(Reuters) - A day after Aetna sued the claims administrator Kurtzman Carson Consultants for exposing confidential medical information about Aetna clients in a settlement notification, a KCC subsidiary brought a new suit blaming Aetna and its lawyers at Gibson Dunn & Crutcher for failing to protect the privacy of Aetna customers.
The fight between Aetna and KCC, as I told you Tuesday, is over settlement notifications KCC mailed to about 12,000 Aetna healthcare plan members who had filled prescriptions for HIV medications. Plan members had sued Aetna over an announced policy change that would have required them to fill prescriptions for HIV medications by mail. They arguing that the policy compromised their privacy because the medications are delivered in special refrigerated packages. Aetna, represented by Gibson Dunn, ended up agreeing to allow health plan members to continue filling HIV prescriptions at their pharmacies. KCC was hired to send out notifications of the settlement.
The notifications were a disaster. They included transparent windows displaying not just the names, addresses and claim numbers of Aetna clients but also the first sentence of the settlement notice, which included the words, “when filling prescriptions for HIV medications.” The settlement notifications, in other words, contained the exact same public exposure the whole litigation was intended to avert.
In the ensuing uproar from advocates for HIV and AIDS patients, Aetna agreed to pay $17.2 million to resolve several class actions accusing the insurer of disclosing clients’ private health information and to pay a $1.15 million fine to resolve the New York attorney general’s investigation of the privacy breach. Aetna is still facing a class action by Missouri residents and other state AG investigations, as well as an investigation by the U.S. Department of Health and Human Services.
In a complaint filed Monday in Philadelphia federal court, the insurer blamed KCC for the botched notifications, claiming that the claims administrator never told Aetna it was going to mail the settlement notifications in an envelope with a transparent window, never tested the mailing to see what information showed through the window and never asked Aetna or Gibson Dunn to approve the mailing. Aetna wants KCC to indemnify it for the entire cost of the notification disaster.
KCC, however, said in its new complaint in Los Angeles federal court that Aetna and Gibson Dunn knew what the notifications would look like. “Aetna and Gibson knew that windowed envelopes were being used in the mailings in question,” the complaint said. “KCC provided samples of the letters to Aetna and Gibson, and those letters demonstrated that windowed envelopes would be used. Aetna and Gibson approved the form and content of the letters before they were transmitted.” (To be clear, KCC named only Aetna, not Gibson Dunn, as a defendant, but refers throughout the complaint to Gibson Dunn’s actions on Aetna’s behalf.)
The KCC suit also accused Aetna and Gibson Dunn of failing to safeguard patient privacy when Gibson Dunn transmitted information about Aetna clients to KCC. When Aetna’s lawyers passed along the list of health plan members to be notified about the HIV prescription policy, there was no protective order in place. Nor did Gibson Dunn encrypt all of the data it sent to the claim administrator, according to KCC. “Aetna and Gibson shared insured PHI without password protection or encryption, shared far more data than was necessary to perform the notice function, and never warned or notified KCC that the insured information Aetna and Gibson provided to KCC to effectuate the mailings was being provided by Aetna and Gibson in violation of their … obligations under HIPAA,” the KCC complaint said.
KCC, which is represented by Vedder Price, claims Aetna has violated its contract with the claims administrator. It wants a declaration that it is not responsible for Aetna’s liability from the settlement notification disaster and a ruling that Aetna must pay KCC’s costs – including the cost of litigating a pending class action in Missouri in which plaintiffs are trying to add both KCC and Gibson Dunn as defendants.
For both Aetna and KCC, as you can see from the dueling complaints, responsibility for the botched settlement notifications is really an existential question. As a health insurer, Aetna has a moral and legal obligation to protect patient privacy. As a claims administrator, KCC is supposed to know – of all things! – how to mail out a settlement notification without violating recipients’ privacy. If clients and customers can’t rely on Aetna and KCC to do their jobs, they’ll turn to competitors. Whoever screwed up the HIV settlement notice will be dogged by the mistake for years to come.
I emailed Aetna lawyers at Manatt Phelps & Phillips for comment on the new KCC suit but didn’t immediately hear back. Gibson Dunn spokeswomen did not provide comment in response to my emails.