The Aetna world headquarters in downtown Hartford, Connecticut.

Aetna Inc. has agreed to settle allegations that it improperly disclosed the protected health information of thousands of Americans, including HIV patients and hundreds of New Jersey residents, New Jersey Attorney General Gurbir Grewal announced Wednesday.

As part of the agreement, the insurance giant will pay the state a $365,000-plus civil penalty. It also will hire an independent consultant to evaluate and report on its privacy protection practices and monitor its compliance with the settlement.

A multistate investigation revealed that in July 2017, Aetna inadvertently disclosed through glassine envelopes sent through the mail by a third party, the names, addresses and conditions of thousands of HIV patients nationwide, including about 650 New Jersey residents, Grewal's office said in a statement.

Aetna later sued the claims administrator that handled the mailings for negligence. The administrator in turn sued Aetna, charging that the insurer committed negligence and breach of contract.

A second September 2017 breach occurred in which a mailing sent to 1,600 people about a study of patients with the heart condition atrial fibrillation revealed the name and logo of the study—IMPACT-AFib—which could have been interpreted as meaning that the addressee had an AFib diagnosis, according to the AG's office.

New Jersey and the other states involved in the investigation, Connecticut, Washington and the District of Columbia, alleged that Aetna violated not only the federal Health Insurance Portability and Accountability Act but also state laws governing protected health information generally and HIV/AIDS information specifically.

The breach involving the HIV patients spawned a class action lawsuit brought on behalf of current and former Aetna customers taking medication to treat HIV or PrEP, a pre-exposure prophylactic medication. In the lead plaintiff's case, one of his family members found the mailing and believed he was living with HIV and had not confided in his family. He was then forced to admit his condition to his family.

Last January, Aetna agreed, pending judicial approval, to pay $17 million to resolve the suit.

“Companies entrusted with individuals' protected health information have a duty to avoid improper disclosures,” said Grewal in the statement. “Aetna fell short here, potentially subjecting thousands of individuals to the stigma and discrimination that, unfortunately, still may accompany disclosure of their HIV/AIDS status. I am pleased that our investigation has led Aetna to adopt measures to prevent this from happening again.”

An Aetna spokesperson said in an email that the company has worked, through the recent class action settlement and other measures, to address the potential impact of “this unfortunate incident” to members.

“In addition, we are implementing measures designed to ensure something like this does not happen again as part of our commitment to best practices in protecting sensitive health information,” he said.

In other Aetna-related news, the U.S. Department of Justice announced on Wednesday that it will approve the $69 billion merger between CVS Health and Aetna, assuming the latter divests its Medicare Part D prescription drug plan for businesses for individuals.