HIPAA Blog

[ Friday, March 02, 2018 ]

 

Aetna HIV Mailing Case (and the missing BAA): I was just reviewing the complaint in the countersuit filed by the mail service vendor, KCC, against Aetna (in preparation for my HIPAA breach presentation at the UT Health Law Conference in Houston April 6-8 [y'all come; tell me you read this, and I'll buy you a drink!]), and found something interesting on page 15.  As you may recall, Aetna hired KCC to send a mailing to a bunch of HIV patients, and the letters went out in "window" envelopes, so that some of the print on the content of the letters (presumably the patient name and address) shows through the celophane window.  However, the mailing was poorly configured because instead of simply the patient name and address showing, information relating to the patient's HIV status also showed through.  Well, it looks like Aetna did NOT have a BAA in place with KCC. 

That could be huge.

Jeff [1:15 PM]

Comments: Post a Comment
http://www.blogger.com/template-edit.g?blogID=3380636 Blogger: HIPAA Blog - Edit your Template