Patients Sue CVS for Revealing Their HIV Status

A handful of people living with HIV are livid after learning that CVS pharmacy chain outed over 6,000 patients, including themselves, as being HIV-positive. A class action lawsuit was filed in the Ohio Court of Claims against CVS Caremark and The Ohio Department of Health for its alleged connection with the scandal.

The patients’ statuses were revealed via mailings of their prescription drugs. The reference code — including the letters “HIV” — were visible for all eyes to see through the envelope window.

Three plaintiffs are listed in the case as John Doe and are men living with HIV in Delaware, Defiance, and Gallia counties in Ohio. All are recipients of the Ohio HIV Drug Assistance Program, which were contracted with CVS Caremark in March 2017.

According to the lawsuit, the pharmacy chain labeled patient mail with "PM 6402 HIV" which was visible for all to see through an envelope window,  including CVS employees and mail delivery personnel. Another company, Fiserv, was named in the lawsuit and was contracted by CVS to do mailings.

Things fell apart quickly after mail-outs were clearly not done properly. Ohio’s Department of Health also failed to follow critical protocols. “At some point prior to August 2017, even though [the Ohio Department of Health] in its proposal stated that it would take sole responsibility for such a mailing, CVS and [its contractor] agreed to send a mailing to [Ohio Drug Assistance Program] participants relating to CVS providing services to OHDAP enrollees and sending them membership cards,” the lawsuit reads. “Significantly, many individuals did not have a relationship at that time with CVS and thus had not provided any prior authorization for CVS to access such information.”

People living with HIV have obvious reasons to keep their status a secret, such as preventing employment or housing discrimination. Thousands of men and women have lost their jobs, lost their career foothold, or even their families after being identified as being HIV-positive. There are serious and permanent consequences, if the wrong people find out.

This follows a similar case last February in which four patients sued CVS Caremark for denying them basic pharmacy comforts including privacy. The four plaintiffs in that case allege that their status was made known to other customers in line at the pharmacy. Several changes were made without alerting the patients.

According to the lawsuit, CVS was aware of the breach months ago and failed to notify the patients that were affected or the U.S. Department of Health and Human Services. To substantiate that claim, there is no record of the breach on the Department of Health’s website under its breach report. Whenever there is a legitimate breach of the Health Insurance Portability and Accountability Act (HIPAA), entities like CVS are required to notify both of the above-mentioned parties.

“Persons with HIV are still subject to stigma, humiliation, mental anguish, embarrassment, and stress based on their HIV status,” the complaint reads. “They may also run the risk of the loss of housing, relationships, and employment when their HIV status is revealed.”

People living with HIV don’t have time to worry about unnecessary disclosure of their status. It’s the last thing they want to worry about. Entire lives could have been destroyed based off of the negligence of CVS and its partners by failing to provide privacy for ultra-sensitive conditions such as HIV.

The litigation is still pending.