CVS is under the microscope after a recently filed federal lawsuit claims the company unintentionally revealed the HIV status of up to 6,000 Ohio residents. The breach allegedly happened through a prescription mailing.

The Dayton Daily News reports the lawsuit claims a letter that had information about getting HIV prescriptions through a CVS program was sent to about 6,000 participants in the state’s HIV Drug Assistance Program between July and August 2017. CNN news reports the envelope’s window allegedly showed the status of the participants.

CVS says the letter’s envelope window was intended to include a reference code for the assistance program, not the recipient’s health status.

Three unidentified HIV-positive plaintiffs are seeking class action status and a jury trial. They claim the company was aware of the issues months ago and did not notify those affected or the federal authorities.

CNN reports one plaintiff identified as John Doe Three says he lives in a small town in Gallia County where, "everyone knows everyone" and has experienced "significant distress as a result of this disclosure."

CNN says he is scared to leave his home and has "experienced complications and health issues since this disclosure, up to and including just in the past several days."

In a statement to CNN, CVS said "CVS Health places the highest priority on protecting the privacy of those we serve, and we take our responsibility to safeguard confidential information very seriously," the statement said.

"As soon as we learned of this incident, we immediately took steps to eliminate the reference code to the plan name in any future mailings."

The lawsuit also named Fiserv, the company that CVS hired to mail the letters.

 

Photo Credit: Le Do