Aetna accidentally exposed customer HIV statuses in clear envelope windows

https://www.washingtonpost.com/news/morning-mix/wp/2017/08/25/aetna-accidentally-exposed-customer-hiv-statuses-in-clear-envelope-windows/

by justin66 • 9 years ago

168 121 9 years ago

washingtonpost.com

mabbo2• 9 years ago

Oh neat, I just signed up for Aetna (first time working in America since ACA).

Is this normal for them? Am I an idiot?

jasonkostempski2• 9 years ago

I have them through work, they're pretty shitty, for example, I currently have to either turn of uBlock (not an option) or open dev tools to unhide a div in order to log in. Why there is anything on health insurance website that communicates with a third-party server baffles me. That said, I don't think there are any good options in the US. They all have weird quirks like this, they all require a fight to get the payouts you're entitled to and they'll fudge the numbers so you end up paying way more than you expect. Welcome to America.

Edit: I do have APL gap insurance too. I have nothing but praise for them, easy to work with, paid quickly (checks usually made out to me directly because most places here don't deal with APL), and covered most of my out-of-pocket cost with Aetna which I maxed out last year.

Fej• 9 years ago

Aetna uses JavaScript for everything on their website. Can't middle-click a link to open in a new tab because it's JS, not a proper link.

sqeaky3• 9 years ago

You shouldn't be downvoted for normal and reasonable questions, or even for self doubt.

Aetna is terrible. The lobby against healthcare reform at every turn. They didn't want obamacare/ACA they didn't want to compete accross state lines, they want to be able to exempt people from pre-existing conditions, they want to give people the run-around.

They are not trustworthy and they are run by bad people. (don't beat up on their phone agents though, they are just trying to make ends meets).

rcraft• 9 years ago

Are there any other insurers that don't do/want many of these same things?

JohnTHaller• 9 years ago

Don't forget about pulling out of the ACA in some states to try to make it look like the merger they wanted to do wouldn't harm competition and then lying about it.

slantedview• 9 years ago

Aetna is terrible

This is true, but I'd like to qualify this by saying that all of the for-profit insurers (and most of the non-profit ones) are terrible. Generating revenue is in direct conflict with providing patient care which is a fundamental flaw in the setup. It's a uniquely American problem.

emodendroket10• 9 years ago

What insurer is trustworthy? They make money by denying claims and coverage to people who actually need it; that's the business model.

mabbo2• 9 years ago

Awesome. I can't change my decision for another year, and then only to Blue Cross. Are they also terrible?

maxerickson7• 9 years ago

Competing across state lines means all insurance will be regulated by the state with rules that most favor the insurer, it isn't all that likely to be good for consumers.

The banking renaissance in South Dakota is a result of a similar situation.

https://www.theatlantic.com/business/archive/2013/07/how-cit...

noonespecial2• 9 years ago

(don't beat up on their phone agents though, they are just trying to make ends meets).

I've gotten very tired of this. Every time I'm on calls like this now I gently suggest to the phone agent that they know that what they are doing contributes to a system that hurts people and that they should try to do something more with their lives.

Don't scream or bluster. Do it with gentleness and respect and get ready to be occasionally very surprised at the results.

bitJericho2• 9 years ago

You absolutely should beat up the phone agents. They are part of the problem just like everyone else in the health industry.

yebyen5• 9 years ago

If you know how to "don't take no for an answer" I'll say optimistically, you'll be alright.

My experience with my wife's health care (Aetna) has been that she will call, try to get an issue resolved, be told "there is no resolution possible" enough times by enough different people that she is ready to give up. Then we call together, and suddenly the story changes.

The particular issue we were dealing with, is not really important, but tl;dr I almost wound up with two health insurances because I tried to stay insured and cover my bases when I was changing jobs, and nobody needs two health insurances.

They tried to tell us we couldn't cancel when I got a new job that came with better coverage for less. I thought that was a qualifying event! But, through some nonsense technicality we would not be allowed to cancel during the plan year, and even though I'd never made a claim and we were making quarterly payments, we'd be on the hook for the remainder of payments for the whole year. (This is illegal, I'm sure of it.)

The best advice I can give you is, know your rights and how to assert them. Good luck with that though, health care in this country is byzantine and I had the benefit of people in my family that work in health care administration who could help me understand.

arkades3• 9 years ago

1) know who to appeal to outside the company. This is the nuclear option. It's usually listed in fine print on every paper denial.

2) "My (partner) works in insurance. He does shit like this for a living. Please don't make me have to (goto 1)".

3) Feel free to cite the law where relevant, on paper, certified mail. The response is invariably "this is wrong, you misunderstand the law, but we will make an exception and (follow the fucking law this once.)"

I was in health insurance, management level, before I went into medicine.

danielvf• 9 years ago

Your advice is spot on.

We had a very similar experience with Blue Cross for many years. I'd swear they have an RNG that randomly denies claims 80% of the time. You just had to fight each one on the phone.

The people on the phone only had the apparent authority to "send the claim through the system again". About a month later you'd find out what happened. If denied again, we would just repeat until we eventually got lucky with the RNG.

They did eventually pay everything they should have, but we'd average about two hours on the phone per doctor visit.

X86BSD• 9 years ago

What floors me is how no one has disrupted this field yet. I have seen a few ground zero startups trying to disrupt healthcare. Make it more effecient, cut out fraud, etc but so far no one is making a dent.

Why is it so hard for some smart young folks to come along and hammer out solutions to accomplish less fraud, easier, and faster to use systems etc?

It seems like it's really REALLY hard to bust up this abortion we call healthcare in the US.

Arubis• 9 years ago

Aetna has long had a poor reputation, even amongst insurance companies. The phrase "Aetna, Aetna, so sorry we met ya" was commonplace in the healthcare industry ~15y ago.

emodendroket10• 9 years ago

They're all like this.

cgb2232• 9 years ago

I had COBRA healthcare through them and even though HR did all the paperwork and submitted it to Aetna, Aetna forgot to actually setup the policy.

I found this out the hard way in the ER mid near fatal allergic reaction

So yeah, you'll be fine...

blackguardx2• 9 years ago

Was this in California around 2008? There was a big scandal about this and now there are big fines for doing it.

A few insurers were accepting people (and accepting payment) without actually setting them up in the system. When many of these people went to use the insurance, they were told that not only did they not have insurance, they would be denied any insurance for having pre-existing conditions.

occultist_throw2• 9 years ago

Reading further in, it was a screw-up on the paper envelope that had too big of a window and referred to HIV treatment connected to the person's name. This is really bad, but it was 12k localized instances of crummy physical mailing.

Its pretty bad, but it's not like this was "300k people leaked by hackers for ransom".

yebyen5• 9 years ago

It's pretty bad.

HIV clinics have "no-contact" lists and if you hypothetically worked for a survey company that made a phone call to one of those numbers, and said you were calling from "XYZ clinic for PQR person who isn't here right now", and the person who takes your call connects the dots, and realizes XYZ clinic is an HIV clinic... you could make two people very upset, and one person homeless.

Hypothetically speaking... it could be real bad news.

Let's just say after that, we asked every medical office we ever worked with from then on, if they had any "no-contact" lists to please ensure they remove those people from the contact list before we started making calls.

We had a mail/phone operation and I'm just imagining our production manager not looking closely enough at even one of 12,000 pieces of mail in windowed envelopes that says "HIV medication" in plain view, before loading them into his car and mailing them at the post office.

He'd be canned instantly. Someone definitely got fired over this.

emodendroket10• 9 years ago

Phew, they only needlessly and carelessly divulged 12,000 people's HIV status.

occultist_throw2• 9 years ago

I never said it was a good thing.

Even though the badness of the situation, I'm saying it would have been terribly worse with mass leaks of the DB this came from. It's not like we in the tech community have seen leaks like that...

Regardless, I see this as a bad screw-up with with no ill intent behind it. It was literally a "too large window" on an envelope...

Broken_Hippo3• 9 years ago

This could have been prevented, though, and now folks could have to deal with a lot of harassment. There are still folks out there that think AIDS is a punishment from god for a sinful lifestyle or will assume you are gay (with all the discrimination that comes with it). Yet other folks finding out will simply stop using normal gestures with you and stand further back, simply because they are afraid they'll magically catch aids.

Sure, it wasn't 300k people leaked by hackers for ransom. It was giving folks reason to discriminate against 12k people. Does it matter if it was localized?

yebyen5• 9 years ago

There are two sides to the story though (I'm not defending Aetna, I'm saying this is not only a problem for people who live around bigots.)

Some non-zero percent of those 12k people live with a partner who doesn't know their HIV status. It is (edit: could be, if untreated) totally unethical for those people to fail to disclose their status to their partners, but arguably it's much worse for those people to be outed by their health insurance company, who should really be the (#@[expletive](/#@ experts in privacy here.

I'm really not sure it's OK that this letter went out at all, even if they had used the right privacy envelopes!

pavel_lishin• 9 years ago

If I were HIV positive, I would much rather my neighbors know my social security number than my HIV status.

dqv• 9 years ago

Wow, this is actually something I consider when sending letters to my clients. I don't ever want to "leak" their info, even if it's not really considered sensitive.

I always assume the top third to be "compromised", only putting the private contents in the lower two thirds or on the back.

I wonder why they don't have the mailing rule of the top third as a written policy.

ThrustVectoring• 9 years ago

A cost/benefit analysis of "put all HIPAA-relevant information inside an opaque envelope" probably comes out ahead if it prevents one issue like this.

Hell, make the envelope a specific color to make it really obvious that you've done things correctly.

maxerickson7• 9 years ago

Would the differently colored envelope itself be a HIPPA violation?

chimeracoder9• 9 years ago

A cost/benefit analysis of "put all HIPAA-relevant information inside an opaque envelope" probably comes out ahead if it prevents one issue like this.

To be pedantic, the patient's name and address are both considered PHI under HIPAA.

The way that most insurers deal with this is by mailing an envelope that has no obvious information on the outside about the sender (it has a return address that's usually a PO box somewhere in the midwest, but not the company's name). So without opening it, you can't tell that the piece of mail relates to medical information.

Banks do this as well when mailing things like credit cards, to make it less obvious to a would-be interceptor of the mail that there's something valuable inside. (Of course, the deliberate inconspicuousness of it is itself conspicuous, but that's another problem).

hammock• 9 years ago

Also there is something called a security envelope, which is printed on the inside with a pattern of lines that makes it difficult to read the contents of an unopened letter by holding it up to the light.

Back when mailing checks to pay bills was a thing, everyone had a box of them and that's what you used. I imagine companies today should still use them.

chimeracoder9• 9 years ago

Note that the USPS also scans and stores images of the front and back of all mail it delivers, even if you don't opt in for their digital delivery service[0]. So this means that the USPS - and anybody else with access to their images, which includes law enforcement - now knows the HIV status of these people.

[0] http://www.nytimes.com/2013/08/03/us/postal-service-confirms...

jubabuba• 9 years ago

In practice USPS/law enforcement will have this image data but they will not parse it for some time (if ever).

checker• 9 years ago

AFAIK in this case law enforcement is the Inspection Service which is part of USPS; if images are divulged to any other agency, it's through USPSIS.

bgirard• 9 years ago

And I've seen a new complex in the bay where, for reasons unknown to me, it shows you the scans of all your neighbors.

jacquesm3• 9 years ago

This comment begs expansion.

ianmiers• 9 years ago

Scarier point: USPS probably knows without that. If these letters are sent out in batches and the envelopes/timing/vender is unique, then all it takes is knowing that 1 letter is abut HIV and then you know all of them are without ever seeing the content.

SomeStupidPoint• 9 years ago

At USPS scale, wouldn't the density of the letters versus public statistics on disease prevalence be a strong indication?

pluma• 9 years ago

Does the US not have standardized letter and envelope sizes?

In Germany we have standards for paper sizes, window placement and the layout of business letters. Considering this type of letter is probably not typed out by hand, it's trivial to use a template with the correct layout. At that point the choice of letter becomes irrelevant.

I'd expect the US to have something similar but maybe they don't? If there are standards, this boils down to either "Aetna used non-standard envelopes" or "Aetna formatted letter incorrectly".

baddox• 9 years ago

I don't know if there are actual codified standards, but I often receive letters (mostly bills) with the same envelope size and window placement. I would guess they just folded or ordered the contents of the envelope incorrectly.

rdiddly• 9 years ago

There is no standard that I'm aware of. On a related note, if I had a dollar (or a Euro) for every US problem that the Germans solved long ago through straight thinking, I'd have enough money to move to Germany.

munificent• 9 years ago

for every US problem that the Germans solved long ago through straight thinking

Sad that we apparently need to add "outlawing Nazis" to that list now.

bdamm3• 9 years ago

Have you talked to some Germans about how "straight thinking" they think their country is? When you don't get to see the sausage made it looks good but peel pack the process a bit and you'll see that there are still very significant issues. Note: I have huge respect for German society and governance.

vidarh4• 9 years ago

The standards for paper and envelope sizes [1] are so ingrained in me that it's almost like metric vs. imperial. They're ISO standards, though based on German standards, and being able to instantly know roughly how big a paper size is, is very convenient.

E.g. A4 almost the size of US Letter, but from there we know if you take an A4 sheet, turn it 90 degrees and puts another one above it in the same orientation, you have A3. Repeat for A2 and so on. Or fold an A4 in half and you have A6. Meanwhile an A4 sheet will fit in a B4 or C4 envelope without being folded, or in a B5 or C5 envelope folded in half...

[1] https://en.wikipedia.org/wiki/Paper_size#International_paper...

dsfyu404ed3• 9 years ago

If I had a dollar for every problem the Germans introduce by over-thinking current problems I could drive a German luxury car (that is old enough to not still be under warranty).

saas_sam2• 9 years ago

Yes we do have standard paper and envelope sizes in the US that are similar to Europe. What probably happened here is they printed the info in a dumb layout that was too close to the address field and/or whoever was running the folder-inserter machine did not move the tri-fold area to the right place. (Source: I used to sell these machines.)

germanier• 9 years ago

The point is that the page layout, i.e. where the fold positions, address field, letter title, reference numbers, date, logo, and actual content go, is standardised as well (DIN 5008). Nobody forces you to use that standard but it frees your mind thinking about actually important stuff so everybody does.

This doesn't help against incorrectly using a folder-inserter but I have never seen that happen. What does the user need to do to have an incorrect fold?

sjg0072• 9 years ago

massive HIPPA violation.

dsfyu404ed3• 9 years ago

Since most of this thread has turned into comparing the terribleness of insurance companies I'll say it again:

A good said of less than legitimate identification documents are probably far more useful to someone needing urgent medical care than insurance coverage is.

neom• 9 years ago

A dude in my girlfriends class at a good university in nyc just had this happen and his roommate saw and went to the school and said they want him removed from the dorm, school obviously said no, but it was a huge ordeal.

kelukelugames• 9 years ago

https://vine.co/v/5hBviTJuHj5

pasbesoin• 9 years ago

Separately, it has been reported in the last several years that the U.S. Postal System has implemented imaging every single piece of mail it moves.

They have already OCR-ed addresses from mail, for years. If they are now retaining the raw images, does this mean that they've inadvertently collected and are holding the HIV status of all the Aetna customers affected by this information leak?

So far, it seems the USPS is not selling what it's collected. (Although I'm sure some of the "make a buck any way you can" crowd in DC and elsewhere would not be above enabling and pushing them to do so.) But, next year? And in case you thing this is far-fetched, many state departments of motor vehicles (DMV) already make their drivers license photographs commercially available, IIRC.

bridanp• 9 years ago

This is the kind of thing that induces panic attacks in my business because so much time is spent on the look and feel of any letter going out to customers, and so little time is spent on the finished product (ie QA process for the letter in the envelope). It's probably not a matter of the company being evil (although Aetna could probably be described that way at times). It's more than likely 1) the lack of proper procedure in place regarding mass mailing, 2) the lack of a standardized Quality Assurance program, and/or 3) a 3rd party was contracted out by Aetna to do the mass mailing and they you could probably wrap back through #1 and #2 for them as well.

None of scenarios can diminish just how awful this is of course. There are some things you can get wrong on that envelope that are bad, but not really livelihood threatening. This is life changing for a huge number of people I'm sure, and the companies involved should be held accountable for the breach.

jacquesm3• 9 years ago

3rd party was contracted out by Aetna to do the mass mailing and they you could probably wrap back through #1 and #2 for them as well.

To contract this out would be a terrible breach of protocol.

MaxfordAndSons• 9 years ago

To contract this out would be a terrible breach of protocol.

That's false. HIPPA covered entities are allowed to engage contractors, who are allowed to handle protected health information (they also must comply with HIPPA, of course).

Source: have worked for an HIO (health information organization, a type of HIPPA compliant contractor), and https://www.hhs.gov/hipaa/for-professionals/faq/547/to-what-...

Aetna accidentally exposed customer HIV statuses in clear envelope windows

Related Stories