Aetna Letter Revealed Information About Georgia Patients' HIV Status, Lawyers Say

A group of people in at least nine states, including Georgia, say that information in a letter sent to them by the insurance giant Aetna contained instructions for filling HIV medication prescriptions was clearly visible through the window on the envelope and have demanded that the company stop the practice because it violates state and federal privacy laws.

The letter in question was sent on July 28 and the company was first made aware on July 31 that in some cases, personal health information was visible through the window of the envelope used to sent the letter. After learning of the issue, Aetna investigated and found that the vendor handling the mailing had used a window envelope and "in some cases, the letter could have shifted within the envelope in a way that allowed personal health information to be viewable through the window," Aetna said in a letter to affected customers that was obtained by Patch.

In a press release, the AIDS Law Project of Pennsylvania said the letters were sent to customers currently taking medications for HIV treatment as well as for Pre-exposure Prophylaxis (PReP), which helps prevent a person from acquiring HIV. A demand letter sent on behalf of the individuals who contacted various nonprofits included a photo of a sealed and redacted envelope sent to a customer in Brooklyn, New York, which clearly showed that the information related to filling HIV medication prescriptions was visible through the window of the envelope.

The letter demanded that Aetna immediately cease and desist from breaching the customers' privacy by sending mail that illegally discloses that they are taking HIV medication. The letter also demanded that Aetna take corrective measures.

"A number of the individuals who contacted the above-referenced organizations reported that family members and neighbors learned their confidential information regarding their use of HIV medications as a result of Aetna's breach," the letter said. "Many of them have already filed complaints with administrative agencies, such as the Office of Civil Rights of the U.S. Department of Health and Human Services and state insurance regulators."

Aetna is in the process of fulfilling its regulatory obligations by notifying applicable state agencies as well as the Department of Health and Human Services, Office of Civil Rights, Patch has learned.

The letter sent to Aetna also seeks verification from the insurance company of the corrective measures Aetna has taken.

"We sincerely apologize to those affected by a mailing issue that inadvertently exposed the personal health information of some Aetna members," Aetna said in a statement. "This type of mistake is unacceptable, and we are undertaking a full review of our processes to ensure something like this never happens again."

In the letter sent to affected customers, Aetna said it will work to ensure proper safeguards are in place to prevent something similar from happening in the future.

"The information displayed in the envelope's window was your first name, last name, address, and in some cases, a reference to filling prescriptions for (certain) medications," Aetna said in its letter to affected customers. "The viewable information did not include the name of any particular medication or any statement that you have been diagnosed with a specific condition. Your Social Security number, bank account information and credit card information were not included in the letter."

Aetna also informed customers that they have the Office of Civil Rights of the HHS.

Ronda B. Goldfein, executive director of the AIDS Law Project of Pennsylvania, said in a statement that the privacy violation is far more than a technical violation of the law.

"It creates a tangible risk of violence, discrimination and other trauma," Goldfein said.

Patients in Connecticut, Arizona, California, Illinois, New Jersey, New York, Ohio, Pennsylvania, and Washington, D.C., were affected by the letter.
Photo by Jessica Hill/Associated Press