CVS Class Action Lawsuit Says 6,000 HIV Patients Exposed

Top Class Actions’s website and social media posts use affiliate links. If you make a purchase using such links, we may receive a commission, but it will not result in any additional charges to you. Please review our Affiliate Link Disclosure for more information.

A class action lawsuit claims that CVS violated patient privacy by exposing the HIV status of 6,000 Ohio residents.

A number of anonymous Ohio residents allege that CVS had a practice of mailing out information related to patients’ involvement in Ohio’s HIV Drug Assistance Program, and those mailings were labeled clearly with a patient code and the acronym HIV.

According to the CVS HIV status disclosure class action lawsuit, patients received information about their HIV medications and benefits for the Ohio HIV Drug Assistance program mailings sent out by CVS.

The Ohio CVS HIV privacy violation class action lawsuit states that the program is one that assists individuals with the copays for life-saving HIV medications.

Allegedly these mailings were in envelopes that bore the words “personal and confidential — please open right away,” but clearly listed the patient’s name, as well as a code involving the acronym “HIV” through two transparent windows. The Ohio residents claim that the envelopes were dropped off at patients’ places of residence, where they could be seen by anyone who looked.

According to the CVS HIV status disclosure class action lawsuit, CVS “clearly made no advance effort to test or review the disclosure of such information prior to disseminating the mailing, since had they done so they would have seen that the identification number with ‘HIV’ next to it was prominently visible through the envelope.”

The Ohio residents claim that this disclosure of status information violates CVS’ own “Notice of Privacy Practices,” which states that they are “required by law to protect the privacy of your PHII and to provide you with this Notice explaining our legal duties and privacy practices.”

The plaintiffs allege that this disclosure also violates the Health Insurance Portability and Accountability Act (HIPAA), compliance with which was a “condition of CVS’s contract with the State of Ohio.”

The three plaintiffs, all HIV-positive men, leading the HIV status class action lawsuit cite emotional distress in the injuries caused by the disclosure. They claim that due to the stigma surrounding HIV, their lives could be damaged. One man states that he “feels that CVS has essentially handed a weapon to anyone who handled the envelope, giving them the opportunity to attack his identity or cause other harm to him.”

The Ohio HIV status class action lawsuit notes that CVS isn’t the first company to be hit with a similar allegations, and states that last year, Aetna Inc. was also accused of revealing patient HIV status in envelopes with clear windows, exposing the information of more than 12,000 patients. The CVS Ohio HIV class action lawsuit goes on to note that the company settled the issue for $17 million.

In another CVS class action lawsuit filed last month, plaintiffs claimed that CVS Caremark forces patients to get their HIV/AIDS medications at CVS instead of from the pharmacy of their choice.

The Ohio residents are represented by Joe R. Whatley, Edith M. Kallas, Alan M. Mansfield, and Henry C. Quillen of Whatley Kallas LLP, Jerry Flanagan of Consumer Watchdog and Terry L. Kilgore.

The CVS Ohio HIV Status Disclosure Class Action Lawsuit is Doe One, et al. v. CVS Health Corp., et al., Case No. 2:18-cv-00238, in the U.S. District Court for the Southern District of Ohio.

UPDATE: On Sept. 10, 2019, a class action lawsuit claiming that CVS failed to maintain client privacy and revealed the HIV status of prescription users has ended in a $4.35 million settlement deal.