Aetna agrees to pay $17 million in HIV privacy breach

Aetna settled a lawsuit for $17 million Wednesday over a 2017 data breach that compromised the privacy of as many as 12,000 people. "Through our outreach efforts, immediate relief program and this settlement we have worked to address the potential impact to members following this unfortunate incident," Aetna wrote in a statement. "In addition, we are implementing measures designed to ensure something like this does not happen again as part of our commitment to best practices in protecting sensitive health information." Aetna had required members to obtain HIV medications through mail-order pharmacies. The affected people had taken medication to treat HIV or to lower the risk of becoming infected with the virus. Aetna changed its policy to allow members to fill HIV prescriptions in person at retail pharmacies, and, in turn, sent out notification letters to anyone who had filled prescriptions for HIV medications. Those letters contained a large envelope window that exposed that sensitive HIV information. The AIDS Law Project of Pennsylvania and the Legal Action Center initially issued a demand letter in late August that the insurer stop the mailings. The company responded, setting up a relief fund for affected people and apologizing.