Here’s a stark reminder of the responsibilities – and risks – of being a business associate: Aetna is suing the company that mailed 12,000 envelopes last summer revealing the recipients had HIV for $20 million and more.
Aetna hired claims administrator Kurtzman Carson Consultants (KCC) to send letters notifying Aetna members of a settlement the payer reached after some had challenged the payer’s policy of restricting HIV drug prescription refills to mail order.
Business Associate Chose Wrong Envelope
KCC mailed the letters in window envelopes, and many revealed the words “HIV medications.” Recipients quickly cried fowl about the personal health information breach (PHI), and Aetna was forced to compensate for the breach after two advocacy organizations sued.
A class-action lawsuit settlement included a $17 million pay-out to members and $1.15 million fine to the State of New York. Aetna also volunteered to provide counseling and other services to those hurt by the breach.
According to the suit, which was obtained by Reuters, Aetna not only wants KCC to pay for damages but the insurer wants to be held harmless for future costs and other liabilities related to the breach
