Aetna Insurance accidently revealed the names of thousands HIV patients in a mailing. The insurance company mailed 12,000 customers in multiple states instructions for filling HIV medication prescriptions.

Information about the medication was visible through the window on the envelope. Recipients were stunned, according to the Legal Action Center and the AIDs Law Project of Pennsylvania. Anyone seeing the letter could learn the recipient is an HIV patient. Patients said family members, roommates and even neighbors saw the letters.

The letters violated federal and state privacy laws and exposed the customers to potential discrimination, the groups said. HIV patients still suffer a stigma that can lead to employment, housing and education discrimination and even to violent attacks. Attorneys representing the customers promptly demanded that Aetna change its mail practices.

“Aetna’s privacy violation devastated people whose neighbors and family learned their intimate health information,” stated Sally Friedman, legal director of the Legal Action Center, in a statement. “They also were shocked that their health insurer would utterly disregard their privacy rights.”

Many customers have already filed complaints with administrative agencies, such as the Office of Civil Rights of the U.S. Department of Health and Human Services and state insurance regulators, the groups said in a letter to Aetna.

Time for PR Damage Control

Aetna worked quickly on damage control. “This type of mistake is unacceptable,” the company said in a statement to the media. “We sincerely apologize to those affected by a mailing issue that inadvertently exposed the personal health information of some Aetna members.”

A vendor had sent the letters with window envelopes, and the letter could have shifted through the window, it said.

“Regardless of how this error occurred, it affects our members and it is our responsibility to do our best to make things right,” Aetna stated. “We will work to ensure that proper safeguards are in place to prevent something similar from happening in the future.”

Its response met two of the basic elements in the classic PR crisis response playbook: apologizing and promising to prevent a similar mistake from happening again. The next steps may be tougher.

Other Possible Steps Aetna can take

One element of a crisis response is to make whole the aggrieved party. “There is no putting the toothpaste back in the tube,” writes Shel Holtz, principal of Holtz Communication + Technology. Aetna could make an investment in helping to eradicate the stigma of HIV, Holtz suggests.

Aetna will need to communicate how it will fulfill its promise of preventing the mistake from happening again. It may wish to re-examine its customer and communication and privacy practices. Already, its website explains steps the company takes to protect privacy, including reducing the use of Social Security numbers. The mishap shows how companies must make sure its vendors understand its requirements. It also shows the danger of mailing windowed envelopes to customers.

Aetna may also wish to employ social media measurement to gauge possible damage to its image, track changes in sentiment over time, and measure the effectiveness of its PR crisis response. The mailing mishap naturally prompted criticisms on social media, and appropriate measurement of social media can provide accurate assessment of public opinion. More insurance companies are learning that social media monitoring and measurement can improve crisis communications as well as improve customer service, uncover fraud and generate sales leads.

Bottom Line: By accidently revealing identities of HIV patients, Aetna created a customer relations problem and a potential PR crisis. Crisis experts applauded how Aetna responded to the problem and suggested steps the company can take to mitigate further damage. The episode highlights how important it is for companies to protect confidential customer information.