IN THE UNITED STATES DISTRICT COURT FOR THE EASTERN DISTRICT OF AETNA INC., Civil Action N0.: Plaintiff, V. KURTZMAN CARSON CONSULTANTS, LLC, JURY TRIAL DEMANDED Defendant. COMPLAINT Plaintiff Aetna Inc. (?Plaintiff? or ?Aetna?), for its Complaint against Defendant Kurtzman Carson Consultants, LLC (?Defendant? or alleges the following: INTRODUCTION 1. By this action (?Action?), Aetna seeks indemnity, contribution, reimbursement and damages from KCC for acts, errors, omissions and gross negligence relating to the handling of Aetna members? protected health information and the mailing of a notice to approximately 12,000 Aetna members in window envelopes which, under certain circumstances, potentially disclosed protected health information of the recipient to unauthorized third parties (as further de?ned below, the ??lncident?). Aetna has incurred, and continues to incur, liability, damages, payments, penalties, claims, losses and expenses as a result of actions. Aetna also seeks an order from the Court declaring that KCC is obligated to defend, indemnify, and hold Aetna harmless from and against any and all liability, damages, payments, penalties, claims, losses, and costs and expenses, including attorneys? fees, paid or incurred, or to be paid or incurred, by Aetna relating in any way to the Incident. Further, Aetna seeks injunctive relief and/or replevin requiring KCC to return property belonging to Aetna, in the form of data and information provided to KCC by attorneys for Aetna, which identi?es certain health plan members who were to receive mailings in connection their health plan bene?ts administered by Aetna and af?liates, and to delete and destroy any copies of such property. 2. This Action is related to and arises from matters at issue in the putative class action ?led in the United States District Court for the Eastern District of styled Beckett, et al. v. Aetna Inc, ez? al., No. 2:17-cv-03864-J S, which is presently before the Honorable Juan R. Sanchez (the ?Beckett Action? or ?Lead Action?). The obligations, payments and costs and expenses for which Aetna seeks indemnity, contribution and other relief include the payments required to be made and the costs and expenses incurred by Aetna in connection with settlement and the defense of the Beckett Action. 3. The putative class members identi?ed in the Beckett Action include nearly 700 individuals who are believed to reside in These nearly 700 residents are persons to whom KCC directed the mailing of the notices in connection with the incident that forms the basis of the Beckett Action. PARTIES 4. Plaintiff Aetna is a corporation with its principal place of business in Connecticut. 5. Plaintiff is informed and believes, and thereon alleges, that Defendant KCC is a Delaware limited liability company, with its principal place of business in California. 6. Plaintiff is informed and believes, and thereon alleges, that the member or members of KCC are not citizens of the same state as Aetna. 7. Defendant?s conduct described herein was undertaken or authorized by Defendant?s of?cers or agents who were responsible for the actions taken herein. Defendant had advanced knowledge of the actions and conduct of said of?cers and agents, and their actions and conduct was rati?ed, authorized and approved by Defendant, either directly or through its of?cers of agents. JURISDICTION AND VENUE 8. This Action is between citizens of different states, and the amount in controversy exceeds the sum or value of $75,000.00, exclusive of all costs. Therefore, this Court has jurisdiction pursuant to 28 U.S.C. 1332(a) (1) (diversity jurisdiction). 9. Venue in this district is proper pursuant to 28 U.S.C. ?1391(a)(2). A substantial part of events or omissions giving rise to the claims occurred in this District. Further, Defendant regularly conducts business in this District. Also, and as stated above, this Action is related to and arises from matters at issue in the Beckett Action ?led and pending in this Court. The putative class members identi?ed in the Beckett Action include individuals who are believed to reside in including in this District, and to whom KCC directed the mailing of notices in connection with the incident that forms the basis of the Beckett Action. GENERAL ALLEGATIONS 10. Aetna is one of the nation?s leading diversi?ed health care bene?ts companies, serving an estimated 37.9 million people with information and resources to help them make better informed decisions about their health care. Aetna offers a broad range of traditional, voluntary and consumer-directed health insurance products and related services, including medical, pharmacy, dental, behavioral health, group life and disability plans, medical management capabilities, and other products and services. Its customers include employer groups, individuals, college students, part-time and hourly workers, health plans, health care providers, governmental units, government-sponsored plans, labor groups, and expatriates. 11. In 2014 and 2015 respectively, two putative class action cases were ?led against Aetna and certain of its subsidiaries and af?liates in federal courts in California and Florida, Doe et al. v. Aetna Inc. et al., No. (S.D. Cal., Dec. 19, 2014), and Doe v. Coventry Health Care, Inc. et al., No. (S.D. Fla. Dec. 22, 2015) (the ?Doe lawsuits?). The Doe lawsuits were ultimately settled. 12. Under the settlement agreement in the Doe lawsuits, the parties agreed that a written notice would be provided to certain putative class members (the ?Members?) advising those Members of their options when ?lling prescriptions for HIV medications (the ?Notice?). In addition to the Notice, the parties agreed that a separate written notice would also be sent to certain putative class members regarding their right to ?le a claim for refunds of certain out-of- pocket costs under the settlement agreement (the ?Settlement Notice?). 13. KCC operates as a class action settlement administrator, and claims to have experience administering over 6,500 settlements. On its website, KCC also claims, among other things, that: it has been recognized as a ?best claims administrator? by The Recorder, The New York Law Journal, and The National Law Journal; (ii) it mails ?millions of documents annually?; it ?has the largest infrastructure in the class action industry, and is backed by superior data security, call center support and technology?; and (iv) its ?proprietary technology and data?handling processes set the industry standard for security, cost ef?ciency and quality.?1 14. The parties in the Doe lawsuits and their counsel agreed to use KCC as the settlement administrator. work included the mailing of the Settlement Notice, the 1 See 4 processing of claims that were submitted as part of the settlement of the Doe lawsuits, and the mailing of the Notice. 15. In a proposal submitted to counsel in the Doe lawsuits, KCC represented that it would use a #10 envelope to mail the Notice and a #10 window envelope to mail the Settlement Notice. 16. Upon information and belief, KCC knew, or should have known, that they were handling con?dential protected health information, including con?dential HIV-related information. Speci?cally, upon information and belief, KCC knew, or should have known, that the words Medications? were referenced in the Notice immediately below the recipient?s name and address. 17. On July 28, 2017, KCC mailed the Notice to Members using envelopes with see- through address windows. KCC mailed the Notice to thousands of Members across the country, including to nearly 700 Members residing in 18. Upon information and belief, among other things, KCC did not advise Aetna or its counsel in the Doe lawsuits at any time that it intended to use, or in fact would be using, a window envelope to mail the Notice, (ii) show the ?nal version of the Notice, within the envelope, to Aetna or its counsel in the Doe lawsuits before mailing the letters, and perform any testing or quality assurance to ensure that protected health information could not be seen through the window envelope. 19. In early August 2017, Aetna began receiving calls and emails from Members who had received the Notice, claiming the words Medications? could be viewed, in whole or in part, through the envelope?s window below the Member?s name and address. 20. On August 28, 2017, Plaintiff Andrew Beckett ?led the Lead Action. Among other things, the class action complaint alleged that the Notice, as prepared and mailed by KCC, was positioned in their envelopes in such a manner that allowed the words Medications,? in whole or in part, to be viewed through the envelope?s window below the Member?s name and address. The class action complaint further alleged that this allowed unauthorized persons to View con?dential HIV-related information of Plaintiff Beckett and the putative class members, causing substantial damage and harm to them. The privacy incident, as alleged in the Lead Action, is referred to herein as the ?Incident.? 21. On September 29, 2017, Aetna initiated a program to address the possible risks of potential immediate harm caused by the Incident to potentially affected Members and their families. The relief provided under this immediate relief program included counseling and emergency ?nancial assistance. 22. In addition to the Becket Action, six other class action lawsuits were ?led against Aetna or Aetna-related entities in various state and federal courts across the country, complaining of the Incident. RH. v. Aetna, Inc, Case No. 2:17-cv-04566 (E.D. Doe v. Aetna, Inc, et a1., Case No. (N .D. Cal); Doe v. Aetna, Inc, Case No. 3:17- (S.D. Cal); Doe v. Aetna, Inc., Case No. (D. Conn); SA. v. Aetna, Inc, et. a1., Case No. BC674088 (Cal. Sup.); Doe v. Aetna, Inc, Case No. (W.D. 23. All of the aforementioned class action lawsuits, with the exception of Doe v. Aetna, Inc., Case No. 4:17-cv-00929 (W.D. have joined and/or been consolidated with the Beckett Action in the Eastern District of (together, the ?Consolidated Action?). 24. On January 17, 2018, Plaintiffs in the Consolidated Action ?led a Motion for Preliminary Approval of Class Action Settlement. As part of the class action settlement, Aetna agreed to resolve all claims for a total sum of $17,162,000, while at the same time preserving all rights to pursue all claims against non-parties to the settlement, including claims against KCC for contribution, indemnity, reimbursement and damages. 25. Three individual actions have also been ?led against Aetna, also complaining of harm and damages allegedly caused by the Incident. D.L., v. Aetna, Inc, et al, Case No. 2: l7-cv- 8478-JFW-MRW (CD. Cal); Smith v. Aetna, Inc, Case No. Doe v. Aetna, Inc, et a1., Case No. C17-02082 (Cal. Sup). 26. In total, to date, ten lawsuits have been ?led against Aetna or Aetna-related entities alleging harm and damages purportedly caused by the Incident (together, the ?Underlying Actions?). 27. In addition to the Underlying Actions, several state attorneys general, as well as the United States Department of Health and Human Services, have opened up investigations into the Incident (the ?Investigations?). The Investigations have and potentially could lead to civil penalties against Aetna as a result of the Incident. 28. Aetna has incurred, and continues to incur, substantial costs and expenses as a result of the Incident, including attorneys? fees and expenses associated with defending itself in the Underlying Lawsuits and Investigations. 29. On October 11, 2017, October 23, 2017, and January 19, 2018, Aetna sent letters to KCC demanding that KCC defend, indemnify, and/or hold Aetna harmless from and against any liability, damages, payments, penalties, claims, losses, and costs and expenses, including attorneys? fees, relating to the Incident, the Underlying Actions, and the Investigations. 30. KCC has refused, and continues to refuse, to do so. 31. On several occasions, beginning in August 2017, Aetna has requested that KCC return, delete and destroy the data that Aetna?s counsel had provided to KCC and other information containing the names and information of certain health plan members who were to receive the above-referenced mailings in connection the Doe lawsuits (the ?Con?dential Data and Information?). 32. KCC has refused, and continues to refuse, to return, delete and destroy the Con?dential Data and Information. 33. On several occasions, Aetna has requested information and materials from KCC regarding, among other things, its policies and procedures related to the mailing incident and any information, instructions, communications or data regarding the mailing including interactions with counsel for Plaintiffs in the underlying matters. To date, KCC has refused to provide any such information or materials. COUNT ONE (Implied Indemnity) 34. Aetna re-alleges all of the foregoing paragraphs of this Complaint as if fully set forth herein. 35. Aetna disputes that it is in any way at fault for the Incident. The acts, errors, omissions and gross negligence of KCC are the direct and proximate causes of the Incident. 36. As a direct and proximate result of the acts, errors, omissions and gross negligence of KCC, Aetna has incurred, and will continue to incur, attorneys? fees and court, investigative, and other costs in connection with defending the Underlying Actions, the exact amount of which is unknown at this time. In addition, Aetna has entered into a settlement (the ?Settlement?) of the Consolidated Actions, which is awaiting approval of the Court in the Lead Action. Upon approval of the Settlement, Aetna will be obligated to pay to the settlement class a sum of $17,162,000, and to make additional expenditures, as set forth in the Settlement. 37. As a direct and proximate result of the acts, errors, omissions and gross negligence of KCC, Aetna has incurred, and will continue to incur, attorneys? fees and investigative and other costs in connection with the Investigations, the exact amount of which is unknown at this time. In addition, Aetna has paid, and potentially could be required to pay, civil penalties and ?nes as a result of the Incident, the exact amount of which is unknown at this time. 38. As a direct and proximate result of the acts, errors, omissions and gross negligence of KCC, Aetna has also paid Member monies in connection with the immediate relief program. 39. Aetna denies all liability in connection With the Incident, the Underlying Actions and the Investigations. However, if and to the extent Aetna is held liable or is responsible in connection with the Incident or in any of the Underlying Actions or Investigations, said liability or responsibility will be vicarious only and will be the direct and proximate result of the acts, errors, omissions and gross negligence of KCC. 40. As the settlement administrator in the Doe lawsuits, KCC has and had a duty to protect and defend Aetna from any and all liability, damages, payments, claims, penalties, losses, expenses, costs, and attorneys? fees arising from or in connection with the Incident, the Underlying Actions and the Investigations, and is further obligated to indemnify Aetna for such liability, damages, payments, claims, penalties, losses, costs, expenses, and attorneys? fees incurred (or to be incurred) by Aetna. 41. As set forth above, KCC has failed and refused, and continues to fail and refuse, to defend or indemnify Aetna. As a direct and proximate result thereof, Aetna has been damaged, in an amount not less than $20 million, for, among other things, amounts paid or incurred, or to be paid or incurred, by Aetna pursuant to the Settlement, or in connection with the Incident, the Underlying Actions or the Investigations, and for costs and attorneys? fees. COUNT TWO (Equitable Indemnity) 42. Aetna re?alleges all of the foregoing paragraphs of this Complaint as if fully set forth herein. 43. As the party responsible for the Incident, KCC has an equitable duty to defend Aetna from any and all liability, damages, payments, penalties, claims, losses, expenses, costs and attorneys? fees arising from or in connection with the Incident, the Underlying Actions and the Investigations, and is further obligated to indemnify Aetna for such liability, damages, payments, penalties, claims, losses, expenses, costs, and attorneys? fees incurred and to be incurred by Aetna. 44. Aetna has demanded that KCC defend and indemnify Aetna as set forth above, but KCC has failed and refused, and continues to fail and refuse, to do so. COUNT THREE (Contribution Pursuant to Pa. Cons. Stat. 8324) 45. Aetna re-alleges all of the foregoing paragraphs of this Complaint as if set forth herein. 46. As a result of the acts, errors, omissions and gross negligence of KCC, to date, claims in excess of $20 million have been made against Aetna in the Underlying Actions. 47. In addition, Aetna faces possible civil penalties, in an amount unknown at this time, as a result of the Investigations. 48. Aetna is entitled to contribution from KCC for its proportionate share of all 10 liability, damages, payments, penalties, claims, losses, expenses, fees and costs, including attorneys? fees and expenses, incurred by Aetna as a result of the Incident, the Underlying Actions and the Investigations. COUNT FOUR (Declaratory Relief) 49. Aetna re-alleges all of the foregoing paragraphs of this Complaint as if fully set forth herein. 50. An actual controversy has arisen and now exists between Aetna and KCC, in that Aetna alleges, and KCC denies, that KCC is obligated to defend, indemnify, and hold Aetna harmless as set forth above. 51. An actual controversy has also arisen and now exists between Aetna and KCC, in that Aetna alleges, and KCC denies, that KCC is responsible for the Incident. 52. As a result of such controversy, it is necessary and appropriate at this time for the Court to declare and determine Aetna?s right to be indemni?ed and/or to receive contribution and reimbursement from KCC for any liability, damages, penalties, claims, losses, expenses, costs, and attorneys? fees paid or incurred, or to be paid or incurred, by Aetna in connection with the Incident, the Underlying Actions and the Investigations. 53. It is also necessary and appropriate for the Court to declare and determine Aetna?s right to be indemni?ed and/or to receive contribution and reimbursement from KCC from and against any losses incurred in connection with future actions arising out of the Incident. In addition, it is necessary and appropriate for the Court to declare and determine the proportion of fault assigned to KCC for the Incident. 54. Aetna has no adequate remedy otherwise at law. 11 COUNT FIVE (Negligence) 55. Aetna re-alleges all of the foregoing paragraphs of this Complaint as if fully set forth herein. 56. As the third-party settlement administrator in the Doe lawsuits, KCC owed a duty to Aetna, plaintiffs in the Doe lawsuits, and the Members to exercise reasonable care in handling of the Members? protected health information. 57. KCC breached its duty to exercise reasonable care when it negligently and/or recklessly mailed the Notice using window envelopes, and in a manner which caused the Incident. 58. As a direct and proximate result of acts, errors, omissions and gross negligence, Aetna has incurred substantial damages, including damages in defending against the Underlying Actions and Investigations. COUNT SIX (Replevin and/or Injunctive Relief) 59. Aetna re-alleges all of the foregoing paragraphs of this Complaint as if fully set forth herein. 60. In connection with the Doe lawsuits, KCC is in possession of Con?dential Data and Information. 61. Aetna has requested KCC to return, delete and destroy all Con?dential Data and Information. 62. Aetna owns and/or has paramount proprietary interests in the Con?dential Data and Information. 12 63. Aetna has the exclusive right of immediate possession of the Con?dential Data and Information. 64. KCC does not have any claim of ownership or possession to the Con?dential Data and Information. 65. Aetna did not, and has not, consented to allow KCC to retain possession of the Con?dential Data and Information. 66. There is no contractual, legal, or equitable justi?cation which permits KCC to continue to retain the Con?dential Data and Information. 67. KCC unlawfully and without approval of Aetna has retained the Con?dential Data and Information, and must be ordered to immediately return and deliver it to Aetna and delete and destroy it at own expense. WHEREFORE, Aetna prays for judgment against KCC and hereby requests as follows: 1. Damages in an amount to be determined at trial, not less than $20 million; 2. Declaratory relief declaring that Aetna is entitled to be defended, indemni?ed and held harmless by KCC from all liability, damages, payments losses, costs, judgments, expenses, and attorneys? fees in connection with the Incident and the defense of the Underlying Actions and Investigations or future actions, investigations or proceedings arising from or relating to the Incident; 3. Injunctive relief and judgment in replevin determining that the Con?dential Data and Information is the property of Aetna, and that KCC has no right to ownership or possession of same; ordering KCC to immediately return the Con?dential Data and Information to Aetna or its designated agent at own expense and deliver it into the control 13 and possession of Aetna or its designated agent; ordering KCC to otherwise delete and destroy, and to certify to the Court that it has done so by sworn af?davit, all copies of the Con?dential Data and Information; and such other related inj unctive and declaratory relief to facilitate enforcement of the foregoing obligations of KCC with respect to the Con?dential Data and Information. 4. Other declaratory relief as appropriate; 5. An award of the cost of suit and reasonable attorney?s fees; 6. Such other and further relief as the Court may deem just and proper; and Aetna hereby demands a trial by jury on all issues and matters so triable. . Dated: February 5, 2018 a . sitiFr?mI'?r? P. FREDERICK P. SANTARELLI LYNNE N. KOLODINSKY ELLIOTT GREENLEAF, RC. 925 Harvest Drive, Suite 300 Blue Bell, PA 19422 lnk@e11iottgreenleaf.corn (215) 977-1024 MATTHEW P. KANNY (pro hac vice forthcoming) DONNA L. WILSON (pro hac vice forthcoming) MANATT, PHELPS PHILLIPS, LLP 11355 W. Olympic Blvd. Los Angeles, CA 90064 mkanny@manatt.com dlwilson@manatt.com (310) 312-4225 Counsel for Aetna Inc. 14