Features Navigation

Live Chat (800) 825-0224 Live Demo

← Back

Aetna Settles Three HIPAA Breaches for $1,000,000

Central Billing Office (CBO)

Aetna has agreed to pay $1,000,000 to the Office for Civil Rights (OCR) at the U.S. Department of Health and Human Services (HHS) and to adopt a corrective action plan to settle potential violations of the Health Insurance Portability and Accountability Act (HIPAA)

April 27, 2017, Aetna discovered that two web services used to display plan-related documents to health plan members allowed documents to be accessible without login credentials and subsequently indexed by various internet search engines. Aetna reported that 5,002 individuals were affected by this breach, and the protected health information (PHI) disclosed included names, insurance identification numbers, claim payment amounts, procedures service codes, and dates of service.

July 28, 2017, benefit notices were mailed to members using window envelopes. Shortly after the mailing, Aetna received complaints from members that the words “HIV medication” could be seen through the envelope’s window below the member’s name and address. Aetna reported that 11,887 individuals were affected by this impermissible disclosure.

September 25, 2017, a research study mailing sent to Aetna plan members contained the name and logo of the atrial fibrillation (irregular heartbeat) research study in which they were participating, on the envelope. Aetna reported that 1,600 individuals were affected by this impermissible disclosure.

OCR’s investigation revealed that in addition to the impermissible disclosures, Aetna failed to perform periodic technical and nontechnical evaluations of operational changes affecting the security of their electronic personal health information (ePHI); implement procedures to verify the identity of persons or entities seeking access to ePHI; limit PHI disclosures to the minimum necessary to accomplish the purpose of the use or disclosure; and have in place appropriate administrative, technical, and physical safeguards to protect the privacy of PHI.

What does this mean for you? Let’s look at all three breaches and see what you can to do protect yourself.

The Breach of April 27, 2017

If you have a website or a web portal that can collect or display patient information and that website is not configured properly you can be at risk of a HIPAA breach. Even if the website is run by a third party, it is your patient information and it is ultimately you who will be responsible for the breach.

What to do?

Look at the contracts you have with your technology providers, make sure that you have Business Associate Agreements (BAA) in place and make sure the BAA’s include terms that the Business Associate will be responsible for all costs, fines, and settlements should there be a breach due to a flaw in the security of their technology. Without these agreements in place it will be you that will have all the costs associated with the breach.

The Breach of July 28, 2017

In this case the problem was with the physical mail. Window envelopes allow the contents of the letter to be seen through the envelope. In this case the contents clearly indicated that the patient had HIV. Making this information public is clearly a major issue. The knee jerk reaction would be to not use window envelopes, but this could result in significant workload to make sure that the right piece of paper is going to the right person. Many HIPAA breaches are the result of placing the wrong piece of paper in the wrong envelope and then mailing it to the wrong person. Window envelopes help to prevent that type of breach. So, the best way to prevent this type of breach is to make sure that any letter you send out has all of the patient information below the top 1/3 of the page. The way paper is folded into a business envelope with a window, only information on the top 1/3 of the page can be viewed through the window no matter how the envelope or paper may be shifted inside the envelope.

Next time you do a mailing, take a couple of envelopes fold them and view the visible page before putting it into an envelope. If there is any visible personal information beyond the information needed to mail the letter, then you need to re-format the letter before having the letter sent.

If you are using a third part service that sends out letters, invoices, or any other documents on your behalf then once again you need to make sure you have a BAA and the BAA must clearly state that they are responsible for all expenses related to any HIPAA breach caused by any action or technology of theirs.

The Breach of September 25, 2017

Envelopes were printed that had information on a study that ONLY went to patients in that study. That identified the patients as having Atrial Fibrillation. That is why this situation was a HIPAA breach.

This one is much more straightforward – never put any information that could be considered patient information on the outside of the envelope. In this case the information related to treatment the patient is having.

For more information about TLD Systems, please visit the AdvancedMD Integration Partner Marketplace.

Michael Brody, DPM
Dr Brody has been actively involved in Computers and Medicine since the 1980’s. Dr Brody as a Residency Director at a VA hospital on Long Island and was present as the VA moved from paper records to computerized records. During this time, he was exposed to the stringent rules and regulations that government employees need to adhere to when protecting patient information. He co-founded TLD Systems with Warren Melnick to create a platform that doctors who wish to work in private practice have a cost-effective method of implementing HIPAA compliance in their practices in a manner that does not interfere with their ability to practice medicine. He has served on the Health Information Technology Standards Panel (HITSP), the Standards and Interoperability Framework (S&I), as a member of the Ambulatory Care Committee at the Certification Commission on Health Information Technology (CCHIT), and numerous other organizations. He is currently a member of the Physicians Committee at the Healthcare Information and Management Systems Society (HIMSS) and a co-Chair of the EHR workgroup at Health Level Seven International (HL7)


Other Resources Related to This Topic

No results found

“The money I have invested in AdvancedMD is miniscule compared to the return. I have never been more efficient – ever – in my professional life as I am now.”

Jed Shay, MD
The Pain Care Center

Read the story  ›

“[Our] patients are very well-educated and well-informed, and they want to see results quickly. The practice has to run extremely efficiently and be accessible to them. The nice thing about [AdvancedMD] is it has allowed me to be more efficient both in and out of the office. Now I don’t have to come back into the office, which is great for my family and everything else. It saves me a lot of time – probably an hour a day on the three days I work in the second office.”

Keith Berkowitz, MD
Center for Balanced Health

Read the story  ›

“The best thing I ever did in private practice was getting AdvancedMD—it has liberated me.”

Estaban Lavato, MD
La Loma Medical Center

“Having integrated practice management and EHR is absolutely wonderful, you don’t have to flip back and forth between systems—all of your information is at hand when needed.”

Raju Raval, MD

Read the story  ›