According to federal court filings and news reports CVS Health Corp divulged the protected health information of 6,000 Ohio residents by mailing letters in envelopes with windows that revealed names and references to HIV diagnoses. The suit alleges that a targeted mail-service delivered envelopes with two windows. One window showed the logo of CVS and an address for the Ohio Department of Health, and the other window included patient names under the ID number “PM 6402 HIV.” The envelope showed a message that said, “Your new prescription have arrived.”
Under the proposed settlement, CVS Corp will pay $4.35 million to resolve these claims.