Attorney General Gurbir Grewal announced New Jersey has entered into a settlement agreement with Aetna Inc. to resolve allegations the company improperly disclosed protected health information of thousands of Americans, including hundreds of New Jersey residents.
The settlement is the result of a multistate investigation focused on two separate privacy breaches by Aetna that occurred in 2017 — one involving a mailing that potentially revealed information about addressees’ HIV/AIDS status and the other concerning a mailing that potentially revealed individuals’ involvement in a study of patients with atrial fibrillation.
New Jersey coordinated with Connecticut, Washington and the District of Columbia in conducting the investigation and negotiating a resolution.
Under the terms of the settlement, Aetna will put in place policy, protocol and training reforms designed to safeguard individuals’ protected health information and ensure the confidentiality of mailings containing that information. The company also will hire an independent consultant to evaluate and report on its privacy protection practices and monitor its compliance with the settlement’s injunctive terms.
Additionally, Aetna will pay a civil penalty of $365,211.59 to New Jersey.
“Companies entrusted with individuals’ protected health information have a duty to avoid improper disclosures. Aetna fell short here, potentially subjecting thousands of individuals to the stigma and discrimination that, unfortunately, still may accompany disclosure of their HIV/AIDS status. I am pleased that our investigation has led Aetna to adopt measures to prevent this from happening again.” Grewal said in a statement.