 OhDAP was initially established in 1990 under the Ryan White HIV/AIDS  Treatment Extension Act, 42 U.S.C. §§ 300ff, et seq. This federal legislation has been renewed  four times -- 1996, 2000, 2006 and 2009 -- and is now called the Ryan White Program within  Ohio and nationwide.     There are three main components within OhDAP. One component is for direct  drug provision for eligible uninsured individuals (i.e., individuals with HIV who are not eligible  for Medicaid due to income level or citizenship status). Another component is used to provide  premium assistance to eligible individuals (i.e., ACA, Medicare Part D, private health insurance  Case: 2:18-cv-00238-EAS-CMV Doc #: 1 Filed: 03/21/18 Page: 5 of 17  PAGEID #: 5 - 5 -  or the employee copayment or coinsurance portion of employer-based insurance). The last  component assists insured individuals with their co-pays for their life-saving HIV specialty  medications.     In March 2017, the Ohio Department of Health awarded an exclusive contract for  pharmaceutical provision services for OhDAP to CVS, effective July 2017. Under that contract,  CVS is to provide OhDAP-eligible clients with HIV medications and is responsible for  communications with participants relating to such medications.    Beginning in approximately late July or early August 2017, Defendants mailed a  letter containing membership cards and information about the CVS program and how persons  would access their HIV-related prescriptions. This letter was mailed to an estimated 6,000  participants in OhDAP, regardless of whether they were active pharmacy customers of CVS.    Even though the information contained in this letter contained the Personal Health  Information (“PHI”) of each individual, specifically information relating to their HIV-positive  status, the envelopes containing these mailings had two clear glassine windows. One, in the  upper left, contained the logo of “CVS/caremark,” the words “Ohio Department of Health,” and  an address for the Ohio Department of Health, and the envelope refers in big red letters to “new  prescription benefits,” thereby revealing that the mailing involved health-related information,  including information about prescription medications. A second window contained the  recipient’s name and address, with the designation “PM 6402 HIV” directly above the person’s  name. This reference to the recipient’s HIV status was plainly visible through the glassine  window. The designation “HIV” in the program identification number was not required by the  Ohio Department of Health, but rather was created by CVS. Defendants clearly made no advance  effort to test or review the disclosure of such information prior to disseminating the mailing,  Case: 2:18-cv-00238-EAS-CMV Doc #: 1 Filed: 03/21/18 Page: 6 of 17  PAGEID #: 6 - 6 -  since had they done so they would have seen that the identification number with “HIV” next to it  was prominently visible through the envelope, as shown by the following:    The Defendants’ combined use of a glassine windowed envelope, their design of  the letter containing the HIV status of the individual recipient such that it could be seen through  the envelope window instead of using an opaque envelope or a letter that was properly spaced  not to publicly reveal such information through the envelope window, and an identification  reference with the term “HIV,” resulted in the potential or actual disclosure of recipients’ HIV  status to numerous individuals, including their families, friends, roommates, landlords,  neighbors, mail carriers, and complete strangers.    The use of envelopes with transparent windows contravenes the standard practice  of the Ohio Department of Health, which is to send all mailings relating to HIV-related issues in  opaque, non-windowed envelopes.     Defendants either knew or reasonably should have known that this mailing was  disseminated in violation of both federal and state laws. Defendants also acted with a conscious  disregard for the rights and safety of other persons that has a great probability of causing  Case: 2:18-cv-00238-EAS-CMV Doc #: 1 Filed: 03/21/18 Page: 7 of 17  PAGEID #: 7 - 7 -  substantial harm. Defendants knew that it is unlawful and likely harmful to disclose patients’  HIV status to the public, and that any persons whose PHI was disclosed were to be separately  notified of that breach. CVS’s “Notice of Privacy Practices” states, “We are required by law to  protect the privacy of your PHI and to provide you with this Notice explaining our legal duties  and privacy practices regarding your [Protected Health Information]…. You have a right to be  notified in the event there is a breach of your unsecured PHI as defined by HIPAA.”  https://www.cvs.com/content/patient-privacy (accessed March 14, 2018). Fiserv advertises its  compliance as well: “From enrollment to payment, let Fiserv help you create, maintain and grow  member engagement while adhering to the strongest risk and compliance standards, including   This action is brought by the Plaintiffs both on behalf of themselves and on behalf  of all other similarly situated persons pursuant to Rule 23 of the Federal Rules of Civil  Procedure. The Plaintiffs seek to represent the following class (“Class”):   All participants in OhDAP to whom Defendants sent a mailing in or about July or  August 2017 in which the participant’s name and the letters “HIV” were visible  through the envelope window.    The precise number and identity of Class members are unknown to the Plaintiffs  but can be obtained from the records of Defendants. News reports have estimated the recipients  of the mailings to be more than 6,000 persons.    Common questions of law and fact predominate over any questions affecting  individual members of the Class. Such common legal and factual questions include the  following:  (a)  Whether Defendants’ conduct was tortious and violated the applicable  standard of care;  Case: 2:18-cv-00238-EAS-CMV Doc #: 1 Filed: 03/21/18 Page: 11 of 17  PAGEID #: 11 - 11 -  (b)  Whether Defendants’ conduct was unlawful, including in violation of the  state and federal statutes and regulations cited above;  (c)  Whether the Class members are entitled to damages and the extent of  those damages; and  (d)  Whether the Class members are entitled to injunctive or declaratory relief.    The Plaintiffs’ claims are typical of the claims of the Class members because  similar mailings to those identified above were sent to Plaintiffs and every Class member.    The Plaintiffs are willing and prepared to serve the Court and the proposed Class  in a representative capacity. The Plaintiffs will fairly and adequately represent and protect the  interests of the Class and have no interests adverse or antagonistic to or that materially and  irreconcilably conflict with the interests of the other members of the Class. Based on the facts  detailed above, the interests of the Plaintiffs are reasonably coextensive with those of absent  Class members.    The Plaintiffs have engaged the services of counsel who are experienced in  complex class litigation and the issues raised in this Complaint who will vigorously prosecute  this action, and who will assert and protect the rights of and otherwise adequately represent the  rights of the Plaintiffs and absent Class members.    Prosecuting separate actions by individual Class members would create a risk of  inconsistent or varying adjudications with respect to individual Class members that would  establish incompatible standards of conduct for Defendants.    By sending similar mailings to thousands of people and later refusing to send  notification thereof Defendants have acted or refused to act on grounds generally applicable to  Case: 2:18-cv-00238-EAS-CMV Doc #: 1 Filed: 03/21/18 Page: 12 of 17  PAGEID #: 12 - 12 -  the Class, thereby making injunctive and declaratory relief appropriate respecting the Class as a  whole.    Because all Class members are seeking the same relief based on the same course  of conduct by Defendants, the questions of law or fact common to Class members as set forth in  this Complaint predominate over any questions affecting only individual members. Thus, a class  action is superior to other available group-wide methods for fairly and efficiently adjudicating  this controversy, to the extent necessary in order to maintain this action on behalf of the Class.    Damages need not be proven for each Class member because Ohio law permits  the award of damages without individualized proof of the extent of emotional distress. But even  if damages must be proven individually, the Class can be certified for purposes of determining  whether the actions of Defendants were tortious and violated applicable Ohio law. 