The Instance of the Revealing Envelope: HIPAA Confidentiality Obligations Extend Beyond Electronic Systems

Violations of the Health Insurance Portability and Accountability Act (HIPAA) generally involve computer breaches or procedural snafus. But a recent incident involving a mailing by insurer Aetna illustrates that HIPAA obligations are equally applicable to paper communication.

Consumer advocates complained that a July 28, 2017 letter from the insurer effectively exposed the HIV status of approximately 12,000 recipients. The letter, outlining options for HIV medication prescriptions, may have been visible through a window in the envelope.

Aetna apologized, while noting that not every envelope in the mailing was affected. Nevertheless, it is in the process of contacting both state and federal regulators. Since HIPAA defines the inadvertent disclosure of personal health information as a breach, the incident is being treated as one. Aetna has notified potentially affected individuals. The notification stressed that "the viewable information did not include the name of