1

UNITED STATES DISTRICT COURT FOR THE

SOUTHERN DISTRICT OF OHIO

EASTERN DIVISION

JOHN DOE ONE; JOHN DOE TWO;

JOHN DOE THREE; and JOHN DOE 

FOUR,

on behalf of themselves and all similarly 

situated individuals,

Plaintiffs,

v.

CAREMARK, L.L.C.;

FISERV, INC.,

FISERV SOLUTIONS, LLC; and 

DEFENDANTS DOES 1–10,

Defendants.

No. 2:18-cv-00238-EAS-CMV

No. 2:18-cv-00488-EAS-CMV

(Consolidated for all purposes)

Chief Judge Edmund A. Sargus, Jr.

Magistrate Judge Chelsey M. Vascura

DEMAND FOR JURY TRIAL

FISERV’S ANSWER TO CONSOLIDATED AMENDED CLASS ACTION COMPLAINT

Defendants Fiserv, Inc. and Fiserv Solutions, LLC (collectively, “Fiserv”), answer 

Plaintiffs’ Consolidated Amended Class Action Complaint (“Consolidated Amended Complaint”) 

as follows.

INTRODUCTION

1. Medical privacy is among the most important tenets of American healthcare.

Patients must be able to trust their physicians, insurers, and pharmacies to protect their medical

information from the improper disclosure (including, but not limited to, their health conditions and 

courses of treatment). Indeed, numerous state and federal laws explicitly require this. And, these 

laws are especially important when protecting individuals with particular medical conditions such 

as HIV or AIDS that can and do subject them to regular discrimination.

ANSWER: Fiserv admits that the allegations in Paragraph 1 purport to draw 

generalizations regarding medical privacy, American health care, and individuals receiving 

treatment for medical conditions, including the extent to which persons with HIV or AIDS may be 

subject to discrimination based on their HIV or AIDS status. Fiserv denies that the allegations in 

Case: 2:18-cv-00238-EAS-CMV Doc #: 79 Filed: 03/29/19 Page: 1 of 32 PAGEID #: 607
2

Paragraph 1 evidence that any of the Plaintiffs or any of the purported class members have suffered 

the injury alleged, and demands strict proof of any alleged injury(ies) or damages. The remaining 

allegations in the final two sentences of Paragraph 1 state legal conclusions to which no response 

is required. Fiserv denies any remaining allegations in Paragraph 1.

2. The Plaintiffs,1 who are living with HIV, bring this action based on the above-listed 

Defendants’ (“Defendants”) unauthorized disclosures of theirs and over 6,000 persons’ HIV status 

and their participation in the OhDAP Program. Except where specifically noted as being based on 

personal knowledge, the allegations herein are based on information and belief formed after an 

inquiry, reasonable under the circumstances, which allegations are likely to have evidentiary 

support after a reasonable opportunity for further investigation and discovery. Accordingly, 

Plaintiffs bring suit as a putative class action for damages, injunctive, and declaratory relief.

ANSWER: Fiserv admits that Plaintiffs have been granted leave to use fictitious names 

and that they purport to bring this action based on the alleged “unauthorized disclosures of theirs

and over 6,000 persons’ HIV status and their participation in the OhDAP Program,” but denies 

that an “unauthorized disclosure[] of [Plaintiffs’] and over 6,000 persons’ HIV status and their 

participation in the OhDAP Program” occurred or that Plaintiffs are otherwise entitled to the relief 

they seek. Fiserv lacks knowledge or information sufficient to form a belief as to the truth of 

Plaintiffs’ allegations that they are “living with HIV.” Fiserv also lacks knowledge or information 

sufficient to form a belief as to the truth of any allegations in the second sentence in Paragraph 2. 

Fiserv admits that Plaintiffs seek the relief asserted in Paragraph 2 but denies that Plaintiffs are 

entitled to such relief. Fiserv denies any remaining allegations in Paragraph 2.

PARTIES

3. On personal knowledge, Plaintiff John Doe One is an individual residing in 

Delaware County, Ohio. He is a client of the Ohio HIV Drug Assistance Program (“OhDAP”). In 

or about August 2017, he received the mailing at issue herein disclosing his HIV status and 

suffered injury in fact as a result thereof.

 1 Plaintiffs John Doe One, John Doe Two, and John Doe Three have been granted leave to proceed 

under fictitious names. Doc. No. 26. Plaintiff John Doe Four was granted leave to proceed under 

a fictitious name in Civil Case No. 2:18-cv-488, now consolidated with this matter. Doc. No. 16.

Case: 2:18-cv-00238-EAS-CMV Doc #: 79 Filed: 03/29/19 Page: 2 of 32 PAGEID #: 608
3

ANSWER: Fiserv denies that the mailing at issue disclosed Plaintiff John Doe One’s 

alleged HIV status to any unauthorized party, particularly based on Plaintiffs’ continuing failure 

or refusal to identify a single unauthorized person to whom their alleged HIV status was actually 

disclosed, and accordingly further denies that Plaintiff John Doe One suffered any injury in fact as 

a result thereof. Fiserv lacks knowledge or information sufficient to form a belief as to the truth 

of the remaining allegations in Paragraph 3.

4. On personal knowledge, Plaintiff John Doe Two is an individual residing in 

Defiance County, Ohio. He is a client of OhDAP. In or about August 2017, he received the mailing 

at issue herein disclosing his HIV status and suffered injury in fact as a result thereof.

ANSWER: Fiserv denies that the mailing at issue disclosed Plaintiff John Doe Two’s 

alleged HIV status to any unauthorized party, particularly based on Plaintiffs’ continuing failure 

or refusal to identify a single unauthorized person to whom their alleged HIV status was actually 

disclosed, and accordingly further denies that Plaintiff John Doe Two suffered any injury in fact 

as a result thereof. Fiserv lacks knowledge or information sufficient to form a belief as to the truth 

of the remaining allegations in Paragraph 4.

5. On personal knowledge, Plaintiff John Doe Three is an individual residing in Gallia 

County, Ohio. He is a client of OhDAP. In or about August 2017, he received the mailing at issue 

herein disclosing his HIV status and suffered injury in fact as a result thereof.

ANSWER: Fiserv denies that the mailing at issue disclosed Plaintiff John Doe Three’s 

alleged HIV status to any unauthorized party, particularly based on Plaintiffs’ continuing failure 

or refusal to identify a single unauthorized person to whom their alleged HIV status was actually 

disclosed, and accordingly further denies that Plaintiff John Doe Three suffered any injury in fact 

as a result thereof. Fiserv lacks knowledge or information sufficient to form a belief as to the truth 

of the remaining allegations in Paragraph 5.

6. On personal knowledge, Plaintiff John Doe Four is an individual residing in 

Montgomery County, Ohio. He is a client of OhDAP. In or about July or August 2017, he received 

the mailing at issue herein disclosing his HIV status and suffered injury in fact as a result thereof.

Case: 2:18-cv-00238-EAS-CMV Doc #: 79 Filed: 03/29/19 Page: 3 of 32 PAGEID #: 609
4

ANSWER: Fiserv denies that the mailing at issue disclosed Plaintiff John Doe Four’s 

alleged HIV status to any unauthorized party, particularly based on Plaintiffs’ continuing failure 

or refusal to identify a single unauthorized person to whom their alleged HIV status was actually 

disclosed, and accordingly further denies that Plaintiff John Doe Four suffered any injury in fact 

as a result thereof. Fiserv lacks knowledge or information sufficient to form a belief as to the truth 

of the remaining allegations in Paragraph 6.

7. Defendant Caremark, L.L.C. (“CVS”) is a foreign limited liability company with 

its principal place of business in either Rhode Island or Illinois. CVS entered into an agreement in 

or about March 2017, effective July 2017, with the State of Ohio in response to a February 2017 

request for proposal to operate as the pharmacy benefits manager for the State’s Ryan White 

Program, which agreement resulted in CVS being responsible for the mailings and illegal 

disclosures at issue herein. As part of that Request For Proposal for services, CVS advertised, 

marketed, promoted, offered for sale and sold its services to the State of Ohio, which were provided 

in a manner that adversely impacted Plaintiffs and Class members.2

ANSWER: Fiserv admits that Defendant Caremark, L.L.C. is a foreign limited liability 

company, but lacks knowledge or information sufficient to form a belief as to Caremark L.L.C.’s 

principal place of business. Fiserv also lacks knowledge or information sufficient to form a belief 

as to the truth of Plaintiffs’ allegations concerning any agreement between CVS and the State of 

Ohio and the terms thereof and any Request For Proposal from the State of Ohio or response 

thereto submitted by CVS and the content thereof. Fiserv admits the allegations in footnote 2. 

Fiserv denies any remaining allegations in Paragraph 7.

8. Defendant Fiserv, Inc. is a foreign corporation with its principal place of business 

in Wisconsin. On its own or through its subsidiary Fiserv Solutions, LLC, it was contracted by 

CVS in connection with CVS obtaining the contract with the Ohio Department of Health (“ODH”) 

to mail information to Plaintiffs and thousands of individuals throughout Ohio, including the 

mailings and illegal disclosures at issue herein. In doing so, Fiserv, either directly or through its 

subsidiary, agreed that it was obligated to comply with various CVS agreements, protocols, 

 2 CVS Health Corporation, and Caremark Rx, L.L.C., were named as defendants in the original 

complaint in this action, and were previously dismissed without prejudice pursuant to Federal Rule 

of Civil Procedure 15(a).

Case: 2:18-cv-00238-EAS-CMV Doc #: 79 Filed: 03/29/19 Page: 4 of 32 PAGEID #: 610
5

practices and orders, several of which are cited herein, to protect the confidentiality and prevent 

the disclosure of the personal health information at issue herein.

ANSWER: Fiserv admits that Fiserv, Inc. is a Wisconsin corporation with its principal 

place of business in Wisconsin. Fiserv admits that one of Fiserv, Inc.’s wholly owned subsidiaries, 

Fiserv Solutions, Inc., entered into a Master Service Agreement effective as of March 29, 2013, 

and later amended, with CVS Pharmacy, Inc., on its own behalf and on behalf of its subsidiaries 

and affiliates including, without limitation, Caremark Rx, L.L.C. (collectively, “CVS”) (the 

“Master Service Agreement”). Fiserv further admits that, on March 31, 2015, Fiserv Solutions, 

Inc., was converted to a limited liability company under Wisconsin law to become Fiserv 

Solutions, LLC, a Wisconsin limited liability company. Fiserv admits that the Master Service

Agreement sets out the terms of the contractual relationship between Fiserv Solutions, LLC, and 

CVS with respect to, inter alia, the mailings placed at issue by the Consolidated Amended 

Complaint. Fiserv denies the remaining allegations in Paragraph 8 and refers to the Master Service

Agreement for the complete terms thereof.

9. Defendant Fiserv Solutions, LLC is a foreign Limited Liability Company with its 

principal place of business in Wisconsin. Fiserv Solutions, LLC is a wholly-owned subsidiary of 

Fiserv, Inc. Fiserv Solutions, LLC, on its own or through Fiserv Inc., was contracted by CVS to 

mail information to Plaintiffs and thousands of individuals throughout Ohio, including the mailings 

and illegal disclosures at issue herein, and appears to be the entity that disseminated the mailing at 

issue herein. Fiserv, Inc. and Fiserv Solutions, LLC will be collectively referred to as “Fiserv” in 

this Complaint. Fiserv did not have authorization from Plaintiffs to access, be provided access to 

or disclose the personal health information at issue herein.

ANSWER: Fiserv admits that Fiserv Solutions, LLC is a Wisconsin limited liability 

company with its principal place of business in Wisconsin. Fiserv admits that Fiserv, Inc. is the 

parent of Fiserv Solutions, LLC. Fiserv admits that Plaintiffs collectively refer to Fiserv, Inc. and 

Fiserv Solutions, LLC as “Fiserv” in the Consolidated Amended Complaint. Fiserv denies the 

allegations of the third sentence in Paragraph 9 and denies the remaining allegations in Paragraph 9 

and refers to the Master Service Agreement for the complete terms thereof.

Case: 2:18-cv-00238-EAS-CMV Doc #: 79 Filed: 03/29/19 Page: 5 of 32 PAGEID #: 611
6

10. Defendant Does 1–10 are entities whose identities are not currently known or 

verified. As the true names, roles and capacities of Defendants named as Does 1–10 are currently 

unknown to Plaintiffs; they are therefore named as Defendants under fictitious names. Plaintiffs 

will identify their true identities and their involvement in the wrongdoing at issue if and when they 

become known. All Defendants’ conduct described herein, including that of Does 1–10, was 

undertaken or authorized by Defendants’ officers or managing agents who were responsible for 

the supervision and operation decisions relating to the wrongdoing here at issue. The described 

conduct of said managing agents and individuals was therefore undertaken on behalf of 

Defendants. Defendants had advance knowledge of the actions and conduct of said individuals 

whose actions and conduct were ratified, authorized, and approved by such managing agents. By

engaging in the conduct described herein, Defendants agreed with each other, the Doe Defendants 

and/or other third-parties to engage in the illegal conduct at issue herein. As set forth below, 

Defendants unjustly profited as a result of these agreements in violation of the laws and regulations 

detailed herein. As a result of such agreements, the Defendants named and to be named herein 

conspired and aided and abetted each other in violating the laws set forth herein.

ANSWER: Fiserv admits that Plaintiffs purport to name as defendants “Does 1-10” but 

denies the remaining allegations in Paragraph 10.

JURISDICTION AND VENUE

11. This Court has original jurisdiction over this action under 28 U.S.C. § 1332(d) 

because the amount in controversy exceeds the sum of $5,000,000, exclusive of interest and costs, 

and is a class action in which at least one member of the Class (as defined below) is a citizen of a 

State (Ohio) different from Defendants CVS (Rhode Island or Illinois) and Fiserv (Wisconsin). As 

set forth below, the Defendants illegally disclosed the HIV status of approximately 6,000 people 

without authorization. Ohio courts have awarded at least $6,000 in damages for individuals whose 

HIV status has been disclosed without authorization. The potential for a similar award in this Court 

shows that the amount in controversy is in excess of $5,000,000.

ANSWER: Fiserv admits that this Court has subject matter jurisdiction over this action 

under 28 U.S.C. § 1332(d), as the amount purportedly in controversy exceeds the sum or value of 

$5,000,000, exclusive of interests and costs, and as this action is a putative class action in which 

at least one member of the putative class of plaintiffs is alleged to be a citizen of a state different 

from that of at least one defendant. Fiserv denies that Plaintiffs are entitled to the relief asserted 

and further denies that Plaintiffs are entitled to pursue a class action. Fiserv lacks knowledge or 

information sufficient to form a belief as to the truth of the allegation about past awards by Ohio 

courts. Fiserv denies the remaining allegations in Paragraph 11.

Case: 2:18-cv-00238-EAS-CMV Doc #: 79 Filed: 03/29/19 Page: 6 of 32 PAGEID #: 612
7

12. Venue is appropriate in this District under 28 U.S.C. § 1391 because a substantial 

part of the events or omissions giving rise to the claim occurred in this District and at least one of 

the Plaintiffs resides in this District.

ANSWER: Fiserv lacks knowledge or information sufficient to form a belief as to the 

truth of the allegations in Paragraph 12.

FACTUAL ALLEGATIONS

13. OhDAP was initially established in 1990 under the Ryan White HIV/AIDS

Treatment Extension Act, 42 U.S.C. §§ 300ff, et seq. This federal legislation has been renewed 

four times – 1996, 2000, 2006 and 2009 – and is now called the Ryan White Program within Ohio 

and nationwide.

ANSWER: The allegations in Paragraph 13 purport to characterize federal and state 

statutes and regulations and state legal conclusions to which no response is required. To the extent 

a response is required, Fiserv refers to the text of the relevant federal and state statutes and 

regulations and denies any allegations inconsistent therewith. Fiserv denies any remaining 

allegations in Paragraph 13.

14. The OhDAP website states:

The Ohio Department of Health (ODH) administers the Ohio HIV Drug Assistance 

Program (OHDAP), providing medications to fight HIV and to treat HIV-related 

conditions. This program must be the payer of last resort. For eligible participants, 

HIV-related medications are provided free of charge. The medications are obtained 

through a specialty mail-order pharmacy to ensure confidentiality and to ensure all 

geographic areas of Ohio have equal access to this service. Verification of monthly 

income, updated enrollment applications and a physician’s report are required at 

the beginning of each enrollment period.

See http://ohiv.org/care/medication-payment-assistance/ (last accessed 1/29/2019)._

ANSWER: Fiserv admits that Paragraph 14 purports to quote the OhDAP website, but 

refers to the text of the OhDAP website for the complete content thereof and denies any allegations 

inconsistent therewith. Fiserv denies any remaining allegations in Paragraph 14.

15. There are three main components within OhDAP. One component is for direct drug 

provision for eligible uninsured individuals (i.e., individuals with HIV who are not eligible for 

Medicaid due to income level or citizenship status). Another component is used to provide

Case: 2:18-cv-00238-EAS-CMV Doc #: 79 Filed: 03/29/19 Page: 7 of 32 PAGEID #: 613
8

premium assistance to eligible individuals (i.e., ACA, Medicare Part D, private health insurance 

or the employee copayment or coinsurance portion of employer-based insurance). The last 

component assists insured individuals with their co-pays for their life-saving HIV-related 

medications.

ANSWER: The allegations in Paragraph 15 purport to characterize Ohio state statutes 

and regulations pertaining to OhDAP and state legal conclusions to which no response is required. 

To the extent a response is required, Fiserv refers to the text of the relevant Ohio state statutes and 

regulations pertaining to OhDAP and denies any allegations inconsistent therewith. Fiserv denies 

any remaining allegations in Paragraph 15.

16. To participate in OhDAP, an individual must submit an application and certify that 

he or she is HIV-positive, stating the year of the individual’s first positive HIV test. The applicant 

must also attach “medical verification documents,” which “are required to establish that an 

individual is HIV+ and, thus, eligible for our services.” Therefore, for purposes of OhDAP, an 

individual’s HIV-positive status necessarily means that the individual has had an HIV test 

performed on him or her, the result of that HIV test was positive, and provided Personal Health 

Information (“PHI”) to a third party reflecting those results.

ANSWER: The allegations in Paragraph 16 purport to characterize Ohio state statutes 

and regulations pertaining to applications submitted to OhDAP and state legal conclusions to 

which no response is required. To the extent a response is required, Fiserv refers to the text of the 

relevant Ohio state statutes and regulations pertaining to applications to OhDAP and denies any 

allegations inconsistent therewith. Fiserv denies any remaining allegations in Paragraph 16.

17. In February 2017, ODH issued a request for proposals for the purchase of pharmacy 

benefit management services for OhDAP. The first criterion for evaluating services to be provided 

under the contract was “Pharmacy Services,” the first of which was the development of a pharmacy 

distribution network. CVS, which submitted a proposal to promote, market and sell its services to 

ODH, proposed to create this network through its own retail and mail-order pharmacies, through 

which it has provided medications under contracts with OhDAP since 2000. In the cover letter for 

its bid, CVS stated, “All of the information contained in this proposal references the capabilities 

of, and services available from Caremark, L.L.C. (‘CVS Caremark’).” CVS also stated that it is a 

health care provider: after stating that it was using the terms “CVS Health” and “CVS Caremark” 

interchangeably, CVS stated, “As a Fortune 10 company, CVS Health is the largest pharmacy 

health care provider in the United States with integrated offerings cross the entire spectrum of 

pharmacy care.” In another part of its bid, CVS also stated, “We understand that offering open 

access to pharmacy services and honoring consumer preferences (retail, mail delivery, or personal 

Case: 2:18-cv-00238-EAS-CMV Doc #: 79 Filed: 03/29/19 Page: 8 of 32 PAGEID #: 614
9

consultation with a CVS pharmacist) sets us apart from other health care providers.”3 CVS also 

repeatedly described its delivery of healthcare services under the heading “Pharmacy Distribution 

Network.” For example, CVS stated, “Our therapy-specific CareTeam outreach, provided by 

expert specialty pharmacy clinicians with up-to-date knowledge of evidence-based protocols, 

helps improve member adherence by educating them on taking medications correctly, reviewing 

proper medication storage and handling, and troubleshooting medication side effects. ... 

Additionally, our national nursing model delivers specialty nursing services, education, and drug 

administration to our members who receive infusion and injection medications ....”

ANSWER: Fiserv lacks knowledge or information sufficient to form a belief as to the 

truth of the allegations in Paragraph 17, including the allegations in Footnote 3.

18. CVS’s bid, which was made in connection with the marketing, promotion, offering 

for sale and sale of such services, also represented that it understood state and federal laws 

concerning the privacy of personal information and thus the extent to which it maintains and 

protects the privacy, confidentiality and integrity of personal information collected from or about 

consumers: “We are in compliance with federal and state laws and regulations that are applicable 

to the services to be provided by CVS Health under the Contract.”

ANSWER: Fiserv lacks knowledge or information sufficient to form a belief as to the 

truth of the allegations in Paragraph 18.

19. In or about March 2017, ODH awarded an exclusive contract to CVS, effective July 

2017. Through this contract and others, CVS is responsible not only for managing OhDAP’s 

pharmacy benefits, but also providing medications to OhDAP participants.

ANSWER: Fiserv lacks knowledge or information sufficient to form a belief as to the 

truth of the allegations in Paragraph 19.

20. Beginning in approximately late July or early August 2017, Defendants mailed a 

letter containing membership cards and information marketing and promoting the CVS program 

and how persons would access their HIV-related prescriptions. The PHI provided by ODH was 

shared and/or this letter was mailed to an estimated 6,000 participants in OhDAP, regardless of 

whether they were active pharmacy customers of CVS. CVS thus marketed and promoted the use 

not only of CVS’s pharmacy benefit management services, but also of its health care delivery 

services. The letter advised OhDAP participants that they could obtain their HIV medications in 

 3 This was a false and misleading marketing statement, since with regard to the HIV medications 

in question here, CVS in fact does not “honor consumer preferences” and typically requires 

consumers to obtain such medications exclusively through mail delivery, directly from a CVS 

retail outlet, or through some other onerous delivery mechanism (“specialty pharmacy program”). 

CVS does so even if consumers prefer to seek personal consultation from a community pharmacist 

of their choice where they receive other medications, and/or if consumers do not want to obtain 

their medications under the specialty pharmacy program due to privacy and other concerns.

Case: 2:18-cv-00238-EAS-CMV Doc #: 79 Filed: 03/29/19 Page: 9 of 32 PAGEID #: 615
10

one of two ways, both provided exclusively by CVS-affiliated entities: from one of CVS’s 320 

retail pharmacies in Ohio (as well as 59 pharmacies located in Target stores), or through CVS’s 

specialty mail-order pharmacy. Such services were thus offered from CVS as a singular health 

care entity, since otherwise Caremark LLC would have been prohibited by law from sharing the 

PHI it possessed and was provided to it by the ODH with these other CVS entities.

ANSWER: Fiserv admits that in approximately late July and early August 2017, CVS 

instructed Fiserv Solutions, LLC to send certain mailings pursuant to the terms of the Master 

Service Agreement in respect of CVS Client #6402. Fiserv refers to the mailings at issue for the 

complete content thereof, and denies any allegations inconsistent therewith and any remaining 

allegations in Paragraph 20.

21. Even though the information contained in this letter contained the PHI of each 

individual, specifically information relating to their HIV status, the envelopes containing these

mailings had two clear glassine windows. One, in the upper left, contained the logo of 

“CVS/caremark,” the words “Ohio Department of Health,” and an address for ODH. A second 

window contained the recipient’s name and address, with the designation “PM 6402 HIV” directly 

above the person’s name. This reference to the recipient’s HIV status was plainly visible through 

the glassine window. The designation “HIV” in the program identification number was not 

required by ODH, but rather was created by CVS. The envelope referred in big red letters to “new 

prescription benefits,” thereby revealing that the mailing from CVS involved health-related 

information, including information about prescription medications. The envelope also stated that 

it was sent from St. Louis, Missouri, with Postal Permit No. 1977. Fiserv is the owner of this 

permit. Defendants clearly made no advance effort to test or review the disclosure of such 

information prior to disseminating the mailing, since had they done so they would have seen that 

the identification number with “HIV” next to it was prominently visible through the envelope and 

directly above the name and address of the individual recipient, as shown by the following:

Case: 2:18-cv-00238-EAS-CMV Doc #: 79 Filed: 03/29/19 Page: 10 of 32 PAGEID #: 616
11

ANSWER: Fiserv refers to the mailings at issue for the complete content thereof, denies 

any allegations inconsistent therewith, admits that Fiserv, Inc. is the owner of Postal Permit 

No. 1977, and denies any remaining allegations in Paragraph 21.

22. The Defendants’ combined use of a glassine windowed envelope, their design of 

the letter containing the HIV status of the individual recipient in an identification code that was

not required by law, and placing that code directly above the consumers’ name and address such 

that no matter what size glassine envelope that was used this PHI could be seen through the 

envelope window, instead of using a different code, an opaque envelope or a letter that was 

properly spaced not to publicly reveal such information through the envelope window and an 

identification reference with the term “HIV,” resulted in the actual disclosure of recipients’ HIV 

status to the United States Postal Service, which was not privileged to receive this information 

under Ohio law or federal law, and potential disclosure to numerous individuals, including their 

families, friends, roommates, landlords, neighbors, and complete strangers. A reasonable person 

seeing this envelope with the letter in it, or even seeing a mock-up of the letter with the code 

directly above the name, or creating the identification code in the first place, would conclude that 

the recipient was HIV-positive or seeking medical treatment for HIV or AIDS-related conditions.

That conclusion would be correct in every instance, as this mailing was sent only to HIV-positive 

individuals, apparently from or at the direction of ODH.

ANSWER: Fiserv refers to the mailings at issue for the complete content thereof, denies 

any allegations inconsistent therewith, and denies any remaining allegations in Paragraph 22.

23. The use of envelopes with transparent glassine windows contravenes the standard 

practice of ODH, which is to send all mailings relating to HIV-related issues in opaque, nonwindowed envelopes. Thus, Defendants must not have cleared the form of this mailing, or they 

did so with the knowledge of that Department in contravention of such practices.

Case: 2:18-cv-00238-EAS-CMV Doc #: 79 Filed: 03/29/19 Page: 11 of 32 PAGEID #: 617
12

ANSWER: Fiserv admits that Fiserv Solutions, LLC sent certain mailings at issue 

pursuant to instructions from CVS pursuant to the Master Service Agreement. Fiserv lacks 

knowledge or information sufficient to form a belief as to the truth of the remaining allegations in 

Paragraph 23, in particular the allegation that “transparent glassine windows contravenes the 

standard practice of ODH.” Fiserv denies any remaining allegations in Paragraph 23.

24. Defendants were under a legal duty and must have known, or either knew or 

reasonably should have known, that this mailing was disseminated in violation of both federal and 

state laws. While CVS refers in connection with its privacy practices to different entities as “CVS 

Health” as a collective health care entity, without defining precisely what entity they are referring 

to, CVS has publicly represented it has systems in place to protect the privacy of sensitive health 

information. For example, in its Vendor Code of Conduct entitled “Conducting Business With 

CVS Health” (which would apply to its relationship with Fiserv), CVS claims on page 3 “It is 

critical that CVS Health and our vendors/supplies, who also access, use and store this information, 

handle it only as needed and in accordance with our Privacy and Information Security Policies and 

Procedures as required under our agreement with our vendors/suppliers, including our Information 

Privacy and Security Requirements and Business Associate Agreements. It is critical that our 

vendors/suppliers have in place reasonable and appropriate administrative, technical and physical 

safeguards to protect this information from improper or unauthorized access or use.” In addition, 

CVS requires in this same Code of Conduct that its vendors and suppliers are expected “to abide 

by applicable laws and regulations, including applicable Federal health care program requirements, 

in the states and countries in which they conduct business” – in this case, the Ohio state laws here 

at issue. In addition, as noted above CVS requires all vendors to comply with CVS’ Data Privacy 

and Security Requirement Agreements, its information Privacy and Security Requirements, and 

its Privacy and Information Security Policies. This Code of Conduct was executed by Neal Baker 

as the Chief Privacy Officer of “CVS Health” – the same person who responded to Plaintiffs’ 

request for a response as to this particular privacy breach as set forth herein. Yet under no set of 

agreements, Codes, business associate agreements, policies or procedures would it be permissible 

to disclose for public viewing the HIV status of a particular person, in violation of Ohio law.

ANSWER: The first and last sentences in Paragraph 24 state legal conclusions to which 

no responses are required. To the extent responses are required, Fiserv denies the allegations of 

the first and last sentences in Paragraph 24. Fiserv admits that the terms of its contractual 

relationship with CVS are set forth in the Master Service Agreement, and denies any allegations 

inconsistent therewith. Fiserv also refers to the CVS Code of Conduct for the complete content 

thereof, and denies any allegations inconsistent therewith. Fiserv denies any remaining allegations 

in Paragraph 24.

Case: 2:18-cv-00238-EAS-CMV Doc #: 79 Filed: 03/29/19 Page: 12 of 32 PAGEID #: 618
13

25. In addition, in the CVS Health “Notice of Privacy Practices” effective as of June 

30, 2017 on the CVS/Caremark website (just a few weeks before the disclosure at issue), CVS 

made further public representations how it protects PHI under HIPAA, as it claims to ODH as part 

of its agreement that it would do. This Notice covers the CVS defendant here as an Affiliated 

Covered Entity even though it is supposedly issued by “CVS Caremark, Inc.”. Under that policy 

CVS states it will not use or disclose PHI for marketing purposes. Yet that was part of the purpose 

of the notice at issue – to advise persons, many of whom did not use CVS, to utilize CVS under 

the OhDAP program to obtain their HIV medications. That policy also states that “we will obtain 

your written authorization before using or disclosing your PHI for purposes other than those 

described in this Notice or as otherwise permitted by law.” Yet no applicable law permitted CVS 

to send Plaintiffs and Class members a notice publicly disclosing their PHI as part of a haphazard 

identification code, which was not a specifically identified purpose in this Notice of Privacy 

Practices. Nor did CVS obtain any advance written authorization from Plaintiffs and Class 

members to do so or to provide this information to Fiserv, in further violation of this Notice, its 

agreement with ODH and Ohio law.

ANSWER: Fiserv refers to the CVS Health “Notice of Privacy Practices” effective as 

of June 30, 2017, for the complete content thereof, and denies any allegations inconsistent 

therewith. Fiserv denies any remaining allegations in Paragraph 25.

26. In addition, all CVS related subsidiaries, divisions, and affiliates are currently 

subject to an FTC consent decree from In the Matter of CVS Caremark Corporation, FTC Case 

No. C-4259. This Consent Decree resulted from several other episodes where CVS was careless 

with consumers’ PHI data. In the order implementing that consent decree, CVS agreed it would 

not in connection with marketing or promoting any product or service (which would include the 

services contracted with the ODH and offered to be provided to Plaintiffs and Class members) “the 

extent to which it maintains and protects the privacy, confidentiality, security or integrity of 

personal information collected from or about consumers.” Yet in obtaining the contract at issue 

from ODH, such security and CVS’ compliance with state and federal privacy laws was one of the 

representations CVS focused upon in connection with selling its services and obtaining access to 

the PHI in question as part of the OhDAP. In addition, CVS was required as part of the FTC Order 

to establish, implement and maintain, with an independent third party, a “comprehensive 

information security program that is reasonably designed to protect the security, confidentiality 

and integrity of personal information collected from or about consumers.” CVS also was ordered 

to develop reasonable safeguards to “select and retain service providers capable of appropriately 

safeguarding personal information they receive” from CVS, and for those providers to implement 

and maintain such safeguards. Yet in connection with this particular breach, it appears CVS created 

program IDs that actually and directly referred to the medical condition of the consumer. CVS also 

made no effort to either test or quality control its mailings to ensure no PHI was publicly visible, 

or to prevent its vendors, including Fiserv, from using windowed envelopes that would disclose 

such information. The fact that Mr. Baker, the Chief Privacy Officer of CVS, and CVS’ other 

statements to the media was simply that this breach was not “intentional”, and that it would modify 

its procedures in place to ensure such an incident would not happen again, is significant evidence 

that Defendants’ procedures – required to be in place under this FTC Order – were not adequate 

to protect the confidentiality of the PHI of Plaintiffs and Class members. Defendants’ violations 

Case: 2:18-cv-00238-EAS-CMV Doc #: 79 Filed: 03/29/19 Page: 13 of 32 PAGEID #: 619
14

of the above provisions of the FTC Order combined with the cavalier use of such a program code 

directly above a consumers’ name and address and the decision to use a windowed envelope 

disclosing that information, is in abrogation of all such applicable laws and obligations. Such 

conduct was thus in violation of the standards and commitments imposed under the agreement 

with ODH and Ohio law, upon both CVS and its vendor Fiserv.

ANSWER: Fiserv refers to the cited FTC consent decree for the complete content 

thereof, and denies any allegations inconsistent therewith. Fiserv lacks knowledge or information 

sufficient to form a belief as to the truth of the remaining allegations against CVS in Paragraph 26. 

Fiserv denies any remaining allegations in Paragraph 26 directed to Fiserv and otherwise denies 

any remaining allegations in Paragraph 26.

27. Defendants also acted with a conscious disregard for the rights and safety of other 

persons that has a great probability of causing substantial harm, resulting in knowing conduct.

Based on the representations, Codes of Conduct, agreements and orders set forth above, including 

the FTC Order, Defendants knew that it is unlawful and likely harmful to disclose patients’ HIV 

status to the public, and that any persons whose PHI was disclosed were to be separately notified 

of that breach. In addition to CVS’s representations about its compliance with state and federal 

laws as described above, CVS states in its “Notice of Privacy Practices,” “We are required by law 

to protect the privacy of your PHI and to provide you with this Notice explaining our legal duties 

and privacy practices regarding your [Protected Health Information].... You have a right to be 

notified in the event there is a breach of your unsecured PHI as defined by HIPAA.” 

https://www.cvs.com/content/patient-privacy (accessed June 5, 2018). Fiserv advertises its 

compliance as well: “From enrollment to payment, let Fiserv help you create, maintain and grow 

member engagement while adhering to the strongest risk and compliance standards, including 

HITRUST® CSF® certification.” https://www.fiserv.com/customer-channelmanagement/output-solutions/healthcareprinting.aspx (accessed June 5, 2018). In addition, as 

alleged above CVS’s Vendor Code of Conduct purports to require vendors, which would include 

Fiserv here, to ensure that their “use, disclosure, transmission, storage, and destruction of 

confidential information [is] in accordance with vendor/supplier contracts and applicable laws.”

ANSWER: Fiserv denies that Defendants “acted with a conscious disregard for the 

rights and safety of other persons that has a great probability of causing substantial harm, resulting 

in knowing conduct” and denies that the remaining allegations in Paragraph 27 support such a 

conclusion. Fiserv admits that https://www.fiserv.com/customer-channel-management/outputsolutions/healthcare-printing.aspx is on its website and refers to that link for the complete content 

thereof, and denies any allegations inconsistent therewith. Fiserv also admits that Paragraph 27 

Case: 2:18-cv-00238-EAS-CMV Doc #: 79 Filed: 03/29/19 Page: 14 of 32 PAGEID #: 620
15

purports to quote and/or characterize the CVS Code of Conduct and other documents. Fiserv refers 

to those documents for the complete content thereof and denies any allegations inconsistent 

therewith. Fiserv denies any remaining allegations in Paragraph 27.

28. Contrary to these obligations that Defendants either knew or reasonably should 

have been aware of, after disclosing the PHI of over 6,000 Ohio residents, CVS hampered efforts 

to remediate the damage by failing to notify affected individuals and the United States Department 

of Health and Human Services, in violation of their own stated privacy policy and in violation of 

45 C.F.R. §§ 164.400–414. One of the undersigned counsel sent CVS a letter advising CVS that it 

had violated HIPAA, asking for verification of the corrective measures that CVS had taken to 

ensure that breaches will not happen in the future, and demanding that CVS notify the affected 

individuals. Mr. Baker, CVS’s Chief Privacy Officer, acknowledged receipt of the letter and stated 

that CVS was investigating this claim, and only later weakly stated in response to public inquiry 

and outcry that its conduct was not “intentional” and would not happen again – of no relevance or 

comfort to the thousands of individuals impacted by this breach. What’s worse, and as further 

evidence of the knowing nature of its wrongful act, in almost a year CVS did not communicate 

further or notify the approximately 6,000 affected individuals or the U.S. Department of Health 

and Human Services of this breach – even though its current merger partner Aetna, Inc., under 

virtually identical circumstances, did so within days of learning of a similar breach. Defendants’ 

failure to provide a notification of this breach shows that it is knowingly attempting to cover up 

this wrongdoing by ignoring it.

ANSWER: Fiserv lacks knowledge or information sufficient to form a belief as to the 

truth of the allegations against CVS in Paragraph 28. Fiserv denies that CVS did not communicate 

with the United States Department of Health and Human Services and refers to the 

communications between CVS and the United States Department of Health and Human Services 

for the complete content thereof. Plaintiffs’ counsel did not communicate with Fiserv until after 

the filing of their original Complaint, and Fiserv accordingly denies any allegations in 

Paragraph 28 directed to Fiserv. Fiserv denies any remaining allegations in Paragraph 28.

29. Defendants’ conduct is especially egregious in this instance because it was directed 

at a class of individuals historically subject to discrimination based upon their medical condition. 

Although many would like to believe a lot has changed since the U.S. Supreme Court held in 1998 

that HIV/AIDS was subject to protections of the Americans with Disabilities Act4

, persons living 

with HIV and those at high risk of infection continue to battle for equal access to healthcare and 

rights. In fact, in a 2009 survey by Lambda Legal, “nearly 63 percent of the respondents who had 

HIV reported experiencing one or more of the following types of discrimination in health care: 

 4 Bragdon v. Abbott, 524 U.S. 624 (1988).

Case: 2:18-cv-00238-EAS-CMV Doc #: 79 Filed: 03/29/19 Page: 15 of 32 PAGEID #: 621
16

being refused needed care; being blamed for their healthcare status; and/or a healthcare 

professional refusing to touch them or using excessive precautions, using harsh or abusive 

language, or being physically rough and abusive.”5 Of those surveyed, 19% reported being denied 

care altogether. As Caremark pointed out on its own website, if patients can’t trust their physicians 

and insurers to protect their health information, they will be less likely to seek important and 

potentially lifesaving medical treatment.

ANSWER: Fiserv denies that “Defendants’ conduct is especially egregious in this 

instance” and denies that the remaining allegations in Paragraph 29 support such a conclusion. 

Fiserv admits that Paragraph 29 purports to quote and/or characterize a Lambda Legal survey, 

Supreme Court opinion, and Caremark’s website. Fiserv refers to the Lambda Legal survey, 

Supreme Court opinion, and Caremark’s website for the complete content thereof and denies any 

allegations inconsistent therewith. Fiserv denies that the allegations in Paragraph 29 evidence that 

any of the Plaintiffs or any of the purported class members have suffered the injury alleged, and 

demands strict proof of any alleged injury(ies) or damages. Fiserv denies the remaining allegations 

in Paragraph 29.

30. Persons living with HIV (and their families) are also regularly subjected to 

employment and housing discrimination. In the 2000s, the U.S. Equal Employment Opportunity 

Commission received 2,175 complaints of discrimination based on HIV, with complaints peaking 

in the last year of the survey, demonstrating a disturbing upward trend. And, a 2009 national survey 

conducted by the Kaiser Foundation also showed that only 21% of people were comfortable living 

with someone with HIV. There are also numerous reported lawsuits over instances in which 

individuals with HIV (including children) have been denied housing and equal access because of 

their HIV status.

ANSWER: Fiserv admits that Paragraph 30 purports to characterize a U.S. Equal 

Employment Opportunity Commission survey and a national survey conducted by the Kaiser 

Foundation. Fiserv refers to the U.S. Equal Employment Opportunity Commission survey and the

Kaiser Foundation survey for the complete content thereof and denies any allegations inconsistent 

 5 https://www.lambdalegal.org/sites/default/files/publications/downloads/fs_hiv-stigma-anddiscrimination-in-the-us_1.pdf, last accessed May 8, 2018. All statistics cited herein are taken from 

Lambda’s report unless otherwise attributed.

Case: 2:18-cv-00238-EAS-CMV Doc #: 79 Filed: 03/29/19 Page: 16 of 32 PAGEID #: 622
17

therewith. Fiserv lacks knowledge or information sufficient to form a belief as to the truth of the 

allegations in the first and last sentences of Paragraph 30. Fiserv denies any remaining allegations 

in Paragraph 30.

31. It is also well known that HIV and AIDS disproportionately impacts minority 

groups such as the LGBT community and African Americans. According to AmFAR, gay and 

bisexual men accounted for 82% of the United States’ 1.2 million people living with HIV, with 

African-Americans accounting for 45% of HIV diagnoses but only 12% of the general population.6

ANSWER: Fiserv admits that Paragraph 31 purports to characterize facts and statistics 

from AmFAR. Fiserv refers to AmFAR’s website for the complete content thereof and denies any 

allegations inconsistent therewith. Fiserv denies that the allegations in Paragraph 31 evidence that 

any of the Plaintiffs or any of the purported class members have suffered the injury alleged, and 

demands strict proof of any alleged injury(ies) or damages. Fiserv lacks knowledge or information 

sufficient to form a belief as to the truth of the remaining allegations in Paragraph 31.

32. The pervasive discrimination suffered by those with HIV or AIDS leads to a social 

stigma that results in significant harm, including a direct correlation to higher rates of depression, 

loneliness, and social isolation—and results in those suffering from (or at high risk of) the illness 

to avoid testing and treatment to avoid the negative consequences of a positive diagnosis. One 

meta-analysis of 119 studies “demonstrated that perceived interpersonal risks are associated with 

HIV disclosure and outlined evidence of associations with anxiety, fear and worry.”7 They may 

also run the risk of the loss of housing, relationships, and employment when their HIV status is 

revealed. A 2012 national survey by the Washington Post and the Kaiser Family Foundation 

showed that fewer than half of respondents would feel “very comfortable” working with someone 

who has HIV or AIDS, or having a teacher for their children who has HIV or AIDS. Only a third 

would feel “very comfortable” with having a roommate who is living with HIV, and fewer than a 

quarter would feel “very comfortable” having food prepared by someone who is living with HIV.8

Such studies and analysis demonstrate that even if individuals living with HIV do not know and 

cannot show who may been made aware of their HIV status, acts such as at issue here increase 

stress and anxiety, and result in personal harm and injury in fact.

 6 http://amfar.org/About-HIV-and-AIDS/Facts-and-Stats/Statistics--United-States/, last accessed 

May 9, 2018.

7 Michael Evangeli and Abigail L. Wroe, HIV Disclosure Anxiety: A Systematic Review and 

Theoretical Synthesis, AIDS Behavior (2017) 21:1–11, https://www.ncbi.nlm.nih.gov/pmc/

articles/PMC5216111/pdf/10461_2016_Article_1453.pdf

8 Washington Post and Kaiser Family Foundation, 2012 Survey of Americans on HIV/AIDS, 

https://kaiserfamilyfoundation.files.wordpress.com/2013/01/8334-f.pdf.

Case: 2:18-cv-00238-EAS-CMV Doc #: 79 Filed: 03/29/19 Page: 17 of 32 PAGEID #: 623
18

ANSWER: Fiserv admits that the allegations in Paragraph 32 purport to cite certain 

documents in order to draw generalizations about the extent to which persons with HIV may be 

subject to stigma, humiliation, mental anguish, embarrassment, and stress based on their HIV 

status. Fiserv denies that the allegations in Paragraph 32 evidence that any of the Plaintiffs or any 

of the purported class members have suffered the injury alleged, and demands strict proof of any 

alleged injury(ies) or damages. Fiserv lacks knowledge or information sufficient to form a belief 

as to the truth of the allegations in the first sentence of Paragraph 32. Fiserv denies the remaining 

allegations in Paragraph 32.

33. The State of Ohio, where Plaintiffs reside and where CVS has substantial 

operations, provides a right to privacy that encompasses unconsented medical information 

disclosures. “[I]t is for the patient—not some medical practitioner, lawyer or court—to determine 

what the patient’s interests are with regard to personal confidential medical information.” Biddle 

v. Warren Gen. Hosp., 86 Ohio St. 3d 395, 408, 715 N.E.2d 518.528 (Ohio 1999); see also 

Hageman v. Southwest Gen. Health Ctr., 119 Ohio St. 3d 185, 188-89, 893 N.E.2d 153, 156 (Ohio 

2008) (applying the rule of Biddle to disclosures made by parties other than physicians or 

hospitals).

ANSWER: Fiserv lacks knowledge or information sufficient to form a belief as to 

where Plaintiffs reside or where CVS has “substantial operations.” The first sentence in Paragraph 

33 states a legal conclusion, to which no response is required. To the extent a response is required, 

Fiserv refers to the text of any relevant Ohio state statutes, regulations, or laws pertaining to the 

right to privacy and denies any allegations inconsistent therewith. The remaining allegations in 

Paragraph 33 purport to characterize Ohio court opinions and state legal conclusions to which no 

response is required. To the extent a response is required, Fiserv refers to the text of the cited Ohio 

court opinions and denies any allegations inconsistent therewith. Fiserv denies any remaining 

allegations in Paragraph 33.

34. In addition to the general protection against the unwanted or unauthorized 

disclosure of medical information and PHI under state law, and the statutory and regulatory 

protections against the disclosure of PHI pursuant to HIPAA, 42 U.S.C. § 1320d-6 and the HIPAA 

Privacy Rules at 45 C.F.R. § 164.500, et seq., the State of Ohio has enacted legislation to 

Case: 2:18-cv-00238-EAS-CMV Doc #: 79 Filed: 03/29/19 Page: 18 of 32 PAGEID #: 624
19

specifically protect HIV patients (and those at risk) in order to encourage testing and treatment.

This legislation protects against the unauthorized disclosure of a person’s HIV status such as the 

Defendants did here, pursuant to Ohio Rev. Code § 3701.243(A) (“no person or agency of state or 

local government that acquires the information while providing any health care service or while in 

the employ of a health care facility or health care provider shall disclose or compel another to 

disclose any of the following ... (3) The identity of any individual diagnosed as having AIDS or 

an AIDS-related condition.”); see also Ohio Rev. Code 3701.244(B) (A person or agency of state 

or local government that knowingly violates ... division (A) of section 3701.243 ... may be found 

liable in a civil action; the action may be brought by any individual injured by the violation.”). In 

addition, applicable law requires companies to specifically identify to consumers who may have 

access to their PHI. Defendants have violated all of these laws. By taking the position Defendants 

were not obligated to notify either the U.S. Department of Health and Human Services or the 

affected consumers of what happened , even though they cannot deny a disclosure of PHI occurred, 

shows Defendants’ wanton and conscious disregard of the rights, feelings and safety of such 

persons.

ANSWER: Fiserv admits that the State of Ohio has enacted Ohio Rev. Code 

§ 3701.243. Fiserv lacks knowledge or information sufficient to form a belief as to why the State 

of Ohio enacted the legislation that Plaintiffs purport to characterize in Paragraph 34, including 

Ohio Rev. Code § 3701.243. The allegations in Paragraph 34 purport to characterize federal and 

Ohio state statutes and regulations and state legal conclusions to which no response is required. 

To the extent a response is required, Fiserv refers to the text of the relevant federal and Ohio state 

statutes and regulations for the complete content thereof and denies any allegations inconsistent 

therewith. Fiserv denies the allegations of the final sentence in Paragraph 34 and denies any 

remaining allegations in Paragraph 34.

35. The damages that result from the unauthorized disclosure of a person’s HIV status 

are significant. For example, an Ohio court awarded damages of $6,000 for the inadvertent 

disclosure of a prisoner’s HIV status to government employees, even though the plaintiff presented 

“no evidence as to the extent of his emotional distress.” Miller v. Ohio Dep’t of Rehab. & Corr., 

No. 2016-00393-AD (Ohio Ct. Cl. Nov. 4, 2016).

ANSWER: Fiserv denies that the mailings at issue disclosed Plaintiffs’ alleged HIV 

status to any unauthorized party, particularly based on Plaintiffs’ continuing failure or refusal to 

identify a single unauthorized person to whom their alleged HIV status was actually disclosed, and 

further denies that Plaintiffs suffered any injury(ies) or damages as a result thereof. Fiserv refers 

Case: 2:18-cv-00238-EAS-CMV Doc #: 79 Filed: 03/29/19 Page: 19 of 32 PAGEID #: 625
20

to the Ohio court decision for the complete content thereof, denies any allegations inconsistent 

therewith, and denies that the facts underlying that decision are analogous to the facts alleged in 

the Consolidated Amended Complaint. Fiserv denies any remaining allegations in Paragraph 35.

36. In addition, Plaintiffs may be without adequate remedy at law, rendering equitable, 

injunctive and/or declaratory relief appropriate in that: (a) relief is necessary to inform the parties 

of their rights and obligations under the laws at issue herein; (b) damages may not adequately 

compensate them for the injuries suffered, nor may other claims permit such relief; (c) the relief 

sought herein in terms of correcting such practices and precluding the further use of glassine 

envelopes may not be fully accomplished by awarding damages; and (d) if the conduct complained 

of is not corrected, harm may continue to result to members of the general public.

ANSWER: Fiserv denies the allegations in Paragraph 36.

37. On personal knowledge, each of the Plaintiffs received the letter in question, 

publicly revealing their HIV status.

(a) John Doe One feels that CVS has essentially handed a weapon to anyone 

who handled the envelope, giving them the opportunity to attack his identity or cause other harm 

to him. He is also experiencing significant distress at home from receiving a mailing that used his 

name, address, birthdate and PHI from an entity with whom he had no business connection. He is 

rightfully concerned that members of his local community have or will learn of his HIV status.

(b) John Doe Two lives in a small town and fears the stigma that would result 

from the disclosure of his HIV status. The more people who know that he is living with HIV, the 

less safe he feels. In his town, many people still believe in “guilt by association,” and thus his 

friends and family run the risk of being stigmatized just by being seen with him. He is concerned 

that people such as his postal delivery person now knows his HIV status, particularly since CVS 

forces him to obtain his HIV medications by mail order and he receives those medications at the 

same address. He is also experiencing significant distress based on the adverse consequences of a 

similar incident years ago.

(c) John Doe Three lives in a small town where “everyone knows everyone.”

He does not publicly disclose his HIV status, but has friends and relatives who work for the U.S.

Postal Service who would have seen this mailing and discovered his HIV status because of the 

Defendants’ mailing. He is also experiencing significant distress as a result of this disclosure,

including an understandable fear to leave his home, and has also experienced increased 

complications and health issues since this disclosure.

(d) John Doe Four has taken great pains to keep his HIV status private for many 

years. As a result of the disclosure of his HIV status, Plaintiff has suffered, and continues to suffer, 

ongoing harm, including the loss of his medical privacy, the disclosure of highly personal 

information, mental, emotional, and physical distress including panic, anxiety, loss of sleep, loss 

of productivity, and time spent dealing with the fallout of the disclosure. Moreover, Plaintiff 

remains in imminent threat of future harm from Defendants because they continue to maintain his 

Case: 2:18-cv-00238-EAS-CMV Doc #: 79 Filed: 03/29/19 Page: 20 of 32 PAGEID #: 626
21

PII and PHI but are not safeguarding it from unlawful disclosure in compliance with state and 

federal laws.

ANSWER: Fiserv denies that the mailings placed at issue “publicly reveal[ed]” 

Plaintiffs’ HIV status or that anyone at the U.S. Postal Service saw “this mailing and discovered 

[any Plaintiff’s] HIV status,” particularly based on Plaintiffs’ continuing failure or refusal to 

identify a single unauthorized person to whom their alleged HIV status was actually disclosed. 

Fiserv further denies that Plaintiffs have suffered any legally cognizable harm as a result of the 

mailings placed at issue. Fiserv lacks knowledge or information sufficient to form a belief as to 

the truth of the remaining allegations in Paragraph 37.

CLASS ALLEGATIONS

38. This action is brought by the Plaintiffs both on behalf of themselves and on behalf 

of all other similarly situated persons pursuant to Rule 23 of the Federal Rules of Civil Procedure. 

The Plaintiffs seek to represent the following class (“Class”):

All participants in OhDAP to whom Defendants provided information to an 

unauthorized recipient and/or sent a mailing in or about July or August 2017 in 

which the participant’s name and the letters “HIV” were visible through the 

envelope window.

ANSWER: Fiserv admits that Plaintiffs are seeking to pursue a class action using the 

stated class definition. Fiserv denies that Plaintiffs can satisfy the requirements under Fed. R. Civ. 

P. 23, that class certification in this matter is appropriate, that there is a certifiable class, that Fiserv 

has engaged in any wrongful conduct, or that the putative class has experienced any legally 

cognizable harm. Fiserv denies any remaining allegations in Paragraph 38.

39. The precise number and identity of Class members are unknown to the Plaintiffs 

but can be obtained from the records of Defendants. News reports have estimated the class number 

to be more than 6,000 persons.

ANSWER: Fiserv lacks knowledge or information sufficient to form a belief as to the 

truth of the allegations in Paragraph 39 as to what Plaintiffs know, do not know, or could obtain. 

Responding further, the allegation in Paragraph 39 regarding news reports is ambiguous, vague, 

Case: 2:18-cv-00238-EAS-CMV Doc #: 79 Filed: 03/29/19 Page: 21 of 32 PAGEID #: 627
22

and without specific citations, and therefore Fiserv lacks knowledge or information sufficient to 

form a belief as to its truth. Fiserv denies any remaining allegations in Paragraph 39.

40. Common questions of law and fact predominate over any questions affecting 

individual members of the Class. Such common legal and factual questions include the following:

(a) Whether Defendants’ conduct was tortious and violated the applicable 

standard of care;

(b) Whether Defendants’ conduct was unlawful, including in violation of the 

state and federal statutes and regulations cited above;

(c) Whether the Class members are entitled to damages and the extent of those 

damages; and

(d) Whether the Class members are entitled to injunctive or declaratory relief.

ANSWER: Fiserv denies the allegations in Paragraph 40.

41. The Plaintiffs’ claims are typical of the claims of the Class members because 

similar mailings to those identified above were sent to Plaintiffs and every Class member.

ANSWER: Fiserv denies the allegations in Paragraph 41.

42. The Plaintiffs are willing and prepared to serve the Court and the proposed Class 

in a representative capacity. The Plaintiffs will fairly and adequately represent and protect the 

interests of the Class and have no interests adverse or antagonistic to or that materially and 

irreconcilably conflict with the interests of the other members of the Class. Based on the facts 

detailed above, the interests of the Plaintiffs are reasonably coextensive with those of absent Class 

members.

ANSWER: Fiserv lacks knowledge or information sufficient to form a belief as to the 

truth of the allegations in Paragraph 42.

43. The Plaintiffs have engaged the services of counsel who are experienced in 

complex class litigation and the issues raised in this Complaint who will vigorously prosecute this 

action, and who will assert and protect the rights of and otherwise adequately represent the rights 

of the Plaintiffs and absent Class members.

ANSWER: Fiserv lacks knowledge or information sufficient to form a belief as to the 

truth of the allegations in Paragraph 43.

44. Prosecuting separate actions by individual Class members would create a risk of 

inconsistent or varying adjudications with respect to individual Class members that would 

establish incompatible standards of conduct for Defendants.

Case: 2:18-cv-00238-EAS-CMV Doc #: 79 Filed: 03/29/19 Page: 22 of 32 PAGEID #: 628
23

ANSWER: Fiserv denies the allegations in Paragraph 44.

45. By disclosing the PHI in question without having first obtained consent to do so 

and sending similar mailings to thousands of people and later refusing to send notification thereof 

Defendants have acted or refused to act on grounds generally applicable to the Class, thereby 

making injunctive and declaratory relief appropriate respecting the Class as a whole.

ANSWER: Fiserv denies the allegations in Paragraph 45. 

46. Because all Class members are seeking the same relief based on the same course of 

conduct by Defendants, the questions of law or fact common to Class members as set forth in this 

Complaint predominate over any questions affecting only individual members. Thus, a class action 

is superior to other available group-wide methods for fairly and efficiently adjudicating this 

controversy, to the extent necessary in order to maintain this action on behalf of the Class.

ANSWER: Fiserv denies the allegations in Paragraph 46.

CAUSES OF ACTION

Count I

Unauthorized, Unprivileged Disclosure to a Third-Party of Nonpublic Medical Information

47. The Plaintiffs repeat and re-allege all allegations as if fully incorporated and set 

forth herein.

ANSWER: Fiserv repeats and re-alleges all answers as if fully incorporated and set 

forth herein.

48. An individual’s HIV status is a fact learned within the physician–patient 

relationship. A patient has the right to privacy of this information.

ANSWER: Fiserv admits an individual’s HIV status is a fact that may be learned within

the physician-patient relationship, but denies the remaining allegations of the first sentence in 

Paragraph 48. The second sentence in Paragraph 48 states a legal conclusion to which no response 

is required. To the extent a response is required, Fiserv refers to federal and/or state law 

concerning the right to privacy of physician-patient information for the complete content thereof 

and denies any allegations inconsistent therewith. Fiserv denies any remaining allegations in 

Paragraph 48.

Case: 2:18-cv-00238-EAS-CMV Doc #: 79 Filed: 03/29/19 Page: 23 of 32 PAGEID #: 629
24

49. To be eligible for OhDAP, an applicant must submit “medical verification 

documents” confirming the applicant’s HIV status. Therefore, a person’s participation in OhDAP 

necessarily reflects facts about that person’s HIV status obtained from documents protected by the 

physician–patient privilege. A patient has the right to privacy of this information.

ANSWER: Paragraph 49 is based on Plaintiffs’ construction of Ohio law and therefore 

states a legal conclusion to which no response is required. To the extent a response is required,

Fiserv denies the allegations in Paragraph 49. Fiserv denies any remaining allegations in 

Paragraph 49.

50. CVS disclosed the HIV status of Plaintiffs and Class members to Fiserv without 

the authorization of Plaintiffs and Class members.

ANSWER: Fiserv denies the allegations in Paragraph 50.

51. Defendants also disclosed the HIV status of Plaintiffs and Class members, without 

their authorization, to third-parties, including government employees of the United States Postal 

Service without authorization, which was not privileged to receive this information, and disclosed 

this information to others, including families, friends, roommates, landlords, neighbors, and 

complete strangers.

ANSWER: Fiserv denies that it disclosed the HIV status of Plaintiffs and putative class 

members to any unauthorized party, particularly based on Plaintiffs’ continuing failure or refusal 

to identify a single unauthorized person to whom their alleged HIV status was actually disclosed. 

Fiserv denies any remaining allegations in Paragraph 51.

52. Defendants have not been authorized by any of the Plaintiffs or Class members to 

disclose the Plaintiffs’ and Class members’ HIV status to any of the above persons or the public.

ANSWER: Fiserv denies that it disclosed Plaintiffs’ and putative class members’ HIV 

status to “any of the above persons” or the public and denies any remaining allegations in 

Paragraph 52.

53. As a direct and proximate result of Defendants’ actions, the Plaintiffs and Class 

members have suffered damages.

ANSWER: Fiserv denies the allegations in Paragraph 53.

Case: 2:18-cv-00238-EAS-CMV Doc #: 79 Filed: 03/29/19 Page: 24 of 32 PAGEID #: 630
25

54. The Plaintiffs, on behalf of themselves and all Class members, seek relief, including 

but not limited to damages, injunctive relief, declaratory judgment, and punitive damages in 

amounts according to proof at time of trial.

ANSWER: Fiserv admits that Plaintiffs seek the relief asserted in Paragraph 54 but 

denies that Plaintiffs are entitled to such relief. Fiserv denies any remaining allegations in 

Paragraph 54.

Count II

Violation of Ohio Rev. Code § 3701.243

55. The Plaintiffs repeat and re-allege all of the allegations of the preceding Paragraphs 

as if fully incorporated and set forth herein.

ANSWER: Fiserv repeats and re-alleges all of its answers of the preceding Paragraphs 

as if fully incorporated and set forth herein.

56. At all times material herein Defendants have been subject to the requirements of §

3701.243. The information contained in the Notice was protected information because it contained 

“the identity of any individual diagnosed as having AIDS or an AIDS-related condition.” Ohio 

Rev. Code Ann. § 3701.243(A)(3).

ANSWER: Paragraph 56 is based on Plaintiffs’ construction of Ohio law and therefore 

states a legal conclusion to which no response is required. To the extent a response is required, 

Fiserv denies the allegations in Paragraph 56. 

57. Ohio law prohibits disclosing any record mentioned above to another person 

without written consent or without statutorily enumerated authorization. Ohio Rev. Code Ann. §

3701.243.

ANSWER: Paragraph 57 is based on Plaintiffs’ construction of Ohio law and therefore 

states a legal conclusion to which no response is required. To the extent a response is required, 

Fiserv refers to Ohio Rev. Code Ann. § 3701.243 for the complete content thereof and denies any 

allegations inconsistent therewith. 

58. CVS knowingly disclosed the HIV status, including having AIDS or an AIDSrelated condition, of Class members to Fiserv without these Class members’ advance written 

authorization.

Case: 2:18-cv-00238-EAS-CMV Doc #: 79 Filed: 03/29/19 Page: 25 of 32 PAGEID #: 631
26

ANSWER: Fiserv denies the allegations in Paragraph 58.

59. Defendants also knowingly disclosed the HIV status, including having AIDS or an 

AIDS-related condition, of Class members, without their authorization, to the United States Postal 

Service without written authorization, which was not privileged to receive this information, and 

further potentially disclosed this information to others, including their families, friends, 

roommates, landlords, neighbors, and complete strangers.

ANSWER: Fiserv denies that it disclosed the HIV status, including AIDS or an AIDSrelated condition, of Plaintiffs or putative class members to any unauthorized party, particularly 

based on Plaintiffs’ continuing failure or refusal to identify a single unauthorized person to whom 

their alleged HIV status was actually disclosed. Fiserv denies any remaining allegations of 

Paragraph 59.

60. These disclosures were made in connection with the provision of health care 

services in this State. Defendants violated Ohio law by knowingly disclosing, without receiving 

advance authorization from the Plaintiffs or any Class members:

(1) The identity of any individual on whom an HIV test is performed; (2) The results 

of an HIV test in a form that identifies the individual tested; [or] (3) The identity of 

any individual diagnosed as having AIDS or an AIDS-related condition.

and without the required disclosures, in violation of Ohio Rev.Code § 3701.243(A)(1)-(3) and (E).

The disclosed information was obtained while administering a state-run program, and providing a 

health care service, namely CVS’s provision of pharmacy benefits management and pharmacy 

services to OhDAP and obtaining a contract for the sale of such services from ODH.

ANSWER: Fiserv denies the allegations in Paragraph 60.

61. Based on the host of orders, laws, codes of conduct, and agreements set forth above, 

the Defendants knew about the laws governing confidentiality of HIV information in Ohio and 

federal law, and they knowingly committed the actions described above, which violated Section 

3701.243(A).

ANSWER: Fiserv denies the allegations in Paragraph 61.

62. As a direct and proximate result of Defendants’ actions, the Plaintiffs and Class 

members have suffered damages.

ANSWER: Fiserv denies the allegations in Paragraph 62.

63. The Plaintiffs and Class members have a private right of action for Defendants’ 

violations of this law. Ohio Rev. Code § 3701.244(B).

Case: 2:18-cv-00238-EAS-CMV Doc #: 79 Filed: 03/29/19 Page: 26 of 32 PAGEID #: 632
27

ANSWER: Fiserv denies the allegations in Paragraph 63.

64. The Plaintiffs and Class members seek relief, including but not limited to damages, 

punitive damages, injunctive relief, declaratory judgment, and attorneys’ fees and costs.

ANSWER: Fiserv admits that Plaintiffs seek the relief asserted in Paragraph 64 but 

denies that Plaintiffs are entitled to such relief. Fiserv denies any remaining allegations in 

Paragraph 64.

Count III

Violation of Ohio Insurance Information and Privacy Protection Act 

Ohio Rev. Code § 3904.01, et seq.

65. Plaintiffs repeat and re-allege the allegations of all Paragraphs as if fully 

incorporated and set forth herein.

ANSWER: Fiserv repeats and re-alleges all of its answers of the preceding Paragraphs 

as if fully incorporated and set forth herein.

66. Plaintiffs’ and Class Members’ HIV-medication information was “personal 

information” as defined under Ohio Rev. Code § 3904.01(R) because it was “individually 

identifiable information gathered in connection with an insurance transaction from which 

judgments can be made about and individual’s character, habits, avocations, finances, occupation, 

general reputation, credit, health or any other personal characteristics.”

ANSWER: Paragraph 66 is based on Plaintiffs’ construction of Ohio law and therefore 

states a legal conclusion to which no response is required. To the extent a response is required, 

Fiserv denies the allegations in Paragraph 66. Fiserv denies any remaining allegations in 

Paragraph 66.

67. Defendants disclosed without authorization or legal basis personal information 

regarding Plaintiffs and Class Members to third-parties that was collected or received in 

connection with an insurance transaction, in violation of Ohio Rev. Code § 3904.13. Plaintiffs and 

Class Members have been harmed by Defendants’ willful and unauthorized disclosures of their 

personal information.

ANSWER: The first sentence in Paragraph 67 states a legal conclusion to which no 

response is required. To the extent a response is required, Fiserv denies the allegations in the first 

Case: 2:18-cv-00238-EAS-CMV Doc #: 79 Filed: 03/29/19 Page: 27 of 32 PAGEID #: 633
28

sentence in Paragraph 67. Fiserv denies that Defendants disclosed personal information regarding 

Plaintiffs and putative class members to any unauthorized party, particularly based on Plaintiffs’ 

continuing failure or refusal to identify a single unauthorized person to whom their personal 

information actually disclosed, and accordingly further denies that Plaintiffs and putative class 

members suffered any injury in fact as a result thereof. Fiserv denies any remaining allegations in 

Paragraph 67.

68. Plaintiffs and Class Members seek relief under Ohio Rev. Code § 3904.21, 

including but not limited to, actual damages, injunctive relief, and attorneys’ fees and costs.

ANSWER: Fiserv admits that Plaintiffs seek the relief asserted in Paragraph 68 but 

denies that Plaintiffs are entitled to such relief. Fiserv denies any remaining allegations in 

Paragraph 68.

Count IV

25 Declaratory Relief

28 U.S.C. § 2201

69. Plaintiffs repeat and re-allege the allegations of all Paragraphs as if fully 

incorporated and set forth herein.

ANSWER: Fiserv repeats and re-alleges all of its answers of the preceding Paragraphs 

as if fully incorporated and set forth herein.

70. An actual controversy has arisen and now exists between Plaintiffs and the putative 

Class on the one hand, and Defendants on the other, concerning Defendants’ failure to protect 

Plaintiffs’ and Class Members’ PHI in accordance with applicable state and federal regulations 

and the agreements between the parties. Plaintiffs and the Class Members contend that Defendants 

failed to maintain adequate and reasonable privacy practices to protect their PHI while on the other 

hand, Defendants contends they have complied with applicable state and federal regulations and 

its agreements with Plaintiffs and Class Members to protect their PHI.

ANSWER: Fiserv denies that Plaintiffs have alleged an actual controversy to support 

declaratory relief that purportedly is independent of the other claims they seek to pursue. Fiserv 

admits that Plaintiffs purport to contend the allegations in the second sentence of Paragraph 70. 

Case: 2:18-cv-00238-EAS-CMV Doc #: 79 Filed: 03/29/19 Page: 28 of 32 PAGEID #: 634
29

Fiserv further admits that each Defendant contends it has complied with applicable state and 

federal regulations. Fiserv denies the remaining allegations in Paragraph 70.

71. Accordingly, Plaintiffs and Class Members are entitled to and seek a judicial 

determination of whether Defendants have performed, and are performing, the medical privacy 

practices and obligations necessary to protect and safeguard Plaintiffs’ and Class Members’ PHI 

from further unauthorized access, use and disclosure or insecure disposal.

ANSWER: Fiserv denies that Plaintiffs are entitled to seek declaratory relief 

independent of the other claims they seek to pursue. Fiserv denies the remaining allegations in 

Paragraph 71.

72. A judicial determination of the rights and responsibilities of the parties over 

Defendants’ medical privacy practices is necessary and appropriate at this time so that: (a) the 

rights of the Plaintiffs and the Class may be determined with certainty for purposes of resolving 

this action; and (b) so that the parties will have an understanding of Defendants’ obligations in the 

future given their continuing legal obligations and ongoing relationship with Plaintiffs and Class 

Members.9

ANSWER: Fiserv denies that a judicial determination of the rights and responsibilities 

of the parties over Defendants’ medical privacy practices is necessary and appropriate at this time. 

Fiserv admits that Plaintiffs purportedly seek to reassert claims previously dismissed by this Court, 

but denies that Plaintiffs are entitled to such relief under those claims. Fiserv denies any remaining

allegations in Paragraph 72.

 9 In their previous complaints, Plaintiffs asserted claims for violation of the Fair Credit Reporting 

Act, breach of confidentiality, breach of fiduciary duty, negligence, negligence per se, breach of 

contract, invasion of privacy, and intentional infliction of emotional distress. The Court dismissed 

these claims. Plaintiffs reassert these claims here, and incorporate their previous complaints, only 

to the extent necessary to preserve these claims for appeal. See Hayward v. Cleveland Clinic 

Found., 759 F.3d 601, 616–18 (6th Cir. 2014) (holding that a plaintiff generally need not replead 

dismissed claims to preserve them for appeal).

Case: 2:18-cv-00238-EAS-CMV Doc #: 79 Filed: 03/29/19 Page: 29 of 32 PAGEID #: 635
30

AFFIRMATIVE DEFENSES

Fiserv asserts the following affirmative defenses in response to the Consolidated Amended 

Complaint. By pleading these affirmative defenses, Fiserv does not assume the burden of proving 

any fact, issue, or element of a claim or defense where such burden properly belongs to Plaintiffs.

1. The Consolidated Amended Complaint fails to state a claim upon which relief can 

be granted.

2. Fiserv, Inc. is not a proper party to this action.

3. To the extent that the requirements under 28 U.S.C. § 1391 are not satisfied, venue 

is improper in this action.

4. This action may not be maintained as a class action because the requirements of 

Rule 23 of the Federal Rules of Civil Procedure are not met in this case.

5. Plaintiffs’ claims are barred or limited to the extent Plaintiffs have failed to mitigate 

any damages they allege they suffered.

6. To the extent that Plaintiffs have consented to the mailings at issue, Plaintiffs’ 

claims may be barred in whole or in part by the doctrines of consent and acquiescence, waiver, 

and estoppel.

7. To the extent that another party is responsible for all or part of Plaintiffs’ alleged 

damages, if any, Plaintiffs are barred from recovering from Fiserv, in whole or in part.

8. Plaintiffs are barred from recovering any relief sought in the Consolidated 

Amended Complaint to the extent that Fiserv’s alleged conduct was not the actual and proximate 

cause for Plaintiffs’ alleged damages, if any.

9. Plaintiffs are barred from recovering any relief sought in the Consolidated 

Amended Complaint to the extent that they have not suffered any legally cognizable damages.

Case: 2:18-cv-00238-EAS-CMV Doc #: 79 Filed: 03/29/19 Page: 30 of 32 PAGEID #: 636
31

10. Without conceding that this is a proper class action, and without conceding that any 

putative class member is similarly situated to Plaintiffs, and reserving all defenses thereto, Fiserv 

reasserts each and every defense set forth within with respect to each and every putative class 

member whom Plaintiffs contend are covered by and/or entitled to relief in this action.

RESERVATION OF RIGHTS

Fiserv reserves the right to amend and/or supplement this Answer, including, without

limitation, to assert additional defenses (statutory or in common law), as may be supported by 

evidence adduced during the investigation and discovery for this matter.

JURY DEMAND

Fiserv hereby requests a trial by jury on all triable claims.

PRAYER FOR RELIEF

WHEREFORE, Fiserv respectfully requests that this Court deny the relief requested in the 

Consolidated Amended Complaint, enter judgment in favor of Fiserv, award reasonable costs and 

attorneys’ fees to Fiserv to the extent permitted by law, and grant Fiserv such other and further 

relief as the Court deems just and proper.

Case: 2:18-cv-00238-EAS-CMV Doc #: 79 Filed: 03/29/19 Page: 31 of 32 PAGEID #: 637
32

Dated: March 29, 2019

Respectfully submitted,

/s/ John H. Mathias, Jr.

James B. Hadden (0059315), Trial Attorney

Murray Murphy Moul + Basil LLP

1114 Dublin Road

Columbus, OH 43215

Telephone: 614.488.0400

Facsimile: 614.488.0401

E-mail: hadden@mmmb.com

John H. Mathias, Jr. (admitted pro hac vice)

David M. Kroeger (admitted pro hac vice)

Megan B. Poetzel (admitted pro hac vice)

Jenner & Block

353 N. Clark Street

Chicago, IL 60654

Telephone: 312.222.9350

Facsimile: 312.527.0484

E-mail:jmathias@jenner.com

dkroeger@jenner.com

mpoetzel@jenner.com

Counsel for Defendants Fiserv, Inc. and Fiserv 

Solutions, LLC

Case: 2:18-cv-00238-EAS-CMV Doc #: 79 Filed: 03/29/19 Page: 32 of 32 PAGEID #: 638