The privacy breach affected 12,000 customers across the nation, in eight states and the District of Columbia. The letter says that the insurer potentially violated the Health Insurance Portability and Accountability Act (HIPAA), which, among other things, protects the privacy of patients' medical information.
"This type of mistake is unacceptable", Aetna said in a statement, according to Bloomberg. That's why HIV status is confidential under federal law, and Aetna is in serious trouble for disclosing the HIV status of thousands of people, all because it was too cheap to print addresses on envelopes.
"We sincerely apologize to those affected by a mailing issue that inadvertently exposed the personal health information of some Aetna members", the company said in a statement.
The envelope had a plastic window that in some cases showed not just the customer's name and address, but also the names of medications, exposing some recipients' HIV status.
The letter says the company learned of the issue on July 31 and subsequently determined that the incident may have a caused a breach of some members' protected health information.
The demand letter was sent by the attorneys on behalf of individuals in Arizona, California, Georgia, Illinois, New Jersey, New York, Ohio, Pennsylvania, and Washington, D.C. The questionable envelopes were also used on letters sent to those on a prescription regimen called pre-exposure prophylaxis, which helps prevent people from acquiring HIV.
Friedman said she was unaware of any legal action now underway but that many letter recipients have filed complaints with government regulators, such as the Office of Civil Rights at HHS.
"These privacy violations have caused incalculable harm to Aetna beneficiaries", the letter states.
Many of these customers have filed complaints with agencies such as the Office of Civil Rights of the Department of Health and Human Services, the legal firms wrote.
Sally Friedman, the director of the Legal Action Center in New York City, and Ronda B. Goldfein, executive director of the AIDS Law Project of Pennsylvania, along with six other organizations, sent Aetna a demand letter Thursday to get the company to cease sending out the letters and right its wrongs. She fears that those who received the letters may report the loss of housing or employment or even violence because of having their HIV status revealed.