CVS Health agreed to pay $4.4 million to settle a lawsuit accusing it of exposing the HIV status of roughly 4,500 Ohio patients, according to The Columbus Dispatch.
The class-action suit, filed in federal court in June 2018, centered on a mass mailing to participants in a state-funded HIV assistance program. The contractor for CVS, Fiserv, reportedly mailed letters showing the recipients name, address and a code indicating the person's enrollment in the assistance program in the clear portion of the envelope.
Some recipients of the letter said CVS violated patient privacy laws and that they could have been harmed if their HIV status became public.
Under the settlement, each recipient of the letter will receive at least $400. People who show they suffered non-financial harm can get as much as $2,500, while people who can show they did suffer financial harm can get up to $10,000. Plantiff's lawyers may receive up to $1.46 million, a third of the overall reward, according to the Dispatch.
The settlement also prohibits CVS from sending out envelopes that say "HIV" in the future and requires it to train its employees on federal privacy laws.
The settlement was filed in the U.S. District Court Dayton Sept. 10. It still needs approval from a judge.