Aetna accidentally exposed customer HIV statuses in clear envelope windows
washingtonpost.com
washingtonpost.com
None of scenarios can diminish just how awful this is of course. There are some things you can get wrong on that envelope that are bad, but not really livelihood threatening. This is life changing for a huge number of people I'm sure, and the companies involved should be held accountable for the breach.
To contract this out would be a terrible breach of protocol.
That's false. HIPPA covered entities are allowed to engage contractors, who are allowed to handle protected health information (they also must comply with HIPPA, of course).
Source: have worked for an HIO (health information organization, a type of HIPPA compliant contractor), and https://www.hhs.gov/hipaa/for-professionals/faq/547/to-what-...
[0] http://www.nytimes.com/2013/08/03/us/postal-service-confirms...
Is this normal for them? Am I an idiot?
My experience with my wife's health care (Aetna) has been that she will call, try to get an issue resolved, be told "there is no resolution possible" enough times by enough different people that she is ready to give up. Then we call together, and suddenly the story changes.
The particular issue we were dealing with, is not really important, but tl;dr I almost wound up with two health insurances because I tried to stay insured and cover my bases when I was changing jobs, and nobody needs two health insurances.
They tried to tell us we couldn't cancel when I got a new job that came with better coverage for less. I thought that was a qualifying event! But, through some nonsense technicality we would not be allowed to cancel during the plan year, and even though I'd never made a claim and we were making quarterly payments, we'd be on the hook for the remainder of payments for the whole year. (This is illegal, I'm sure of it.)
The best advice I can give you is, know your rights and how to assert them. Good luck with that though, health care in this country is byzantine and I had the benefit of people in my family that work in health care administration who could help me understand.
2) "My (partner) works in insurance. He does shit like this for a living. Please don't make me have to (goto 1)".
3) Feel free to cite the law where relevant, on paper, certified mail. The response is invariably "this is wrong, you misunderstand the law, but we will make an exception and (follow the fucking law this once.)"
I was in health insurance, management level, before I went into medicine.
Pay on time, keep documentation you paid on time. Hell, turn on autopay and keep documentation on -that-.
Don't ever think you can hold your premiums hostage. You'll only be screwing yourself.
Edit: if you're referring to clinic bills, be sure you're in active communication with the practice manager so you don't get sent to collections. If it's a hospital, you'll be sent to collections anyway - they automate that process, once you're sufficiently late.
I'm not saying skip out on your bills. I'm saying that the provider and insurance need to figure the bill out. I'm not floating a provider in my network so that I can fill out a ton more paperwork to get reimbursed eventually.
And yes, they do make errors in major ways. Just two years ago, I got as though I hadn't made my deductible. It was a $2500 difference. It's much easier to have a provider refile to get their money than for me to pay them and then work through the insurer's system to get reimbursement.
We had a very similar experience with Blue Cross for many years. I'd swear they have an RNG that randomly denies claims 80% of the time. You just had to fight each one on the phone.
The people on the phone only had the apparent authority to "send the claim through the system again". About a month later you'd find out what happened. If denied again, we would just repeat until we eventually got lucky with the RNG.
They did eventually pay everything they should have, but we'd average about two hours on the phone per doctor visit.
Why is it so hard for some smart young folks to come along and hammer out solutions to accomplish less fraud, easier, and faster to use systems etc?
It seems like it's really REALLY hard to bust up this abortion we call healthcare in the US.
Efficiency is a tough nut to crack but there are organizations like Kaiser Permanente that have been very successful with a vertical integration model to cut this overhead. The problem is that it's a political fight every step of the way - doctors, hospitals, insurance companies, and drug makers each have their own extremely powerful lobbies who will spend lavishly to keep their cut of the profits flowing.
Which is why we're actually moving in the opposite direction - the ACA moves away from this type of integrated care organization and towards a fee-for-service model. The idea is to have the consumer be the one choosing the cheapest MRI provider or whatever - but in practice the pricing is still entirely opaque and the public are more or less thrown to the wolves. The finest health-care plan the Heritage Foundation could devise...
And of course everyone has their own idea of how to improve efficiency, all of which translates into a lot of paperwork and red tape. That is why your insurance denies claims after all - "efficiency" (airquotes). It creeps into every aspect of medical care, especially anything having to do with Federal dollars (Medicare/Medicaid). And to be fair a lot of it is justified, it is an uphill battle to get providers to adopt even basic best-practices like checklists during surgical procedures ("remove and count all 5 pieces of gauze before you close the patient"...). Another thing that doctors fight tooth and nail is clinical decision-support tools - even though these are a value-add for the physician in many cases (did you want to order that test with contrast or without? A family doctor may not know.)
(disclosure: I worked on such a tool at my current employer)
One little-addressed area of extreme waste is generic drugs. The idea is that once your patent expires (after decades of "patent evergreening" of course) anyone can make your drug - but in practice that's not how it works, one company just dumps product on the market at cost until everyone else leaves the market, at which point they are once again free to charge whatever they want. The overhead costs of starting drug production is quite high, and in practice it's more difficult for new drugs to claim bioequivalence because the drugs involve biological steps in their production. A company is not obligated to share the organisms used in their production process and if a competitor creates their own they must repeat FDA approval processes, which are inordinately expensive.
Suffice it to say he was impressively unsuccessful, but it gives very interesting insight into how and why the problem is so complex, just from a consumer's perspective.
[1] https://www.vox.com/2016/5/5/11591592/birth-cost-hospital-bi...
Aetna is terrible. The lobby against healthcare reform at every turn. They didn't want obamacare/ACA they didn't want to compete accross state lines, they want to be able to exempt people from pre-existing conditions, they want to give people the run-around.
They are not trustworthy and they are run by bad people. (don't beat up on their phone agents though, they are just trying to make ends meets).
The banking renaissance in South Dakota is a result of a similar situation.
https://www.theatlantic.com/business/archive/2013/07/how-cit...
Not really; states are still free to set additional requirements for insurance plans that cover members of that state.
To be honest, competing across state lines would not actually do much in the long run. It'd provide an extra degree of competition in the short-term, but ultimately then insurers would consolidate into multistate operations (which is already the case to a large degree).
Cruz's proposed legislation from a couple years ago appears to restrict what "secondary" states can regulate quite a lot:
https://www.congress.gov/bill/114th-congress/senate-bill/647...
(b) Exemptions From Covered Laws in a .—Except as provided in this section, a health insurance issuer with respect to its offer, sale, rating (including medical underwriting), renewal, and issuance of individual health insurance coverage in any secondary State is exempt from any covered laws of the secondary State (and any rules, regulations, agreements, or orders sought or issued by such State under or related to such covered laws) to the extent that such laws would—
Of course it spells out a bunch of situations where the secondary state would still have authority, but reducing the ability of states to regulate sure seems to be one of the goals there.
https://www.forbes.com/sites/clairetsosie/2017/04/14/why-so-...
I've gotten very tired of this. Every time I'm on calls like this now I gently suggest to the phone agent that they know that what they are doing contributes to a system that hurts people and that they should try to do something more with their lives.
Don't scream or bluster. Do it with gentleness and respect and get ready to be occasionally very surprised at the results.
I worked alongside many people in their 60s. Imagine doing that as a retirement plan.
Nine times out of ten, you'll get a dismissive hangup but every once in a while it shatters the script and you'll get a quick story of someone trapped in a bad situation and then a quick word of advice on how to proceed in a a way that will get results.
Its a rhetorical phone nuke. Use it carefully. I started using it about 5 years ago when I noticed that the "heartfelt plea" had utterly stopped working.
I also use it often when "Microsoft tech support" calls me to tell me that they have detected that my computer has a virus. Its a touch more appropriate in that situation.
They certainly do act to minimize the claims they pay.
People are still really critical of the current regulation, where you can sign up during the enrollment period without any penalty.
Those organization types are just as motivated to save money as for-profit is.
Any government run healthcare would be money constrained the same way, and they would have to do exactly the same as the insurance companies to try to save money in order to have enough to at least give the impression of being fair to everyone.
The issue here is not for-profit insurance companies, it's that there is no competition on the Doctor side of things, so costs just go up and up and up.
A fair number of the Blue Cross/Blue Shield companies, for example.
This is true, but I'd like to qualify this by saying that all of the for-profit insurers (and most of the non-profit ones) are terrible. Generating revenue is in direct conflict with providing patient care which is a fundamental flaw in the setup. It's a uniquely American problem.
Without revenue, there's no money to use to actually provide care.
> It's a uniquely American problem.
It's not at all. Aside from the fact that most of the world uses at least some degree of privatization in providing or paying for healthcare, even the few that don't do so at the metaphorical "last mile" (such as England) still suffer from the unavoidable problem that money isn't infinite, and sometimes decisions have to be made to deny people care that otherwise still would have a material benefit to the patient.
In America, the insurance company and their payment policies carry more weight than the doctor's decisions. This matters a great deal if you have a traumatic accident and require many surgeries, as happened to a friend of mine. In America, if you have a trauma, you are recommended to get a lawyer immediately to help your medical expenses be handled properly. Think about that... in America, if you get hurt, you need a lawyer almost a badly as you need a doctor. Not because you need to sue the cause, but because you need to encourage the insurance company. There's something fundamentally miserable about that.
No, in most developed nations other than the US, the doctor has approximately the same power that they do in the US.
The difference is that, under capitated systems or systems like the NHS (which is not actually capitated yet, but functions more or less like it is), the doctor factors the cost into their decision-making process. That might sound like a good thing for patients, but it's generally not - it means they have an incentive to avoid unnecessary care, but they also have a very direct incentive to bias on the side of avoiding necessary care as well, to avoid eating into their budget.
This is absolutely a problem with the NHS, although Hacker News readers tend not to be the demographics that suffer from it the most, so you don't hear about it as much here.
> in America, if you get hurt, you need a lawyer almost a badly as you need a doctor
I get that this is intended to be hyperbole, but even on that scale, it's absurd.
As a result it is very transparent what is sacrificed - e.g. you can find NICE [1] documentation on evaluations of individual drugs and treatments and their benefits, and documentation of the decision making processes of the NHS trusts, so they can be debated and used as a basis for deciding funding, or you're free to sign on to additional private cover if the exemptions worry you.
What we don't get is debates like this where people need to exchange information about whether or not an insurer is likely to try do be excessively strict in denying claims etc., because those kinds of things are extremely marginal here, not something most people ever need to deal with.
The decisions that NICE makes are not fundamentally different from the decisions that insurers make when deciding which medications and treatments are covered for various conditions, and in fact, you can find analogous documentation of these decisions from every major insurer.
> The difference is that those systems goes to great lengths to ensure that the decision is done based on clinical needs and objective measures of what achieves the most patient benefit for the available money.
Emphasis mine.
NICE is not operating in some magical world where "revenue" and "costs" are somehow not intrinsically linked with clinical decisions. They're doing the same thing that insurers do - make decisions about treatments based on objective measures of clinical outcomes, subject to a finite budget.
Ironically, this entire thread is about HIV, and HIV treatment and prevention are one area in which the NHS falls drastically short of what's available in the US both to people on private insurance and to people without insurance coverage whatsoever.
And, as pointed out, people additionally have the option of taking out additional coverage, which as it happens also provide us with a good idea of to what extent people feel the NHS is sufficient. Typically only around 10% take up private insurance, mostly as a perk offered by some employers.
The availability of that as a (quite cheap) "escape hatch" is quite interesting in that respect. Especially given that the average person in the UK pay far less towards the NHS than the average American pay for healthcare via taxes and health insurance - you can sign up for high end private insurance in the UK and still end up paying less.
> They're doing the same thing that insurers do - make decisions about treatments based on objective measures of clinical outcomes, subject to a finite budget.
NICE's recommendations are not subject to the NHS budget. They are independent for a reason. Cost efficiency of a treatment enters into their assessments, but they do not have final say on which treatments are offered. They make recommendations based on the clinical need and document efficacy, outcomes and costs. It's up to the NHS to then allocate funds accordingly.
> Ironically, this entire thread is about HIV, and HIV treatment and prevention are one area in which the NHS falls drastically short of what's available in the US
I don't know the details of this, but find it curious given that some quick searches indicate that the HIV/AIDS death rate in the US per 100,000 is a larger factor above the UK than the prevalence rate.
Of course that could be for other reasons than treatment.
I know there's been some debate over funding of preventative treatments (with the NHS finally deciding to fund trials), but that was over responsibility largely (preventative measures is in general a council responsibility), but if anything the fact that the NHS decided to start trials after public debate seems to me a pretty good demonstration of what I'm saying.
The system is not perfect, but it's open, transparent and subject to democratic control.
That's like saying "people additionally have the option of paying out-of-pocket". Remember, by definition, the expected monetary value of insurance is negative, so unless the private insurance is being subsidized by taxpayer dollars (defeating the whole point), this is equivalent to saying that people are still free to pay for treatments themselves.
> NICE's recommendations are not subject to the NHS budget. They are independent for a reason. Cost efficiency of a treatment enters into their assessments, but they do not have final say on which treatments are offered. They make recommendations based on the clinical need and document efficacy, outcomes and costs. It's up to the NHS to then allocate funds accordingly.
You can't escape the fact that, at the end of the day, the process still amounts to the same thing. Given a finite budget, decisions are made on how to allocate that funding based on clinical data, resulting in some people not receiving treatment, even though they would otherwise benefit clinically from it. What the NHS does is not fundamentally different from what insurance companies do.
Saying that it's subject to "democratic control" doesn't really mean a whole lot, except that the process ends up being a lot slower, and it becomes a political battle. (Notice that PrEP has been available in the US for five years at zero cost to patients, and it's still not available in the UK. Or, notice that the cure for HCV is generally accessible on private insurance in the US, but almost nobody in the UK is able to receive it through the NHS.)
No, that's pointing out that in the UK, we have an insurance system that is so cheap that for the very few that feels it's insufficient, it is still cheaper if they buy supplementary insurance on top, and they do have the option of have both private and socialised insurance.
> What the NHS does is not fundamentally different from what insurance companies do.
It does result in fundamentally better coverage for far less money. Somehow that seems "fundamentally different" to me. We pay on average about half as much, and for that everyone gets covered, and those that aren't satisfied can pay - still less - to get far more extensive cover.
The pigheaded insistence on defending the US system is to me utterly bizarre given that it's more expensive even if you choose to go private on top of the socialised systems in most of Europe. Especially given the kind of stories in this thread - from a European perspective they're the kind of horror-stories that makes at least me want to never consider living in the US.
> Saying that it's subject to "democratic control" doesn't really mean a whole lot
It does mean a whole lot when there are a number of examples of how it results in actual change.
> (Notice that PrEP has been available in the US for five years at zero cost to patients, and it's still not available in the UK.
Firstly, you can not consider the UK as a whole as one entity, as the NHS is not a single system, and control of NHS Scotland is devolved. Scotland started NHS funding of PrEP in April 2016.
This is an issue of speed of approvals of new treatments, which frankly says little about the respective systems - the reverse is often true too; drugs coming out of Europe often take years to get approved for use in the US.
Secondly, PrEP has been available to people in the UK from online pharmacies since 2016. It's not available on the NHS outside of a trial, but the flexibility of UK drug import rules means that buying PrEP in the UK is possible for around $50/month.
Also while it may have been technically available for 5 years in the US, wide insurance cover does not appear to have been present nearly that long.
Saying it is zero cost to patients in the US also seems like cherry-picking. The pages I find all say that outside of various programs targeting specific groups you can expect to pay your normal insurance co-pay, which for many will be more than the full cost of buying these drugs for UK patients outside of insurance.
In any case this boils down to the usual process of approvals varying country by country irrespective of the system - in most of the world PrEP is not yet approved, irrespective of budgets.
If you want to a meaningful comparison of this you'd need to do a wide comparison of time to approvals. Otherwise you need to look at availability of drugs post-approval.
> Or, notice that the cure for HCV is generally accessible on private insurance in the US, but almost nobody in the UK is able to receive it through the NHS.)
I believe that's at least two years out of date - as far as I can see expanded funding was approved in 2015, and an example of how policy was changed within weeks after a charity made the public aware of it. Given that the drug in question was rolled out in 2013/14 that does not seem unreasonable to me.
Same issue as above in any case, where looking at the newest drugs says little about long term availability of care.
While I could respond to the rest of your points - including a couple of the statements which are factually incorrect - if this is the way you're going to talk to someone who's having a conversation with you in good faith, there's not much point in me spending any more time on the matter here tonight.
They have an interesting governance structure (https://en.wikipedia.org/wiki/Kaiser_Permanente) that tries to align incentives correctly.
[1]: Coverage areas as divided by corporate entities:
Northern California
Southern California
Colorado
Georgia
Hawaii
Mid-Atlantic (vicinity of Washington, D.C., including Maryland and Virginia)
Northwest (Northwest Oregon and Southwest Washington)
Washington (except Southwest Washington)For me Kaiser is a couple things. First of all it is peace of mind. They won't screw you. Essentially everything they offer is covered at a reasonable rate. Example: I was sent to the emergency room once and was able to pay on the spot with the cash in my wallet. Secondly, if you go to one of their medical centers everything is in that building. When I am sick, I don't want to go to a few stops across town to get everything (doctors office, lab, pharmacy, etc).
Additionally they actively do things to keep people healthy. They host farmers markets at some of their centers, run advertisements focused on getting exercise and eating well. In general, they make you feel like they are on your side.
Compare to one of my friends with a bog-standard vaginal birth, was pressured to leave as soon as possible, partner kept getting kicked out of the room, and she paid $7k and counting while still getting random claims. LC visits also not covered despite wanting to breastfeed desperately, and she gave up due to issues that could have been resolved.
It's not even just the baby stuff that is like this - my dad has their medicare advantage plan and he LOVES it and I love the integrated care since it's so easy for his specialists to talk to each other without me having to be the messenger.
Kaiser gets a bad rap a lot of times, sometimes for good reason, but in the average case, they must be doing something okay that they don't fight me like Anthem used to do ALL THE TIME (plus remember when maternity coverage cost like $500 extra _per month_ on the individual market?)
I didn't personally have any problems, and generally zero problems with mental health car (my ex needed it). I don't know if it makes a difference, but my employer (a major pharmacy chain) merely hired them to administer their health plans and funded it through the company. When they dealt with me, they weren't really using their funds.
Edit: I do have APL gap insurance too. I have nothing but praise for them, easy to work with, paid quickly (checks usually made out to me directly because most places here don't deal with APL), and covered most of my out-of-pocket cost with Aetna which I maxed out last year.
I found this out the hard way in the ER mid near fatal allergic reaction
So yeah, you'll be fine...
A few insurers were accepting people (and accepting payment) without actually setting them up in the system. When many of these people went to use the insurance, they were told that not only did they not have insurance, they would be denied any insurance for having pre-existing conditions.
I am worried, though! Because I've got this deduction coming out of my paycheck for insurance, and your insurance provider just told me that they've never heard of me! Escalate!
Maybe they're still doing it
I always assume the top third to be "compromised", only putting the private contents in the lower two thirds or on the back.
I wonder why they don't have the mailing rule of the top third as a written policy.
Hell, make the envelope a specific color to make it really obvious that you've done things correctly.
To be pedantic, the patient's name and address are both considered PHI under HIPAA.
The way that most insurers deal with this is by mailing an envelope that has no obvious information on the outside about the sender (it has a return address that's usually a PO box somewhere in the midwest, but not the company's name). So without opening it, you can't tell that the piece of mail relates to medical information.
Banks do this as well when mailing things like credit cards, to make it less obvious to a would-be interceptor of the mail that there's something valuable inside. (Of course, the deliberate inconspicuousness of it is itself conspicuous, but that's another problem).
Back when mailing checks to pay bills was a thing, everyone had a box of them and that's what you used. I imagine companies today should still use them.
In Germany we have standards for paper sizes, window placement and the layout of business letters. Considering this type of letter is probably not typed out by hand, it's trivial to use a template with the correct layout. At that point the choice of letter becomes irrelevant.
I'd expect the US to have something similar but maybe they don't? If there are standards, this boils down to either "Aetna used non-standard envelopes" or "Aetna formatted letter incorrectly".
This doesn't help against incorrectly using a folder-inserter but I have never seen that happen. What does the user need to do to have an incorrect fold?
As for how folder-inserters can be used incorrectly: there are various settings you have to fine-tune, most notably the location of the creases. If the creases are too far in one direction, you will end up with the address not displaying appropriately in the window. So you run a test, bump it up or down, and repeat until the info is in the window correctly. THEN, and only then, do you proceed to run the remaining 100s or 1000s of pages.
Worth noting that tuning is not always due to printed pages being in different layouts. The machines themselves have moving parts that start drifting a bit over time, so you are basically recalibrating it.
E.g. A4 almost the size of US Letter, but from there we know if you take an A4 sheet, turn it 90 degrees and puts another one above it in the same orientation, you have A3. Repeat for A2 and so on. Or fold an A4 in half and you have A6. Meanwhile an A4 sheet will fit in a B4 or C4 envelope without being folded, or in a B5 or C5 envelope folded in half...
[1] https://en.wikipedia.org/wiki/Paper_size#International_paper...
Sad that we apparently need to add "outlawing Nazis" to that list now.
...and then your mechanic will curse you for having a vehicle that is insanely difficult (and expensive) to repair (hang out on /r/justrolledintotheshop for a little while to see what I mean - "service position" anybody? Or what about the carnage to fix a simple heater core?)...
Reddit has an Toyota fetish which I find pretty intolerable.
They have already OCR-ed addresses from mail, for years. If they are now retaining the raw images, does this mean that they've inadvertently collected and are holding the HIV status of all the Aetna customers affected by this information leak?
So far, it seems the USPS is not selling what it's collected. (Although I'm sure some of the "make a buck any way you can" crowd in DC and elsewhere would not be above enabling and pushing them to do so.) But, next year? And in case you thing this is far-fetched, many state departments of motor vehicles (DMV) already make their drivers license photographs commercially available, IIRC.
A good said of less than legitimate identification documents are probably far more useful to someone needing urgent medical care than insurance coverage is.
Its pretty bad, but it's not like this was "300k people leaked by hackers for ransom".
HIV clinics have "no-contact" lists and if you hypothetically worked for a survey company that made a phone call to one of those numbers, and said you were calling from "XYZ clinic for PQR person who isn't here right now", and the person who takes your call connects the dots, and realizes XYZ clinic is an HIV clinic... you could make two people very upset, and one person homeless.
Hypothetically speaking... it could be real bad news.
Let's just say after that, we asked every medical office we ever worked with from then on, if they had any "no-contact" lists to please ensure they remove those people from the contact list before we started making calls.
We had a mail/phone operation and I'm just imagining our production manager not looking closely enough at even one of 12,000 pieces of mail in windowed envelopes that says "HIV medication" in plain view, before loading them into his car and mailing them at the post office.
He'd be canned instantly. Someone definitely got fired over this.
Sure, it wasn't 300k people leaked by hackers for ransom. It was giving folks reason to discriminate against 12k people. Does it matter if it was localized?
Some non-zero percent of those 12k people live with a partner who doesn't know their HIV status. It is (edit: could be, if untreated) totally unethical for those people to fail to disclose their status to their partners, but arguably it's much worse for those people to be outed by their health insurance company, who should really be the (#@[expletive](/#@ experts in privacy here.
I'm really not sure it's OK that this letter went out at all, even if they had used the right privacy envelopes!
> Some non-zero percent of those 12k people live with a partner who doesn't know their HIV status. It is totally unethical for those people to fail to disclose their status to their partners
This is itself based in old misinformation about HIV that serves to perpetuate harmful stigmas around HIV.
HIV is treatable, and when properly treated, cannot be transmitted[0]. That's not even taking into account other forms of HIV prevention that are practiced to reduce the risk of HIV transmission. While it's advisable for an HIV- to ask their partner's HIV status (and HCV, and other STD statues), a person with HIV under proper treatment should not be expected to proactively disclose that to every partner or potential partner, and it's not "totally unethical" for them to make the decision not to volunteer that information unasked.
[0] Decades of misinformation have drilled the false belief that HIV is always infectious into people's minds, to the point where public health groups are literally launching massive campaigns to correct this belief.
Q&A: http://i-base.info/qa-on-the-partner-study/
Full study: http://jama.jamanetwork.com/article.aspx?articleid=2533066
I haven't been personally in this situation, but I've been at a company that was afraid we were gonna lose the contract because of a miscommunication between their office and our office, where "no-contact" request was not honored.
I honestly had no idea what you just told me. My focus was on the illegal disclosure by the trusted health care company, because that was the angle I experienced a (much smaller scale) similar situation from.
(I know HIV clinics have no-contact lists, but I am skeptical whether or not health insurance companies do. This story is just a colossal mess, too many layers of wrong for me to comprehend.)
When thinking about the ethical implications you have to take the real world into consideration, not the perfect world.
Some folks don't know they have it, and there are big gaps in health care. Not everyone that needs to be tested or should be tested has the means or transportation to do so, let alone afford the medications. Theoretically, we could test this with normal bloodwork and have tax dollars pay for the medications, treating it like a public health cause. We just don't, partially because of outdated views on it, bigotry, and so on.
Granted, this is completely ignoring the world outside the US, where there are other difficulties.
This is the real world you were referring to, right?
It should also be obvious that he's referring to folks that have medication available. HIV isn't the death sentence it used to be because we've made great strides.
Even though the badness of the situation, I'm saying it would have been terribly worse with mass leaks of the DB this came from. It's not like we in the tech community have seen leaks like that...
Regardless, I see this as a bad screw-up with with no ill intent behind it. It was literally a "too large window" on an envelope...