A lawsuit has been filed against CVS Health claiming that it unintentionally revealed the HIV status of 6,000 of its customers in Ohio.
In a federal lawsuit filed last Wednesday, three John Does are suing CVS and have sought class action status for the other affected customers. The plaintiffs have requested a jury trial.
The three John Doe’s all live in different counties in Ohio but are clients of the Ohio HIV Drug Assistance Program, or OhDAP, which has had a contract with CVS since March 2017.
Under that contract, CVS provides OhDAP clients with HIV medications and is responsible for communication relating to those medications.
In late July or early August 2017, a letter containing membership cards, information about the CVS program and how to access their HIV medications was mailed to an estimated 6,000 participants in OhDAP.
According to the lawsuit, the letter’s clearly showed the recipient’s HIV status through the envelope window above the patient’s name and address.
"The Defendants' combined use of a glassine windowed envelope, their design of the letter containing the HIV status of the individual recipient such that it could be seen through the envelope window instead of using an opaque envelope or a letter that was properly spaced not to publicly reveal such information through the envelope window, and an identification reference with the term "HIV," the lawsuit alleges, "resulted in the potential or actual disclosure of recipients' HIV status to numerous individuals, including their families, friends, roommates, landlords, neighbors, mail carriers, and complete strangers."
Fiserv, the company that CVS contracted to mail the information, is also named in the lawsuit.
In a statement to ABC News on the lawsuit, CVS Health says, “CVS Health places the highest priority on protecting the privacy of those we serve, and we take our responsibility to safeguard confidential information very seriously. Last year, as part of a CVS Caremark benefits mailing to members of an Ohio client, a reference code for an assistance program was visible within the envelope window."
"This reference code was intended to refer to the name of the program and not to the recipient’s health status," the statement continued. "As soon as we learned of this incident, we immediately took steps to eliminate the reference code to the plan name in any future mailings."