AETNA INC.

Aetna Inc. (CT, Health Plan) reported to HHS OCR on 2017-06-20 an Unauthorized Access/Disclosure affecting 5,002 individuals. On April 27, 2017, two web services displaying plan documents allowed access without login credentials and were indexed by internet search engines, exposing names, insurance IDs, claim payment amounts, procedure codes, and dates of service. Separately, envelope mailings in July and September 2017 inadvertently disclosed HIV medication and atrial fibrillation study participation to additional members. OCR settled with Aetna for $1,000,000 plus a corrective action plan. Breached information located on Network Server.

Affected (this filing):

Aetna reported a data breach to the Montana Attorney General. The breach was reported on 2017-06-21. The breach occurred on 4/27/2017. 11 Montana residents were affected.

Affected (this filing): 11

Aetna, Inc. reported a data breach to the Oregon Attorney General. The breach was reported on 2017-07-10. The breach occurred during 2/1/2017 - 4/28/2017. The breach was discovered on 4/24/2017. 5,002 individuals were affected. Notice was sent on 6/21/2017.

Affected (this filing): 5,002

Aetna Inc. reported to HHS on 2017-08-29 a Unauthorized Access/Disclosure affecting 11887 individuals. Breached information located on Paper/Films. Aetna settled potential HIPAA violations for $1,000,000 involving impermissible disclosures of PHI via web services and mail envelopes.

Affected (this filing):