Sending a letter with a large transparent window on the front, Aetna recently revealed approximately 12,000 people's names and use of HIV medication. Recipients included people living with HIV, as well as HIV-negative people using pre-exposure prophylaxis (PrEP) for HIV prevention.
Jason Crittenden, an Aetna client in Chicago, was one of the many who received the letter. He told TheBody.com it was glaringly obvious that the information would be visible to anyone who saw the envelope.
On Thursday, the AIDS Law Project of Pennsylvania and Legal Action Center in New York City sent a letter to Aetna on behalf of 23 individuals who received the letters, telling the insurer that this was a gross breach of privacy and demanding that the company stop sending the letters and take corrective measures to ensure that a similar breach does not happen again.
Aetna clients in at least nine states (Arizona, California, the District of Columbia, Georgia, Illinois, New Jersey, New York, Ohio and Pennsylvania) received the letter. The combination of the letter's layout and the envelope's extra-large cellophane window allowed medical information to be visible to anyone who saw the letter at the post office, in the mailbox or on top of a pile of unread mail inside their home.
"I used to do HIPAA [Health Information Portability and Accountability Act] consulting, so my first thought was probably more, 'Oh my god, how could somebody be so stupid.'" Crittenden said. He said he wasn't worried for himself because he has a private mailbox and is relatively open about taking PrEP, but he immediately thought about others who might not be in the same position.
"If they sent that to somebody who is positive and their family doesn't know, I can't imagine the depth of harm that could be caused by such a ridiculously dumb mistake," he added.
Health insurers such as Aetna are subject to HIPAA, a federal law that, with few exceptions, says your health information cannot be shared without your permission. In addition, most states have laws that are specifically designed to keep all information about a person's HIV status confidential. For example, a New York state law protects anyone who has had an HIV test, been exposed to HIV, is living with HIV or is being treated for HIV. Under this law, information about HIV status cannot be released without a specific form signed by the patient, their guardian or their health care proxy.
These laws were put into place to protect individuals from stigma around HIV, which is still a concern. And, now, that stigma can extend not only to people living with HIV who are on treatment, but also people who take HIV medication for HIV prevention, known as PrEP.
"When you're holding confidential information, you have a heightened responsibility to protect that information, and Aetna failed to do that," explained Ronda Goldfein, executive director of The AIDS Law Project of Pennsylvania and the legal issues expert for TheBody.com.
She told TheBody.com that some individuals who had contacted her group reported that family members, roommates and neighbors learned of their use of HIV-related medication because of this mailing.
Aetna told Bloomberg News that 12,000 of these letters were mailed. The company said they used a third-party vendor for the mailing but declined to name the vendor. Aetna is notifying customers of this issue and has apologized saying, "This type of mistake is unacceptable."
Goldfein says her group started with the "cease and desist" letter to Aetna because they wanted to put a stop to the mailing before anyone else's privacy was breached. Their next step is to learn more about how people were harmed by the mailing. She fears that those who received the letters may report the loss of housing or employment or even violence because of having their HIV status revealed.
Anyone who received the letter from Aetna can contact Ronda Goldfein directly.