Lawsuit Claims CVS Mailing Revealed 6,000 Ohioans’ HIV Status
Although laws protect private health information, three HIV-positive men say a code used by the pharmacy chain disclosed their status.
By Bob Vitale, PRIZM
March 28, 2018
http://prizmnews.com/blog/2018/03/28/lawsuit-claims-cvs-mailing-revealed-6000-ohioans-hiv-status/
Three HIV-positive men have accused CVS in a federal lawsuit of revealing the status of more than 6,000 Ohioans through a mailing that used the letters “HIV” in a code visible through envelope windows.
“Persons with HIV are still subject to stigma, humiliation, mental anguish, embarrassment and stress based on their HIV status,” the suit says. “They may also run the risk of the loss of housing, relationships, and employment when their HIV status is revealed.”
The plaintiffs and the other Ohioans whose private health information was allegedly revealed are clients of the Ohio HIV Drug Assistance Program. The state hired CVS in March 2017 to serve as pharmacy benefits manager for its Ryan White Program, the federal system of care and treatment for HIV-positive Americans.
The mailings—in envelopes labeled “personal and confidential” despite a large drawing of pill bottles and the words, “Your new prescription benefits have arrived” in red—were sent out in late July or early August. Windows on the envelope showed the CVS logo and the address of the Ohio Department of Health, as well as recipients’ names and addresses and the code “PM 6402 HIV.”
According to the lawsuit, filed in the U.S. District Court in Columbus, the result was “potential or actual disclosure of recipients’ HIV status to numerous individuals, including their families, friends, roommates, landlords, neighbors, mail carriers and complete strangers.”
The men are from Delaware, Defiance and Gallia counties. The suit details the alleged harm to all three:
- “John Doe One feels that CVS has essentially handed a weapon to anyone who handled the envelope, giving them the opportunity to attack his identity or cause other harm to him. He is also experiencing significant distress at home from receiving a mailing that used his name, address, birthdate and(protected health information) from an entity with whom he had no business connection. He is rightfully concerned that members of his local community have or will learn of his HIV status.”
- “John Doe Two lives in a small town and fears the stigma that would result from the disclosure of his HIV status. The more people who know that he is HIV-positive, the less safe he feels. In his town, many people still believe in’guilt by association,’and thus his friends and family run the risk of being stigmatized just by being seen with him. He is concerned that people such as his postal delivery person now knows his HIV status, particularly since CVS forces him to obtain his HIV medications by mail order and he receives those medications at the same address. He is also experiencing significant distress based on the adverse consequences of a similar incident years ago.”
- “John Doe Three lives in a small town where’everyone knows everyone.’He does not publicly disclose his HIV status but has friends and relatives who work for the U.S. Postal Service who would have seen this mailing and discovered his HIV status because of the defendants’ mailing. He is also experiencing significant distress as a result of this disclosure, including an understandable fear to leave his home, and has also experienced increased complications and health issues since this disclosure, up to and including just in the past several days.”
The lawsuit also names as a defendant Fiserv Inc., which was hired by CVS to produce the mailing.
A statement from CVS was included in a Dayton Daily News report on the lawsuit yesterday:
“CVS Health places the highest priority on protecting the privacy of those we serve, and we take our responsibility to safeguard confidential information very seriously. Last year, as part of a CVS Caremark benefits mailing to members of an Ohio client, a reference code for an assistance program was visible within the envelope window. This reference code was intended to refer to the name of the program and not to the recipient’s health status. As soon as we learned of this incident, we immediately took steps to eliminate the reference code to the plan name in any future mailings.”
The Ohio Department of Health has a policy of sending all mailings to HIV patients in opaque, non-windowed envelopes, the lawsuit states. Federal and state laws prohibit disclosure of private health information.
Lawyers for the three men are seeking class-action status for their lawsuit against CVS and Fiserv, which would include everyone who received the mailing. They have not specified the damages they seek.
