Aetna in $17M settlement for HIV privacy breach

Aetna Inc. agreed to pay $17.2 million to settle a class-action lawsuit over a July mailing that breached the HIV privacy of thousands of the health insurer's customers, attorneys for the plaintiffs said Wednesday.

The breach is believed to be the world's largest involving HIV privacy, the attorneys said.

The bulk of the class members — 11,875 Aetna customers who received a benefits notice in an envelope with a large plastic window that could have exposed their HIV status to mail carriers, roommates, neighbors, and family members — will receive an automatic payment of $500.

They may also submit claims for up to $10,000 in financial distress and $10,000 in other harm, according to the settlement filed in U.S. District Court for the Eastern District of Pennsylvania in Philadelphia where it awaits approval.

An additional 1,610 individuals whose protected health information was allegedly improperly disclosed by Aetna to its legal counsel and mail vendor but did not receive the faulty benefits notice will receive an automatic payment of $75.

Ronda B. Goldfein, executive director of the AIDS Law Project of Pennsylvania, in Philadelphia, said in a news release that stigma associated with HIV remains pervasive. "The fear of losing control of HIV-related information and the resulting risk of discrimination are barriers to health," she said. "This settlement reinforces the importance of keeping such information private."

In addition to the AIDS Law Project, the Legal Action Center in New York and the Philadelphia law firm Berger & Montague PC were involved in the litigation.

The Aetna mailing last summer was in response to the settlement of two lawsuits in 2014 and 2015 alleging that Aetna had jeopardized the privacy rights of customers by requiring them to obtain HIV medication solely through the mail, instead of in person at a retail pharmacy. That settlement required Aetna to notify customers that they could fill prescriptions for HIV medications through mail order or retail pharmacy. The company it hired to handle the mailing used an envelope with an address window that was so big that it exposed part of the letter containing the letters HIV.

"Through our outreach efforts, immediate relief program and this settlement we have worked to address the potential impact to members following this unfortunate incident," Aetna said in a statement. "In addition, we are implementing measures designed to ensure something like this does not happen again as part of our commitment to best practices in protecting sensitive health information."

After about $6 million in aggregate base payments of $500 and $75, as much as $4.3 million in attorneys' fees and costs, $100,000 in aggregate split among 37 named plaintiffs, and up to $180,000 for the cost of administering the settlement, about $6.5 million will remain for individuals who file claims for financial and other harm.

Separately, the AIDS Law Project and the Legal Action Center have submitted 13 requests for relocation expenses ranging from $2,500 to $18,000, and two requests for counseling, all of which Aetna has approved under an agreement announced in late September.