In January 2018, Aetna settled a lawsuit for $17 million over a data breach. In March 2018, a class-action lawsuit was filed against CVS, Fiserv and other parties for a similar data breach. The cases are related – the privacy compromises occurred because personal health information (PHI) could be seen through the window of the envelopes used for mailing notices to people with HIV.
In the case of the letter sent by Aetna, the envelope had an oversized address block window, to allow mailings with different return addresses to use the same envelope. However, the letter was printed in such a way that several lines of PHI also appeared through the window.
The CVS mailing was different, as the envelope had 2 windows. The return window had “CVS/Caremark” and “Ohio Department of Health”. In the second window, there’s not only the mailing address, but 2 other lines – an alphanumeric code in the top line, and directly below it, “PM 6402 HIV”. The complaint states that any person seeing the envelope could conclude that the recipient is HIV-positive.
As the lawsuit points out, people “with HIV are still subject to stigma, humiliation, mental anguish, embarrassment, and stress based on their HIV status.” Ignorance and prejudice cause unnecessary fear, resulting in broken relationships and lost jobs. In turn, this fear means people often feel they must hide their HIV-positive status.
In both mailings, a comprehensive quality control program, with proper testing and reviews before production, would have prevented these privacy breaches. Letter templates should designate “clear zones” where personal information must be excluded. Supervisors, operators and quality control staff should have checklists that include inspecting what information displays through the envelope windows.
Too often, operations is focused on “cost-per-piece”, and has discontinued the use of separate quality control teams. In a rush to meet client deadlines, full testing – including print and insert – is often bypassed. The word “quality” appears on brochures and in proposals, but employees are rewarded on throughput.
An effective quality control program requires buy-in at all levels – including operators, coordinators, supervisors and managers. The emphasis on quality control needs to be more than a process, it must become part of the culture of the organization. While reviewing critical steps does slow down the process, quality must be enforced. Additional spot checks conducted by leads and supervisors will increase the focus on quality controls, with an emphasis on preventing errors.
Achieving a high level of quality requires commitment by leadership, and the establishment of an environment in which quality can flourish. Controls will add to the costs of printing and mailing. However, a slightly higher cost for doing a job once correctly, is less expensive than having to complete a job a second time because of errors. Even more importantly, quality controls will protect the privacy of the recipient, and keep mailers out of court.
