[ Friday, May 25, 2018 ]
Aetna HIV Mailing Case Update: I
reported on this case back in March, but it keeps getting more and more interesting. At least the blame game does.
To recap, Aetna send out mailings to beneficiaries with HIV, and the mailing came in window envelopes that allowed the HIV diagnosis to be viewed without opening the envelope. The mailing was actually part of a legal settlement. Having already sued its own mailing company (which responded by blaming Aetna's law firm),
Aetna has now decided to sue the plaintiff's firm that brought the cases that resulted in the settlement. For good measure, they've also sued the nonprofit entity that helped the plaintiffs put the lawsuit together in the first place.
Sweetest part: the underlying settlement was over a Aetna policy that required HIV patients to use mail-order pharmacies. The plaintiffs objected because, due to the specific nature of the drugs, the mail delivery could expose that the plaintiffs were HIV patients. So the underlying case was over an objection about improper disclosure of PHI.
Crazy, man.
Jeff [11:51 AM]
[ Friday, July 17, 2020 ]
I haven't been able to read the whole story here (it leads to a Westlaw paid page), but it looks like Aetna wants the plaintiff's firms that caused their big breach (
discussed here; it was a really bad one involving HIV information) by using window envelopes. This interesting, because this was not Aetna's lawyers, but rather the firms pursuing a class action lawsuit against Aetna. Thus, Aetna has no BAA with them. Also, these law firms are not covered entities, and since they represented the individual plaintiffs, they would not be business associates; thus the firms are not subject to HIPAA for their culpability in the breach. Interesting. . . .
[ Wednesday, October 22, 2008 ]
Aetna and Microsoft's HealthVault: Aetna is
rolling out HealthVault to its subscribers to use to make their Aetna-internal PHR portable. We'll see how it works. Personally, I tried tinkering around in HealthVault and found it relatively user-unfriendly and non-intuitive (jeez, who'da thunk Microsoft would make a user-unfriendly, non-intuitive product? Vista, anyone [and I don't mean the VA's EHR product]).
Jeff [10:40 AM]
[ Thursday, February 08, 2018 ]
Aetna HIV mailings: When the sh*t hits the fan, it s
platters everywhere. Aetna agreed to about $20 million in fines and damages, sued its claims administrator KCC, who in turn counterclaimed against Aetna, claiming that Aetna's attorneys, Gibson Dunn & Crutcher, bear responsibility too.
Jeff [1:13 PM]
[ Friday, March 02, 2018 ]
Aetna HIV Mailing Case (and the missing BAA): I was just reviewing
the complaint in the countersuit filed by the mail service vendor, KCC, against Aetna (in preparation for my HIPAA breach presentation at the UT Health Law Conference in Houston April 6-8 [y'all come; tell me you read this, and I'll buy you a drink!]), and found something interesting on page 15. As you may recall, Aetna hired KCC to send a mailing to a bunch of HIV patients, and the letters went out in "window" envelopes, so that some of the print on the content of the letters (presumably the patient name and address) shows through the celophane window. However, the mailing was poorly configured because instead of simply the patient name and address showing, information relating to the patient's HIV status also showed through. Well, it looks like Aetna did
NOT have a BAA in place with KCC.
That could be huge.
Jeff [1:15 PM]
[ Sunday, October 14, 2018 ]
Latest development:
Aetna pays the NJ Attorney General $365,000 as a fine for the data breach involving the use of window envelopes to send notices to beneficiaries receiving HIV medications. As noted earlier, the window envelopes allowed the potential disclosure of PHI to unintended recipients.
Update: Aetna
also has settled with the AGs of Connecticut, Washington State, and DC.
[ Monday, October 15, 2018 ]
It was the biggest HIPAA breach ever, one of the biggest of any sort of breach involving personally-identifiable information: hackers got access to the medical records of almost 80 million people. While it's still unclear what damage was done, O
CR has finally weighed in with how much it'll cost Aetna: $16 million. That's almost 3 times the previous record of $5.5 million.
Update: AP story is
here.
[ Friday, August 25, 2017 ]
The Trouble with Window Envelopes: It's nice to use envelopes where the address of the recipient is only printed on the page inserted into the envelope, but is visible through a window in the outer envelope. It saves costs, as well as reduces the possibility of a mismatch between the information in the insert and the information on the envelope (i.e., the wrong letter gets inserted into the wrong envelope).
However, if you're going to do so, make sure ONLY THE NAME AND ADDRESS show through the window.
I think Aetna's gonna be in trouble for this. . . .
Jeff [2:05 PM]
[ Wednesday, January 06, 2021 ]
As I noted in early December, I had back surgery, and was out for a couple of weeks. Follow that up with the Christmas and New Years holidays, making for a couple of 3-day weeks, plus the fact that I've been less than optimal physically due to the back pain that precipitated the surgery, and I've fallen behind in my blogging duties. I'll try to catch up this month, and here's my first installment of "what I shoulda told you a couple of months ago." And don't worry, I'll report on the NPRM soon enough; suffice it to say, it's small potatoes, but if it becomes final, you'll have some paperwork to do.
Aetna Settles 3 breaches from 2017 for $1,000,000: These included (i) PHI-containing web services that were internet accessible without passwords or credentials; (ii) a mailing to HIV patients using window envelopes that allowed the words "HIV medication" to show through the window, and (iii) another mailing to research participants with the name and logo of the research study on the envelope. The resolution agreement and action plan, which includes an implementation report and 2 annual reports, are here.
Ransomware and other security incidents are on the rise, and disproportionately affecting healthcare entities: The FBI specifically warned of a wave of cyber-attacks specifically directed at the healthcare industry. It's Russians using Ryuk. And the potential for such an attack being lethal was made clear in September when a German hospital suffered a hacking incident and a patient died as a result. All of this came out about the same time as new news of the particular vulnerability of IOT-connected medical devices. As far as we know, other than in movies and spy novels, nobody's hacked the pacemaker or insulin pump of a corporate executive or politician and demanded ransom, but it's clearly possible.
PACS server vulnerabilities: I already discussed the PACS system issue, but if you want to read some inside baseball on this, here's a researcher discussing how he was able to access petabytes of x-ray, MRI, and CT images, without hacking, over the internet. It's not for the faint of heart -- he showed that not only could you view images and steal data, you could upload fake images to these PACS systems. Hat tip: Joel Lytle.
City of New Haven (CT) fined for failure to terminate former employee's access to PHI: The city's health department, which operates a clinic, didn't remove a former employee's credentials to access its medical records, and the employee snooped into about 500 files before being discovered. The PHI included STD test results (lovely). The city had not done a risk analysis (of course), and under the resolution agreement paid a fine of over $200,000.
That's enough for now, more later.
Jeff [8:34 AM]
[ Tuesday, August 29, 2017 ]
Aetna HIV data breach: Well,
that was fast. Those class action lawyers can outrun an ambulance.
Jeff [2:57 PM]
[ Tuesday, February 10, 2015 ]
Anthem Breach: Secondary Impacts on Employers. One thing to think about when you hear of big insurers being subject to a data breach: in many cases, while the company usually does have a great deal of insured beneficiaries (either through direct insurance purchases or fully-insured employers), almost all have a great many more beneficiaries covered as TPAs or otherwise. For example, most Americans with private insurance are insured by employers who have self-funded insurance plans. Those self-finded insurance plans then go and hire Anthem, United Healthcare, Blue Cross Blue Shield, Cigna, Aetna, or some other entity to administer those plans, and those third-party administrators (or TPAs) are usually insurance companies themselves; that makes sense, since they must know how to administer the employer's self-funded plan if they can administer their own insurance products.
So, when an insurer like Anthem suffers a breach, many of the impacted individuals will be direct Anthem subscribers, but more will likely be beneficiaries of some employer who hired Anthem as a TPA of its self-insured plan.
Thus, in addition to pondering Anthem's fate, and what Anthem ought to do, it makes sense to also ponder what those self-insured plans and plan sponsors ought to do. Interestingly, here's an employment law boutique
with a blog post on just that. Something for employer clients of Anthem to consider, for sure, and useful thoughts for all employers with either fully-insured or self-insured/TPA plans. Additionally, it's worth it for employers to start thinking about what they would do if such a breach occurred with their own TPA.
Update: Here's
another (shorter) blog post with an additional good point: check your BAAs to see who is responsible for notifications. Of course, if you are (i) a HIPAA covered entity or (ii) a HIPAA business associate with any possible breach notification obligations, you should already have breach notification communication tools (set channels of communication, form letters, vendors chosen if not actually lined up, etc.) in place, ready to pick up and use.
Jeff [10:06 AM]
[ Thursday, May 28, 2009 ]
AEtna Web Site Hacked: 65,000 people offered credit monitoring: It's a job application website, not medical records, so not exactly a HIPAA issue.
Jeff [10:20 AM]
http://www.blogger.com/template-edit.g?blogID=3380636
Blogger: HIPAA Blog - Edit your Template
