Blame game rages between Aetna, claims administrator over envelope privacy breach

Photo Source: The Legal Action Center

Despite a settlement in January wherein Aetna agreed to pay roughly $17 million to resolve class action suits related to a privacy breach involving the use of envelopes with transparent windows, a blame game is raging between the insurance giant and the claims administrator that actually mailed the notices in the faulty envelopes.

Back in July, Aetna sent notices to about 12,000 members informing them that after settling class actions challenging their rules, members would be allowed to fill prescriptions in person or by mail. However, the notices were sent in envelopes with large transparent windows  that showed their names, addresses, claim numbers and the first line of the notice which read in part "when filling prescriptions for HIV medications."

[Also: Aetna pays $17 million to settle lawsuit over envelope breach]

Monday, Aetna filed a filed their own lawsuit in Philadelphia federal court blaming the claims administrator they hired for the notification, Kurtzman Carson Consultants, for sending out the settlement notices in the improper envelopes and exposing members' sensitive medical information. They accused KCC of gross negligence in the suit and are demanding they pay all of Aetna's costs related to the incident, claiming that KCC never tested the mailing to ensure privacy nor got approval for the mailing from Aetna's lawyers.

Aetna is demanding KCC not only pay their costs, but also either return or destroy all confidential health records used in the notification. The complaint alleges that KCC has refused to comply with their request regarding the records.

KCC has fired back with a suit of its own casting the blame on Aetna and its lawyers for the privacy breach. Though the suit only names Aetna as a defendant, it blames the payer and its lawyers Gibson Dunn saying they knew what envelopes KCC planned on using for the mailing. The complaint said KCC sent all draft notices to Gibson for approval.

"Aetna and Gibson knew that windowed envelopes were being used in the mailings in question," the suit alleges. "KCC provided samples of the letters to Aetna and Gibson, and those letters demonstrated that windowed envelopes would be used. Aetna and Gibson approved the form and content of the letters before they were transmitted."

The suit also accuses Aetna of sending KCC too much private health information on the members in question and of failing to properly encrypt the information when it was sent.

"Information specific to Coventry insureds was not password protected, nor was it sent via a secure file transfer protocol," according to the suit. "Instead, Gibson simply emailed Coventry insured information in an unsecured fashion from Gibson to KCC."

Aetna is currently on the hook for about $20 million total, which includes the class action lawsuits and also a $1.15 million fine from the New York Attorney General's investigation of the unlawful disclosure.

Twitter: @BethJSanborn
Email the writer: beth.sanborn@himssmedia.com