HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Nov. 8, 2017.
- Organization as reported
- Aetna Inc., CT
- Entity type as reported
- Health Plan
- Category as reported
Unauthorized Access/Disclosure
- Location of information as reported
- Paper/Films
- Submission date
- Nov. 8, 2017
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14009, row:5148)
- Archived copy
- Held in the private archive (provenance)
Aetna Life Insurance Company and the affiliated covered entity (Aetna) has agreed to pay $1,000,000 to OCR and to adopt a corrective action plan to settle potential violations of the HIPAA Privacy and Security Rules. Aetna is an American managed health care company that sells traditional and consumer-directed health insurance and related services. In June 2017, Aetna submitted a breach report to OCR stating that on April 27, 2017, Aetna discovered that two web services used to display plan-related documents to health plan members allowed documents to be accessible without login credentials and subsequently indexed by various internet search engines. Aetna reported that 5,002 individuals were affected by this breach, and the protected health information (PHI) disclosed included names, insurance identification numbers, claim payment amounts, procedures service codes, and dates of service. In August 2017, Aetna submitted a breach report to OCR stating that on July 28, 2017, benefit notices were mailed to members using window envelopes. Shortly after the mailing, Aetna received complaints from members that the words "HIV medication" could be seen through the envelope's window below the member's name and address. Aetna reported that 11,887 individuals were affected by this impermissible disclosure. In November 2017, Aetna submitted a breach report to OCR stating that on September 25, 2017, a research study mailing sent to Aetna plan members contained the name and logo of the atrial fibrillation (irregular heartbeat) research study in which they were participating, on the envelope. Aetna reported that 1,600 individuals were affected by this impermissible disclosure. OCR's investigation revealed that in addition to the impermissible disclosures, Aetna failed to perform periodic technical and nontechnical evaluations of operational changes affecting the security of their electronic PHI (ePHI); implement procedures to verify the identity of persons or entities seeking…