A Pennsylvania man has filed a class action lawsuit against Aetna Inc., accusing it of violating his privacy rights when the insurer mailed him prescription information in an envelope with a large, clear window that disclosed instructions for filling HIV medication.

The 22-page lawsuit was filed late yesterday in federal court in Philadelphia on behalf of 12,000 Aetna policyholders in 23 states.  The complaint also names a yet unidentified vendor that Aetna used to send its mailing.

The plaintiff – a 52-year-old man – filed the lawsuit under a pseudonym to protect his privacy.  The complaint alleges that the man’s sister and the sister’s financée learned about the plaintiff’s condition by “sorting the mail.”  The plaintiff takes HIV medications as part of a regiment of pre-exposure prophylaxis to prevent him from acquiring the disease.

As we reported yesterday, Aetna sent out letters in late July which exposed the policyholder’s name, address and a reference to filling prescriptions for HIV medications through a transparent envelope window.  Aetna has accepted responsibility for the incident and in a public statement called the mistake “unacceptable” and said it was the insurer’s responsibility to “do our best to make things right.”

The complaint charges that Aetna’s actions “revealed HIV-related information of their current and former insureds to their family, friends, roommates, landlords, neighbors, mail carriers and complete strangers.”

It also accuses Aetna of “recklessly” failing to supervise its mail fulfillment vendor “to ensure that the highly sensitive information … was not illegally disclosed to third parties.”  The complaint notes that the industry-standard practice of protecting the contents of a mailing is to use a blank cover page that contains only the recipient’s name and address or to use an envelope without a glassine window.

The seven-count complaint alleges violations of Pennsylvania’s Act 148, which prohibits any individual, including an insurer, from disclosing HIV-related information without consent, together with claims for negligence, negligence per se, breach of contract, invasion of privacy, unfair trade practices under the state’s mini-FTC statute and unjust enrichment.

Thirty-nine states have either HIV-specific privacy laws or general privacy provisions that reference HIV.

This isn’t the first privacy dust up Aetna has faced over HIV prescription coverage.  Aetna faced two separate class actions in 2014 and 2015 which alleged that the insurer “jeopardized the privacy of people taking HIV medications by requiring its insureds to receive their HIV medications through mail and not allowing them to pick up their medications in person at a pharmacy.”  The lawsuits were settled but contained a condition requiring Aetna to send its policyholders a notice telling them that they were no longer required to order their medications through the mail.