Thousands of HIV patients whose names and conditions were visible through glassine envelopes sent through the mail will share $17 million that Aetna Insurance Co. has agreed to pay in settlement of claims that the insurer failed to protect the individuals’ privacy.

The settlement, upon judicial approval, would resolve a nationwide class action breach of privacy lawsuit filed in federal court in Philadelphia in August over, ironically, notices mailed as part of a settlement of a previous class action claiming the health insurer’s mail order requirement for medications violated HIV patients’ privacy. 

Related: Biggest threats to health care security are employees’ ignorance, lack of awareness

The lawsuit was brought on behalf of current and former Aetna customers taking medication to treat HIV or PrEP, a pre-exposure prophylactic medication. The lead plaintiff is a man using a pseudonym who, according to court papers, feared “severe harm” would befall him should his true identity be revealed.

According to the proposed settlement agreement, Hartford, Connecticut-based Aetna would pay $17,161,200 to the plaintiffs—a base payment of at least $500 to each of the nearly 12,000 patients who were sent the glassine window envelopes, through which instructions for filling HIV medications were clearly visible. This settlement amount will also be used to pay $75 each to customers whose private health information Aetna improperly disclosed to its lawyers and mail vendor.

The settlement also allows patients who were sent the allegedly invasive notices and who can demonstrate financial or nonfinancial harm to submit claims for additional monetary awards.

In the lead plaintiff’s case, one of his family members found the mailing and believed he was living with HIV and had not confided in his family. He was then forced to admit his condition to his family, according to the complaint.

“HIV still has a negative stigma associated with it, and I am pleased that this encouraging agreement with Aetna shows that HIV-related information warrants special care,” the lead plaintiff said in a statement released by the AIDS Law Project of Pennsylvania. The nonprofit public interest law firm that works to protect the legal rights of people living with HIV in Pennsylvania and South New Jersey teamed up with Philadelphia-based class action firm Berger & Montague and the Legal Action Center on the suit.

In an emailed statement, Aetna said the company is implementing measures to ensure that an incident like this does not happen again.

“Through our outreach efforts, immediate relief program and this settlement we have worked to address the potential impact to members following this unfortunate incident,” according to the statement.

Frederick Santarelli of Elliott Greenleaf in Blue Bell, Pennsylvania, and Matthew Kanny and Donna Wilson, partners in the Los Angeles office of Manatt, Phelps & Phillips, represented Aetna in the settlement.

The incident giving rise to the agreement is believed to be the world’s largest data breach involving HIV privacy, according to Ronda Goldfein, executive director of the AIDS Law Project.

“The fear of losing control of HIV-related information and the resulting risk of discrimination are barriers to health care,” Goldfein said in a statement. “This settlement reinforces the importance of keeping such information private, and we hope it reassures people living with HIV, or those on PrEP, that they do not have to choose between privacy and health care.”