fees and expenses.
Ironically, Aetna’s mailing was an attempt to address privacy concerns raised in two lawsuits filed against the insurer in 2014 and 2015. The company had wanted customers to get their HIV medications exclusively from mail-order pharmacies rather than retail pharmacies, and customers objected, saying that using the mail could breach their privacy. The letter sent by the third-party mailing company on behalf of Aetna was intended to explain the insurer’s revised HIV medication procedures.
Aetna settled with individual plaintiffs in those cases, and as a condition of those individual settlements, it agreed to send a notice to everyone who had been required to obtain HIV medication by mail order. This notice would inform members that they didn’t have to use mail order any longer.
“The case settled more quickly and cheaper than I would’ve expected,” says Jeff Drummond, a HIPAA and cybersecurity attorney at Jackson Walker LLP in Dallas. “Because it was a class action, it’s hard to tell if there just weren’t definable and provable damages, whether the damages were inconsistent across the class, or if there was some other reason for the quick and relatively cheap resolution.”
For example, he tells RPP, “maybe most of the victims are open about their HIV status, or live alone or in some other situation where nobody likely saw the potentially exposing envelope.” He adds, “I suspect that there were few if any people with really bad stories of lost jobs or family strife; those would likely have been played up to push up the settlement amount.”