In a little-noticed development, three HIV-positive residents of Ohio on March 22 filed a class action lawsuit against the CVS pharmacy and healthcare company for what they claim was its “unauthorized public disclosure” of their HIV status and the HIV status of over 6,000 others in Ohio in July and August of 2017.
The three residents, saying they wish to protect their privacy, filed the lawsuit under the names John Doe One, John Doe Two, and John Doe Three before the United States District Court for the Southern District of Ohio.
The lawsuit says the unauthorized and “illegal” disclosure of the patients’ HIV status occurred when the letters “HIV” appeared above the patients’ names through the window of envelopes used in a mass mailing by a CVS affiliate of information to patients related to their enrollment in Ohio’s version of the federal AIDS Drug Assistance Program.
The Ohio Drug Assistance Program, or OhDAP, pays some or all of the cost of HIV medication for low-income people in the state, including those with limited or no health insurance coverage. Ohio officials retained two CVS affiliate companies, Caremark LLC and Caremark Rx LLC, to administer parts of the program and to arrange for providing the patients’ HIV medication.
The two affiliates retained two contractors, FISER V, Inc. and FISER V Solutions LLC, to carry out the mailings, the lawsuit says. The parent company CVS Health Corporation, the two CVS Caremark affiliates and the two FISER V companies are each named as defendants in the lawsuit.
The lawsuit says the three HIV-positive residents who are named as plaintiffs in the lawsuit are seeking to represent as part of a class action all participants in the Ohio Drug Assistance Program “whom Defendants sent a mailing…in which the participant’s name and the letters ‘HIV’ were visible through the envelope window.”
It says the number of those potentially eligible for class action status in the lawsuit could exceed 6,000.
CVS has said it took immediate steps to eliminate any reference to HIV in envelope windows as soon as it learned about the mailing in question.
“Beginning in approximately late July or early August 2017, Defendants mailed a letter containing membership cards and information about the CVS program and how persons would access their HIV-related prescriptions,” the lawsuit says. “This letter was mailed to an estimated 6,000 participants in the OhDAP, regardless of whether they were active pharmacy customers of CVS,” it says.
According to the lawsuit, although the letters contained highly confidential information about the patients’ HIV status, they were sent in envelopes that had two “glassine windows” through which information on the letter could be seen by anyone handling the unopened envelopes, including U.S. Postal Service employees.
One of the windows in the upper left side of the envelope contained the “CVS/Caremark” logo, the words “Ohio Department of Health,” and the notation “new prescription benefits,” the lawsuit says.
“A second window contained the recipient’s name and address, with the designation ‘PM 6402 HIV’ directly above the person’s name,” the lawsuit states. “This reference to the recipient’s HIV status was plainly visible through the glassine window,” it says.
“Persons with HIV are still subject to stigma, humiliation, mental anguish, embarrassment, and stress based on their HIV status,” the lawsuit says. “They may also run the risk of the loss of housing, relationships, and employment when their HIV status is revealed,” it says.
John Doe Two and Three live in small Ohio towns and are fearful that disclosure of their HIV status could subject them to harmful repercussions, says the lawsuit. It adds that the two are experiencing “significant distress” over who might have seen their HIV status exposed in the envelope window of the mailing they received.
“John Doe One feels that CVS has essentially handed a weapon to anyone who handled the envelope, giving them the opportunity to attack his identity or cause other harm to him,” the lawsuit says.
When contacted by the Washington Blade for comment on the lawsuit, CVS spokesperson Gary Serby sent a statement similar to the one CVS issued last August when news about the mailing with the “HIV” designation above the patients’ names first surfaced.
“CVS Health places the highest priority on protecting the privacy of those we serve, and we take our responsibility to safeguard confidential information very seriously,” the statement says.
“Last year, as part of a CVS Caremark benefits mailing to members of an Ohio client, a reference code for an assistance program was visible within the envelope window,” the statement continues. “This reference code was intended to refer to the name of the program and not to the recipient’s health status. As soon as we learned of this incident, we immediately took steps to eliminate the reference code to the plan name in any future mailings,” it says.
“We have no further comment due to the pending litigation,” the CVS statement says.
As of early this week, CVS had not filed an official response in court to the lawsuit. Under court rules, the company has 21 days from the time it was served papers about the lawsuit on March 22 to file its “answer” to the lawsuit or to file a motion seeking certain action by the court.
The lawsuit calls for the court to declare the HIV “disclosure” through the mailings a violation of Ohio law and to order the company not to make future unauthorized disclosures of patients’ HIV status.
It calls for an unspecified amount of an award of compensatory and punitive damages to the plaintiffs and attorneys’ fees. It also mentions that Ohio courts have awarded “at least $6,000 in damages for individuals whose HIV status has been disclosed without authorization.” It says that figure would translate into an amount greater than $5 million in a class action case like this one in which as many as 6,000 people are believed to have been subjected to unauthorized release of their HIV status.