Live data from Hacker News

Aetna accidentally exposed customer HIV statuses in clear envelope windows

washingtonpost.com

121–130 of 130 posts

Re: Aetna accidentally exposed customer HIV statuses in clear envelope windows

#121

Earlier quoted context omitted.

> 3rd party was contracted out by Aetna to do the mass mailing and they you could probably wrap back through #1 and #2 for them as well. To contract this out would be a terrible breach of protocol.

>To contract this out would be a terrible breach of protocol. That's false. HIPPA covered entities are allowed to engage contractors, who are allowed to handle protected health information (they also must comply with HIPPA, of course). Source: have worked for an HIO (health information organization, a type of HIPPA compliant contractor), and https://www.hhs.gov/hipaa/for-professionals/faq/547/to-what-...

You are 100% correct, I messed that up. What came to mind was the likes of Sendgrid or Mailchimp. Apologies and thank you for the correction.

Re: Aetna accidentally exposed customer HIV statuses in clear envelope windows

#122

Earlier quoted context omitted.

Yes we do have standard paper and envelope sizes in the US that are similar to Europe. What probably happened here is they printed the info in a dumb layout that was too close to the address field and/or whoever was running the folder-inserter machine did not move the tri-fold area to the right place. (Source: I used to sell these machines.)

The point is that the page layout, i.e. where the fold positions, address field, letter title, reference numbers, date, logo, and actual content go, is standardised as well (DIN 5008). Nobody forces you to use that standard but it frees your mind thinking about actually important stuff so everybody does. This doesn't help against incorrectly using a folder-inserter but I have never seen that happen. What does the use…

I've not seen a standard position for such fields. Different software produces different layouts of printed information. I suppose it's possible that MOST software will produce a standard layout, but in my short time in the industry I witnessed a wide range of layouts for documents intended to be folded and inserted into a window envelope. (EDIT: Should add that 'software' would also include printer drivers and printer hardware/software that does not always interpret fonts, sizing, etc., in the same way.)

As for how folder-inserters can be used incorrectly: there are various settings you have to fine-tune, most notably the location of the creases. If the creases are too far in one direction, you will end up with the address not displaying appropriately in the window. So you run a test, bump it up or down, and repeat until the info is in the window correctly. THEN, and only then, do you proceed to run the remaining 100s or 1000s of pages.

Worth noting that tuning is not always due to printed pages being in different layouts. The machines themselves have moving parts that start drifting a bit over time, so you are basically recalibrating it.

Re: Aetna accidentally exposed customer HIV statuses in clear envelope windows

#123
post #98

Earlier quoted context omitted.

If I had a dollar for every problem the Germans introduce by over-thinking current problems I could drive a German luxury car (that is old enough to not still be under warranty).

> I could drive a German luxury car ...and then your mechanic will curse you for having a vehicle that is insanely difficult (and expensive) to repair (hang out on /r/justrolledintotheshop for a little while to see what I mean - "service position" anybody? Or what about the carnage to fix a simple heater core?)...

Service position is a Volvo thing IIRC.

Reddit has an Toyota fetish which I find pretty intolerable.

Re: Aetna accidentally exposed customer HIV statuses in clear envelope windows

#124
post #109

Earlier quoted context omitted.

The point is not that NICE is perfect, but that these limitations are subject to democratic control - if people feel that the NHS treatments are inadequate based e.g. on the NHS being unable to fund treatments that are recommended by NICE, the government has a direct and immediate ability to control the funding. It happens quite regularly that public debate over NHS funding of specific treatments leads to concrete ch…

> And, as pointed out, people additionally have the option of taking out additional coverage, That's like saying "people additionally have the option of paying out-of-pocket". Remember, by definition, the expected monetary value of insurance is negative, so unless the private insurance is being subsidized by taxpayer dollars (defeating the whole point), this is equivalent to saying that people are still free to pay f…

> That's like saying "people additionally have the option of paying out-of-pocket".

No, that's pointing out that in the UK, we have an insurance system that is so cheap that for the very few that feels it's insufficient, it is still cheaper if they buy supplementary insurance on top, and they do have the option of have both private and socialised insurance.

> What the NHS does is not fundamentally different from what insurance companies do.

It does result in fundamentally better coverage for far less money. Somehow that seems "fundamentally different" to me. We pay on average about half as much, and for that everyone gets covered, and those that aren't satisfied can pay - still less - to get far more extensive cover.

The pigheaded insistence on defending the US system is to me utterly bizarre given that it's more expensive even if you choose to go private on top of the socialised systems in most of Europe. Especially given the kind of stories in this thread - from a European perspective they're the kind of horror-stories that makes at least me want to never consider living in the US.

> Saying that it's subject to "democratic control" doesn't really mean a whole lot

It does mean a whole lot when there are a number of examples of how it results in actual change.

> (Notice that PrEP has been available in the US for five years at zero cost to patients, and it's still not available in the UK.

Firstly, you can not consider the UK as a whole as one entity, as the NHS is not a single system, and control of NHS Scotland is devolved. Scotland started NHS funding of PrEP in April 2016.

This is an issue of speed of approvals of new treatments, which frankly says little about the respective systems - the reverse is often true too; drugs coming out of Europe often take years to get approved for use in the US.

Secondly, PrEP has been available to people in the UK from online pharmacies since 2016. It's not available on the NHS outside of a trial, but the flexibility of UK drug import rules means that buying PrEP in the UK is possible for around $50/month.

Also while it may have been technically available for 5 years in the US, wide insurance cover does not appear to have been present nearly that long.

Saying it is zero cost to patients in the US also seems like cherry-picking. The pages I find all say that outside of various programs targeting specific groups you can expect to pay your normal insurance co-pay, which for many will be more than the full cost of buying these drugs for UK patients outside of insurance.

In any case this boils down to the usual process of approvals varying country by country irrespective of the system - in most of the world PrEP is not yet approved, irrespective of budgets.

If you want to a meaningful comparison of this you'd need to do a wide comparison of time to approvals. Otherwise you need to look at availability of drugs post-approval.

> Or, notice that the cure for HCV is generally accessible on private insurance in the US, but almost nobody in the UK is able to receive it through the NHS.)

I believe that's at least two years out of date - as far as I can see expanded funding was approved in 2015, and an example of how policy was changed within weeks after a charity made the public aware of it. Given that the drug in question was rolled out in 2013/14 that does not seem unreasonable to me.

Same issue as above in any case, where looking at the newest drugs says little about long term availability of care.

Re: Aetna accidentally exposed customer HIV statuses in clear envelope windows

#125
post #124

Earlier quoted context omitted.

> And, as pointed out, people additionally have the option of taking out additional coverage, That's like saying "people additionally have the option of paying out-of-pocket". Remember, by definition, the expected monetary value of insurance is negative, so unless the private insurance is being subsidized by taxpayer dollars (defeating the whole point), this is equivalent to saying that people are still free to pay f…

> That's like saying "people additionally have the option of paying out-of-pocket". No, that's pointing out that in the UK, we have an insurance system that is so cheap that for the very few that feels it's insufficient, it is still cheaper if they buy supplementary insurance on top, and they do have the option of have both private and socialised insurance. > What the NHS does is not fundamentally different from what…

> The pigheaded insistence on defending the US system

While I could respond to the rest of your points - including a couple of the statements which are factually incorrect - if this is the way you're going to talk to someone who's having a conversation with you in good faith, there's not much point in me spending any more time on the matter here tonight.

Re: Aetna accidentally exposed customer HIV statuses in clear envelope windows

#126
post #119

Earlier quoted context omitted.

I've heard a lot of complaints about government organizations. "Motivated to save money" isn't one of them.

Tons of government programs have wait lists because they don't have enough money. And other programs don't give people enough, because the program doesn't have enough to do so. Any government run healthcare would be money constrained the same way, and they would have to do exactly the same as the insurance companies to try to save money in order to have enough to at least give the impression of being fair to everyone…

Empirically that doesn't seem to be the case.

Re: Aetna accidentally exposed customer HIV statuses in clear envelope windows

#127
post #86

Earlier quoted context omitted.

As far as your provider is concerned, whether your insurance should pay or not isn't really their problem. I have never been somewhere that did not make me sign a form saying that I agreed to be responsible for whatever my insurance did not pay.

Most providers understand the shit-show that is insurance, and will drastically adjust their behavior and prices based on who is paying.

Maybe, but that doesn't help if it goes to collections like the parent part describes.

Re: Aetna accidentally exposed customer HIV statuses in clear envelope windows

#128
post #18

Wow, this is actually something I consider when sending letters to my clients. I don't ever want to "leak" their info, even if it's not really considered sensitive. I always assume the top third to be "compromised", only putting the private contents in the lower two thirds or on the back. I wonder why they don't have the mailing rule of the top third as a written policy.

A cost/benefit analysis of "put all HIPAA-relevant information inside an opaque envelope" probably comes out ahead if it prevents one issue like this. Hell, make the envelope a specific color to make it really obvious that you've done things correctly.

Also there is something called a security envelope, which is printed on the inside with a pattern of lines that makes it difficult to read the contents of an unopened letter by holding it up to the light.

Back when mailing checks to pay bills was a thing, everyone had a box of them and that's what you used. I imagine companies today should still use them.

Re: Aetna accidentally exposed customer HIV statuses in clear envelope windows

#129
post #59

Earlier quoted context omitted.

This is not something I'd recommend. Any lapse in payment will be used to suspend your policy in the future in the event you get flagged as a high-expense patient, backdated to the period you didn't pay your premiums on time. Pay on time, keep documentation you paid on time. Hell, turn on autopay and keep documentation on -that-. Don't ever think you can hold your premiums hostage. You'll only be screwing yourself. E…

I wonder if they meant that you shouldn't pay providers until things are sorted out. I agree that you need to pay your premiums, but doctors and hospitals will just send you to collections. Still not a great option, but it does keep the money in your pocket until things are sorted out. (Of course, I wouldn't do this unless I was very sure I was right, also, so that any collections issues would be an insurer/provider…

It is (also) their problem. If they're in the network, they've agreed to certain terms as well.

I'm not saying skip out on your bills. I'm saying that the provider and insurance need to figure the bill out. I'm not floating a provider in my network so that I can fill out a ton more paperwork to get reimbursed eventually.

And yes, they do make errors in major ways. Just two years ago, I got as though I hadn't made my deductible. It was a $2500 difference. It's much easier to have a provider refile to get their money than for me to pay them and then work through the insurer's system to get reimbursement.

Re: Aetna accidentally exposed customer HIV statuses in clear envelope windows

#130
post #40

Earlier quoted context omitted.

I have them through work, they're pretty shitty, for example, I currently have to either turn of uBlock (not an option) or open dev tools to unhide a div in order to log in. Why there is anything on health insurance website that communicates with a third-party server baffles me. That said, I don't think there are any good options in the US. They all have weird quirks like this, they all require a fight to get the pay…

Aetna uses JavaScript for everything on their website. Can't middle-click a link to open in a new tab because it's JS, not a proper link.

I can accept that but whatever the reference to twitter ads is for, I'm appalled by.
Post reply on HN