Aetna to pay $1.15 million civil penalty after leaking 2,460 members' HIV status

aetna will pay a $1.15 million civil fine, and vowed to improve it's privacy settings to settle charges it leaked the hiv-positive status of 2,460 new york members. during a mailing last summer, the confidential information could be seen in large transparent envelope windows.

new york attorney general eric schneiderman on tuesday said names, claim numbers and hiv medication instructions in the july 28, 2017 mailing were "clearly visible" to outsiders because of how aetna folded letters and inserted them into the envelopes. 

the mailing was intended to notify members of a class action settlement permitting them to buy hiv medication at discounted prices, rather than by mail - where their privacy might be compromised if families or neighbors saw the drug packages. 

"through it's own carelessness, aetna blatantly violated its promise to safeguard members' private health information," schneiderman said in a statement. the attorney general said his office uncovered similar issues with a september 25, 2017 mailing by aetna to 163 new york members with atrial fibrillation, an irregular heart condition.  

the hartford, connecticut-based company neither admitted nor denied any wrongdoing. however, aetna did agree to retain an independent consultant for two years to monitor its efforts to improve member privacy. 

also, last week they agreed to a $17.2 million settlement in the federal court in philadelphia of private litigation over similar claims by more than 11,000 members in new york and other states.

"we have worked to address the potential impact to members following this unfortunate incident. we are implementing measures designed to ensure something like this does not happen again as part of our commitment to best practices in protecting sensitive information," aetna said in a statement.

last month, aetna was bought by cvs health corp in a $69 billion transaction.