AETNA Facing Legal Action for Patient HIV Status Breach

by | Sep 2, 2017

Aetna is facing a class action lawsuit following a privacy breach that saw the HIV positive status of up to 12,000 individuals disclosed against the patients’ wishes.  The individuals names and addresses were visible during a recent mail distribution when details of prescribed HIV medications were identifiable through the transparent windows of envelopes.

The correspondence was in relation to medical benefits and information on how HIV medications could be received. Due to the mistake, which has been attributed to letters becoming misplaced inside the envelopes during delivery, many people had had their HIV status revealed to those close to them.  Breach notification letters have been distributed to the 12,000 individuals on the relevant mailing list. However it remains unclear exactly how many people had details disclosed.

In a recent release, Aetna stated that “this type of mistake is unacceptable,” and revealed that steps are being taken to ensure proper measures are put in place to prevent incidents like this from happening. However, for individuals affected by the incident, serious and irreparable harm has been done.

The Legal Action Center and AIDS Law Project of Pennsylvania contacted Aetna last week insisting the insurer stop sending mail that “illegally discloses” that the plan members are taking HIV medication.”

The class-action legal case has been filed in the U.S. District Court for the Eastern District of Pennsylvania by both organizations and their legal team from Berger & Montague, P.C. The suit insists that Aetna stop the practice of sending data relating to HIV medications via mail, changes standard operating procedures and pays compensation.

In a recent release to the media, the AIDS Law Project outlined that the data breach has caused trauma for some Aetna members whose HIV positive condition was disclosed. The press release referred to one example of a couple in Florida who had to move home due to the disclosure as a result of the fear and embarrassment that they felt

In another case, the sister of a 52-year old male from Pennsylvania discovered that he was taking HIV medication after due to the data disclosure. That man,  the lead plaintiff in the class action lawsuit, does not have HIV but takes the medication as part of a regimen of pre-exposure prophylaxis – to prevent him from contracting the virus.

Aetna conducted the mailing to address alleged privacy violations highlighted in two lawsuits in 2014 and 2015, which were filed after the group required customers to receive their HIV medications in the mail. The named plaintiffs claimed these actions could lead to a breach in their privacy. The legal cases were settled, and the correspondence was sent on July 28, 2017.

By the time that the press release was issued, six AIDS service organizations across the U.S.A. had received “dozens” of official complaints from Aetna customers about the breach.

Sally Friedman, legal director of the Legal Action Center said, “Some have lost housing, and others have been shunned by loved ones because of the enormous stigma that HIV still carries. This case seeks justice for these individuals. Insurers like Aetna must be held accountable when they fail to vigorously protect people’s most private health information.”

Raise the level of HIPAA Awareness in your organization with Learner-Friendly, Comprehensive and Affordable HIPAA Training.


Please enable JavaScript in your browser to complete this form.

Patrick Kennedy

Patrick Kennedy is a highly accomplished journalist and editor with nearly two decades of experience in the field. With expertise in writing and editing content, Patrick has made significant contributions to various publications and organizations. Over the course of his career, Patrick has successfully managed teams of writers, overseeing the production of high-quality content and ensuring its adherence to professional standards. His exceptional leadership skills, combined with his deep understanding of journalistic principles, have allowed him to create cohesive and engaging narratives that resonate with readers. A notable area of specialization for Patrick lies in compliance, particularly in relation to HIPAA (Health Insurance Portability and Accountability Act). He has authored numerous articles delving into the complexities of compliance and its implications for various industries. Patrick's comprehensive understanding of HIPAA regulations has positioned him as a go-to expert, sought after for his insights and expertise in this field. Patrick's bachelors degree is from the University of Limerick and his master's degree in journalism is from Dublin City University. You can contact Patrick through his LinkedIn profile:

Raise the level of HIPAA Awareness in your organization with Learner-Friendly, Comprehensive and Affordable HIPAA Training.

Comprehensive HIPAA Training

Used in 1000+ Healthcare Organizations and 100+ Universities

    Full Course - Immediate Access

    Privacy Policy