Life-Health-Dental Insurance · Health Insurance · Private litigation + Data breach
Aetna (CVS Health)
Headline
In July 2017 Aetna mailed about 12,000 members letters about filling prescriptions for HIV medication and PrEP - in envelopes whose transparent window was large enough to display the words through the plastic.
In July 2017 Aetna mailed about 12,000 members letters about filling prescriptions for HIV medication and PrEP - in envelopes whose transparent window was large enough to display the words through the plastic. The irony is exact: those letters were sent to notify members of the resolution of EARLIER privacy litigation, brought because Aetna had required HIV patients to use mail-order pharmacies rather than pick up prescriptions in person. A second mailing in September 2017 exposed about 1,600 people's participation in an atrial fibrillation study the same way (per the New Jersey Attorney General). Aetna paid $17.2 million to settle the class action - base payments of about $500 each, with claims up to $20,000 available for those who could show additional harm - then roughly $640,000 more to New Jersey, Connecticut and DC (Oct 2018), and $935,000 to California (Jan 2019). Counsel's framing was that the harm was in the status being disclosed, full stop: no hacker, no breach of a system, just an envelope specification.
- Severity
- Evidence tierUnassigned
- Claims confirmed
- Last verified2026-08-04
Case status. Private litigation; the legal tier of its sources has not been assigned yet.
Primary source. www.hipaajournal.com/aetna-settles-class-action-lawsuit-filed-victims-hiv-status-data-breach/ — Verified - primary source confirmed.
Terms
Arbitration
Not independently confirmed this pass — standard binding arbitration + class action waiver expected.
Data sharing
Not itemized separately from the DOJ/antitrust findings below.
Fees and billing
SAME DOJ MEDICARE ADVANTAGE KICKBACK/DISABILITY-DISCRIMINATION LAWSUIT (False Claims Act allegations, not findings; U.S. ex rel. Shea v. eHealth, No. 21-cv-11777 (D. Mass.) - motions to dismiss denied March 25, 2026 and the case is in discovery; defendants deny wrongdoing) as Elevance/Humana (see Elevance row for full detail) — Aetna is a named co-defendant alleged to have both paid illegal broker kickbacks AND specifically pressured brokers to enroll fewer disabled Medicare beneficiaries. SAME antitrust/Zelis out-of-network reimbursement conspiracy case as Elevance/UnitedHealth/Cigna/Humana (see Elevance row).
Contacts
Privacy contact. Not recorded.
Legal notice. Not verified this pass. If publicly traded: SEC Form 10-K cover page gives the official corporate address; the Secretary of State business-entity search in the state of incorporation gives the registered agent, which must accept service. If private: the state registered agent is usually the only reliable route.
Mailing address. Not recorded.
Evidence
| Claim | Kind | Support | Sources |
|---|---|---|---|
| 1. The letters were mailed in July 2017. | fact | unsupported | 1 (1 confirmed) |
| 2. Aetna mailed the letters. | fact | contradicted | none recorded |
| 3. About 12,000 members received letters about HIV medication and PrEP. | fact | supported | none recorded |
| 4. The envelope window was large enough to display the words through the plastic. | fact | supported | none recorded |
| 5. The letters notified members of the resolution of earlier privacy litigation over required mail-order pharmacy use. | fact | unsupported | none recorded |
| 6. A second mailing two months later exposed 1,600 people's participation in an atrial fibrillation study. | fact | contradicted | 1 (0 confirmed) |
| 7. Aetna paid $17.2 million to settle the class action. | fact | supported | none recorded |
| 8. Base payments were about $500 each. | fact | unknown | 1 (1 confirmed) |
| 9. Claims up to $20,000 were available for those showing additional harm. | fact | unsupported | 1 (1 confirmed) |
| 10. Aetna paid roughly $640,000 to New Jersey, Connecticut and DC. | fact | unsupported | 1 (0 confirmed) |
| 11. Aetna paid $935,000 to California. | fact | unsupported | 1 (0 confirmed) |
| 12. Counsel's framing: the harm was in the status being disclosed; no hacker, no system breach, just an envelope specification. | characterization | n/a | none recorded |
3 of 12 claims have a confirmed source of their own.
Sources
| Source | Claim | Tier | Status | Quote |
|---|---|---|---|---|
| reporting · 2017-08-25 www.hipaajournal.com/third-party-mailing-error-sees-aetna-plan-members-hiv-status-disclosed-8939/ | Claim 1 | Unassigned | confirmed | “The mailing was sent by a third-party vendor on July 28, 2017.” Quote basis: not recorded. |
| none | Claim 6 | Unassigned | not found | No quote recorded. Quote basis: not recorded. |
| reporting www.hipaajournal.com/aetna-settles-class-action-lawsuit-filed-victims-hiv-status-data-breach/ | Claim 8 | Unassigned | confirmed | “class members who were sent the envelopes with the clear plastic windows will receive a base payment of $500” Quote basis: not recorded. |
| court · 2018-01-16 | Claim 9 | Unassigned | confirmed | “for a total maximum of up to $20,000 in addition to the minimum Base Payment” Quote basis: not recorded. |
| none | Claim 10 | Unassigned | not found | No quote recorded. Quote basis: not recorded. |
| none | Claim 11 | Unassigned | not found | No quote recorded. Quote basis: not recorded. |
Source vault
Link status: Candidate - not yet fetched
| Document | Last fetch | |
|---|---|---|
| Privacy policy aetna.com/legal-notices/privacy-policy.html | Not fetched yet | NO (HTML only) |
| Terms of service aetna.com/legal-notices.html | Not fetched yet | NO (HTML only) |
| Website No URL recorded | Not fetched yet | — |
| Primary source https://www.hipaajournal.com/aetna-settles-class-action-lawsuit-filed-victims-hiv-status-data-breach/ Verification: Verified - primary source confirmed | Not fetched yet | — |
Enforcement
No enforcement actions are linked to this row.
State statute
No HQ state on file, so no state statute applies by headquarters.