CVS Health is being sued for revealing the HIV status of nearly 6,000 Ohio patients when it mailed letters showing their participation in the state's HIV drug assistance program through the envelopes' glassine window, according to CBS Philly.
The complaint was filed March 21 and also names the company's third party mail vendor, Fiserv, as a defendant. The companies are being sued by three unidentified plaintiffs seeking a class action lawsuit and jury trial.
The lawsuit alleges CVS failed to properly disclose the privacy breach when it did not contact all affected patients. The letters included the patients' new benefits cards and information about a mail prescription program, but exposed sensitive information through the envelopes' clear window.
Plaintiffs claim the inadvertent disclosure has been damaging to their personal reputations. The first plaintiff, referred to as John Doe One of Delaware County, Ohio, said he "feels that CVS has essentially handed a weapon to anyone who handled the envelope, giving them the opportunity to attack his identity or cause other harm to him," CBS reports.
Another, called John Doe Two of Defiance County, said he lives in a small town and is concerned about the stigma surrounding his HIV status. He also fears his "friends and family run the risk of being stigmatized just by being seen with him."
In a statement to CNN, CVS Health claimed the envelope window intended to show a reference code for the assistance program, not patients' health status.
"CVS Health places the highest priority on protecting the privacy of those we serve, and we take our responsibility to safeguard confidential information very seriously," the statement said. "As soon as we learned of this incident, we immediately took steps to eliminate the reference code to the plan name in any future mailings."