The Aetna world headquarters in downtown Hartford, Connecticut, on Sept. 22, 2011. Photo: Shutterstock

The nation's third-largest insurer, Aetna Inc., has filed a federal lawsuit in Philadelphia against the class action settlement administrator it blames for disclosing the names and conditions of thousands of HIV patients in a mailing.

But the administrator, in turn, sued Aetna in California, charging that the insurer and its agent, Gibson, Dunn & Crutcher, committed negligence and breach of contract for “failure to adequately safeguard the protected health information of thousands of Aetna insureds.” Gibson Dunn is not named as a defendant in the lawsuit, however.

In a lawsuit filed Monday in the U.S. District Court for the Eastern District of Pennsylvania, Aetna alleges that claims administrator Kurtzman Carson Consultants (KCC) was negligent last summer when it sent out notices that, via a glassine window in the envelope, exposed 12,000 patients' protected medical information nationally, including that of 700 residents of Pennsylvania, according to the complaint. The mailed notices related to settlements in two previous class action lawsuits challenging Hartford, Connecticut-based Aetna's procedures for filling HIV medication. Last month, Aetna entered into a $17 million proposed settlement to resolve a nationwide class action breach of privacy lawsuit stemming from the mailings' improper disclosures. The settlement is awaiting judicial approval.

In addition to seeking $20 million in damages from KCC, Aetna's suit also seeks indemnification from the company, and for it to return or destroy all confidential patient data that it received in connection with the mailing.

Aetna claims in the complaint that KCC did not tell the company or its Gibson Dunn lawyers that it planned to use a windowed envelope to mail the notice. Nor did KCC ever test the envelopes to see if any protected health information could be seen through the window, or get approval from Aetna or Gibson Dunn of the final version of the notice in the envelope before mailing it, Aetna alleges in the complaint.

In addition, Aetna claims, KCC should have known that the words “HIV Medications” were referenced in the notice immediately below the recipient's name and address. The complaint also alleges that Aetna has tried to resolve the matter with KCC, but that the company has refused to indemnify it or return its confidential patient information.

In an email, KCC's general counsel, Drake Foster, denied Aetna's “demonstrably false” allegations against the company. “KCC deeply empathizes with people affected by this incident and intends to respond to Aetna consistent with the rights and responsibilities related to this matter,” he said.

California-based KCC responded on Tuesday with its own federal lawsuit in Los Angeles against Aetna, claiming that it was actually Aetna and its legal counsel in the underlying HIV medication cases, Gibson Dunn, that were at fault in the incident.

In its complaint, KCC claims that it provided Aetna and Gibson Dunn samples of the letters, which showed that windowed envelopes would be used, and that Aetna and Gibson Dunn approved the form and content of the letters before they were sent. KCC is seeking indemnification from Aetna and an unspecified amount of damages

A spokesperson for Aetna did not immediately respond to an emailed request for comment. Under the proposed $17 million settlement agreement in the latest privacy suit, Aetna would pay $17,161,200 to the plaintiffs—a base payment of at least $500 to each of the nearly 12,000 patients who were sent the glassine windowed envelopes, through which instructions for filling HIV medications were clearly visible. This settlement amount will also be used to pay $75 each to customers whose private health information Aetna improperly disclosed to its lawyers and mail vendor.

The settlement also allows patients whose privacy was breached by the glassine envelopes who can demonstrate financial or nonfinancial harm to submit claims for up to $20,000.

A Gibson Dunn spokesman said the firm could not comment on the matter.

In addition to this settlement, Aetna last month also agreed to pay $1.15 million to resolve the New York attorney general's investigation into the matter. Several state attorneys general, along with the U.S. Department of Health and Human Services, launched investigations into the improper disclosures.

KCC alleges that the multiple lawsuits and governmental investigations resulted from Aetna's carelessness in its handling of this protected health information. In addition to failing to “implement appropriate protective measures” to ensure the privacy of the information at issue in the notices, the company, in violation of the federal Health Insurance Portability and Accountability Act, sent far more information about the patients to KCC than was necessary for it to do its job of mailing the notices, the complaint states. In addition, some of the patients' information was not encrypted, password-protected or sent to KCC in a sufficiently secure manner, the administrator charged.

“Aetna and Gibson [Dunn] transferred Aetna's insureds' [private health information] to KCC in a reckless, careless, and negligent fashion that resulted in the public disclosure of the fact that thousands of Aetna insureds were taking HIV/AIDS medications,” the complaint alleges.

Los Angeles-based associate Christopher Ramos and Chicago-based shareholders Blaine Kimrey and Jeanah Park of Vedder Price represent KCC in the matter.

Frederick Santarelli and Lynne Kolodinsky of Elliott Greenleaf in Blue Bell, Pennsylvania, and Matthew Kanny and Donna Wilson, partners in the Los Angeles office of Manatt, Phelps & Phillips, represent Aetna.

CORRECTION: This story has been corrected from the initially published version to amend the information related to the proposed settlement currently awaiting judicial approval.