On The Case

Aetna, still looking for scapegoat in HIV disclosure fiasco, sues plaintiffs firms

(Reuters) - Aetna has intensified its search for someone else to blame for a settlement notification fiasco that has so far put the company on the hook for nearly $20 million.

Aetna stands accused, as you may recall, of violating the privacy of customers who take HIV medications by allowing postal delivery of a settlement notice that displayed patients’ names, addresses and HIV prescription information in a transparent envelope window. In February, the insurer sued the claims administrator Kurtzman Carson Consultants in federal court in Philadelphia, arguing that KCC should indemnify Aetna for the botched notice because KCC chose the overly-revelatory envelope. That case is ongoing.

But Aetna has meanwhile found a new target. On Wednesday, the insurer filed a complaint in Philadelphia federal court against the plaintiffs firm Whatley Kallas and the non-profit Consumer Watchdog, which represented Aetna clients in the cases that led to the botched notification. The new suit contends that plaintiffs lawyers demanded Aetna supply confidential information about its clients to KCC, then failed to assure that none of the information would be exposed in the settlement notification mailing.

Aetna is claiming, in other words, that plaintiffs lawyers are responsible for its failure to protect the private health information of its clients. If that seems weird to you, consider this additional irony: The problematic settlement notices stemmed from cases in which Whatley Kallas and Consumer Watchdog sued Aetna for (wait for it) compromising the confidentiality of clients who had been prescribed HIV medication. Aetna’s contention is that the plaintiffs lawyers who forced the company to change its policies to protect patient confidentiality are actually to blame for the exposure of that exact information.

This is all a tangled skein, so I’ll try to unravel it. Back in 2014, Aetna informed customers who had been prescribed HIV medications of a new policy that would require them to fill prescriptions by mail rather than in person. Whatley Kallas and Consumer Watchdog brought prospective class actions in California and Florida on behalf of Aetna clients who claimed that because HIV medications are delivered in refrigerated containers, the new policy would expose their HIV status to anyone who saw the packages, including neighbors or co-workers. Aetna, represented by Gibson, Dunn & Crutcher, agreed to a settlement in which it would allow health plan members to continue filling HIV prescriptions at their pharmacies.

KCC was hired to send out settlement notifications. Aetna supplied information about its clients to KCC.

The envelope KCC used for the settlement notifications had a window to display clients’ name and address. Unfortunately, the window also showed the first line of the letter to Aetna clients, including the words, “when filling prescriptions for HIV medications.”

The notification led to a new round of suits against Aetna, most of which were consolidated in Philadelphia federal court. On May 9, U.S. District Judge Juan Sanchez of Philadelphia granted preliminary approval of a $17.2 million settlement between the insurance company and clients whose HIV status was exposed in the settlement notification letters. Aetna also agreed to pay a $1.15 million fine to resolve an investigation into the privacy breach by the New York Attorney General. The company has said other state AG investigations are still under way, as are scattered individual suits against Aetna by customers raising allegations outside of the now-settled class action.

Aetna and KCC began pointing fingers at one another nearly a year ago in private negotiations over blame for the disastrous mailings. Their talks culminated in tit-for-tat complaints in February. Aetna sued KCC in Philadelphia. KCC fired back the next day in federal court in Los Angeles, claiming that Aetna and its lawyers at Gibson Dunn had approved both the “form and content” of the notification letters before they went out. KCC also alleged that Aetna breached patient confidentiality rules when it gave unencrypted client data to the claims administrator without obtaining a protective order.

Aetna and KCC moved to dismiss one another’s suits, each claiming the other was forum-shopping. In April, U.S. District Judge John Walter of Los Angeles granted Aetna’s motion to toss the KCC suit, concluding that Aetna had been the first to file and had not engaged in bad-faith forum shopping. Judge Sanchez in Philadelphia has not ruled on KCC’s motion to dismiss Aetna’s suit, although it’s hard to image he’ll toss that case after the dismissal of the California action.

That brings us to Aetna’s new suit against Consumer Watchdog and Whatley Kallas. The insurer’s complaint attempts to lay blame on plaintiffs lawyers because Whatley Kallas supposedly recommended KCC and was considered to be the “requesting attorney” on the KCC engagement. Aetna also contends the plaintiffs firms “demanded” Aetna supply confidential patient records to KCC and that they failed to “take any steps to insure the confidentiality of the plaintiffs’ and Aetna members’ sensitive data.”

That is a patently ridiculous theory, according to Harvey Rosenfield and Jerry Flanagan of Consumer Watchdog. Their responsibility in the settlement notification process, they said, was to make sure Aetna lived up to its promise to change its policy so patients prescribed HIV medications could maintain their privacy by picking up their medication from pharmacies. “The wording of the notice was the key part for us,” said Flanagan. “We edited the text of the letter to make sure we held Aetna’s feet to the fire.”

Consumer Watchdog never saw or handled confidential Aetna client information, nor did it see the settlement notification envelope proposed by KCC, according to Rosenfield and Flanagan, who also pointed out that it was Aetna, and not plaintiffs lawyers, that ultimately made the call to hire KCC. In a May 22 letter to Aetna, sent in response to Aetna's final pre-suit threat, Consumer Watchdog said it was incredulous that Aetna would attempt to pin blame on plaintiffs lawyers without a scintilla of proof. “Far from evidencing some ‘smoking gun,’” the letter said, Aetna’s purported evidence “did not even put Consumer Watchdog and Whatley Kallas lawyers at the scene of Aetna’s crime.” (The letter is also signed by Whatley Kallas name partner Joe Whatley.)

Whatley and Consumer Watchdog said in the letter that they intend to seek sanctions against the insurer for filing a frivolous case, in addition to a possible defamation suit. “If Aetna believes that an attack on lawyers for Consumer Watchdog and Whatley Kallas LLP will be a cost-free exercise in retaliation, it is deeply mistaken,” the letter said. “Aetna would be well advised to focus on remediation of its privacy practices on a nationwide basis … instead of pursuing abusive and retaliatory tactics that seek to evade liability for its own failings and suggest that Aetna still does not take responsibility for ensuring that its customers’ private medical information is protected.”

Aetna lawyer Matthew Kanny of Manatt, Phelps & Phillips did not respond to my phone message.