Some non-zero percent of those 12k people live with a partner who doesn't know their HIV status. It is (edit: could be, if untreated) totally unethical for those people to fail to disclose their status to their partners, but arguably it's much worse for those people to be outed by their health insurance company, who should really be the (#@[expletive](/#@ experts in privacy here.
I'm really not sure it's OK that this letter went out at all, even if they had used the right privacy envelopes!