(Reuters) - Who is responsible for what has to be one of the biggest fiascos in the history of settlement notices?
In late July 2017, after Aetna settled a pair of prospective class actions challenging its rules for filling prescriptions for HIV medications, about 12,000 members of Aetna health plans received notification that the insurer would allow them to fill prescriptions in person or by mail. The notifications came in envelopes with large transparent windows showing the names, addresses and claim numbers of the health plan members.
But that wasn’t the only information exposed in the windows. Most of the first sentence of the notification was also displayed - including the words “when filling prescriptions for HIV medications.”
Within days of the mailing, advocacy groups for people with HIV and AIDS began to field calls from patients distressed that the notifications compromised their privacy. At the end of August, Berger & Montague and the AIDS Law Project of Pennsylvania sued Aetna in a class action in Philadelphia federal court – the first of seven class actions blaming Aetna for breaching patient privacy in the settlement notifications. Several state attorneys general opened investigations of the privacy breach, as did the U.S. Department of Health and Human Services.
Aetna rushed to contain the damage. By the end of September, it had set up an emergency assistance program, providing counseling and limited financial assistance to affected plan members and their families. In January, the company agreed to settle the privacy class actions for $17.2 million, without conceding liability. Aetna also agreed to pay a $1.15 million fine to resolve the New York AG’s investigation of the improper disclosure.
So far, Aetna is on the hook for nearly $20 million, not counting its own legal costs, from the botched settlement notification.
Or is it? In a complaint filed Monday in Philadelphia federal court, Aetna blames the claims administrator Kurtzman Carson Consultants (better known as KCC) for sending out settlement notices that exposed plan members’ medical information. Accusing KCC of gross negligence, Aetna wants the claims administrator to pay all of its costs from the epic notification fail.
According to Aetna’s complaint, KCC never told Aetna it intended to mail the 12,000 notifications in an envelope with a see-through window. Aetna claims KCC never tested the mailing to see how much information would be displayed and did not ask Aetna or its lawyers in the original HIV prescription case, Gibson Dunn & Crutcher, for approval of the mailing.
Aetna, represented in the indemnification case by Elliott Greenleaf and Manatt Phelps & Phillips, also wants KCC to return or destroy all of the confidential health records it used in the notice process. According to a filing in the privacy class action, KCC received patient records from Gibson Dunn, which, in turn, got them from Aetna. (According to the plaintiffs’ motion for preliminary approval of the settlement, Aetna now bears the entire cost of the deal but Gibson Dunn and KCC have signed agreements tolling the statute of limitations in the event the settlement fails to win court approval.)
Aetna’s complaint alleges that the company has tried to reach a deal with KCC but KCC has refused to indemnify Aetna or return the confidential information.
I left phone messages for Aetna counsel Frederick Santarelli of Elliott Greenleaf and for KCC executives Daniel Burke and Drake Foster. None got back to me. Gibson Dunn partners and media representatives did not respond to my email request for comment on the Aetna notification disaster.