Aetna Inc. is suing a legal support firm for $20 million, blaming it for breaching the privacy of thousands of customers with a mailing that disclosed HIV information.
In a lawsuit filed Monday in federal court in Pennsylvania, Aetna said Kurtzman Carson Consultants LLC, an administrative support company for legal and financial businesses, is responsible for "errors, omissions and gross negligence" related to a mailing to about 12,000 Aetna members. The mailing "potentially disclosed" protected health information, Aetna said.
Drake D. Foster, general counsel at KCC, said in an email Tuesday that the company denies the allegations, which he called "demonstrably false."
"KCC deeply empathizes with people affected by this incident and intends to respond to Aetna consistent with the rights and responsibilities related to this matter," he said.
A spokesman for Aetna declined to comment.
Aetna reached a $17 million settlement last month in a federal class-action lawsuit filed over the privacy breach that disclosed where to purchase HIV medications.
In July, Aetna mailed a notice in envelopes with large, clear windows that showed recipients had been prescribed HIV medications. The lawsuit alleged that the names of 13,487 Aetna customers who had the medications were given to the vendor sending the envelopes and 11,875 received the mailing.
If the proposed settlement is approved by the courts, all members of the class-action will receive between $75 and $500.
The lawsuit began with a Pennsylvania man who said his sister learned he was taking HIV medication when she saw the envelope. The man did not have the virus that causes AIDS but was taking medication as a preventative measure.
Aetna has promised to adopt measures to protect sensitive health information and ensure something like this does not happen again.
In its lawsuit against KCC, Aetna asked a judge for a "hold harmless" ruling, protecting the insurer from all liability, damages, payments, claims and other obligations related to the mailing. It's also seeking damages of at least $20 million.
KCC is a class-action settlement administrator, responsible for mailing documents and handling secure data. Aetna said in its lawsuit that KCC was the administrator for two class-action lawsuits filed against Aetna in 2014 and 2015. Its work included mailing a settlement notice and processing claims, Aetna said.
KCC knew or should have known that it was handling confidential protected health information, including HIV-related information, Aetna said. Specifically, it should have known that the words "HIV Medications" were referenced in the notice below the recipient's name and address, Aetna said.
KCC mailed the notice to members using envelopes with see-through address windows without informing Aetna it would use the envelopes, Aetna said.