It was an ironic start to a class-action lawsuit: Notices mailed as part of a settlement of a previous class action alleging that Aetna Insurance Co.'s mail order requirement for medications violated HIV patients' privacy allegedly revealed insureds' names and conditions through glassine envelope windows. Now Aetna is facing another class action, this one in federal court in Philadelphia, over claims that it failed to protect HIV patients' privacy.

The lawsuit was filed in August by a man using the pseudonym Andrew Beckett, who, according to court papers, feared “severe harm” would befall him should his true identity be revealed.

“The instructions for the recipient to fill their HIV medication prescription was plainly visible through the large-window section of the envelope,” the complaint said. “Specifically, the visible portion of the letter clearly indicated that it was from Aetna, included a claims number and information for the addressee, and stated '[t]he purpose of this letter is to advise you of the options … Aetna health plan when filling prescriptions for HIV Medic…'”

According to the complaint, one of Beckett's family members found the mailing and believed he was living with HIV and had not confided in his family. Beckett was forced to admit his condition to his family.

In a statement shortly after the lawsuit was filed, Aetna “sincerely apologize[d] to those affected by a mailing issue that inadvertently exposed the personal health information of some Aetna members.” The envelopes were distributed in Arizona, California, Georgia, Illinois, New Jersey, New York, Ohio, Pennsylvania, and Washington, D.C.

“This type of mistake is unacceptable, and we are undertaking a full review of our processes to ensure something like this never happens again,” the statement added. The company is offering emergency financial relief and counseling to those who suffered specific harm as a direct result of the mailing.

Philadelphia-based class-action firm Berger & Montague, the Legal Action Center and the AIDS Law Project of Pennsylvania teamed up on the suit.

Ronda Goldfein, executive director of the AIDS Law Project, a nonprofit public interest law firm that works to protect the legal rights of people living with HIV in Pennsylvania and South New Jersey on issues ranging from discrimination to housing to immigration, spoke with The National Law Journal specifically about the lawsuit, the organization's work and about health care privacy issues more generally. The interview has been edited for length and clarity.

The National Law Journal: How did this lawsuit and your involvement in it come about?

Ronda Goldfein: Based on postings to a listserv that lawyers who work in this area of HIV-related legal issues share, it was pretty clear within a few days that something was happening. At first, people were suggesting that the clients file administrative complaints. We often use the state and federal administrative agencies to get the attention of the defendant and to have the agencies do some of the expensive discovery that nonprofits can't always do. But it started to seem like there were many of these, and we were concerned that it was still happening. We didn't have a whole lot of information in terms of when they were mailed, who was receiving them, so it was kind of like little patches of wildfire. So, the Law Project teamed up with the Legal Action Center, a public interest firm based in New York City, and decided that we needed to tell Aetna to cut it out immediately.

NLJ: What was your first step?

RG: We wrote a demand letter to Aetna and sent out a press release with it. We had a few goals. One, we wanted to make sure that there would be some transparency and some pressure for Aetna to stop this immediately. Two, we wanted to make sure that any other entity, be it an insurer, a home health care provider, whomever, who has this type of sensitive information knows that they need to be careful with it, that they can't send it out in an envelope so the world could see. And three, we were starting to hear from clients, saying, “Wow, I thought I was the only one. I was shocked when I got this in the mailbox. I didn't know what to do. I didn't know who to call. I was so upset.” When we kept hearing that story over and over again, we wanted folks on a public level to know, “It wasn't just you. You can talk to us about it. This is what we're doing.” We quickly heard that there were 12,000 letters sent out and thought, “Wow, that's out of control,” so we thought we needed to formalize our demand letter to a real demand.

NLJ: What's at stake with privacy breaches like this one?

RG: Somebody reported that the letter came while he had family members over, and the family members saw for the first time that he has HIV. We've heard stories of small towns where letters are left on bulletin boards or on the table in a small post office when they're mis-delivered. In many cases, that's the center of town, and people see them. We've heard stories where the mail carrier is somebody the person knows from church. The mail carrier hands the letter over, and then next Sunday, everybody's looking at the person differently.

NLJ: How do you decide when to get involved in litigation?

RG: We're based in Pennsylvania, and our jurisdiction is Pennsylvania and Southern New Jersey. We try to look at the issues that are affecting people living with HIV that are immediately impacting and have a bigger impact. When you challenge discrimination or you challenge privacy violations, not only is that relief for the individual, but, because we are a public interest law firm, we are committed to publicizing all of our work, which sends clear messages.

Not to sound too grandiose, but we try to pursue every claim that we think has some merit and can survive

NLJ: Do you take proactive measures to monitor privacy and other legal issues nationwide that affect people living with HIV? Is that even possible?

RG: To an extent, it is. With something like this, you would never think that you would have to tell the companies, “Hey, when you're sending out notices, don't violate people's privacy,” so in those cases we wouldn't really know. But if we see a policy that we feel will negatively impact people with HIV, we'll become involved in that. If we see legislation pending that we think is problematic, then we will get involved in that. We try to be proactive in that regard.

NLJ: Is it a big problem in the health care industry at large that we're seeing these sorts of privacy breaches, or is the harm specific to people living with HIV?

RG: No matter what the information is, whether it's stigmatizing information or not, our mail carriers, our neighbors, our friends, our churchgoers shouldn't be able to see what our medical information is, so it should all be protected. HIV is particularly stigmatizing, but I don't want to suggest we need to have one standard for HIV and one standard for all other conditions. We have to have a basic understanding and appreciation of medical privacy.