PRHHS OCRFirst filing
Filed May 18, 2014bd_bd5ff92a5f2b427e
American Health Inc. (a subsidiary of Triple-S Management Corporation, San Juan, PR) reported to HHS OCR on 2014-05-18 an Unauthorized Access/Disclosure breach affecting 11,531 individuals. Breached information was located on Paper/Films. OCR investigations revealed widespread HIPAA non-compliance: impermissible PHI disclosure to a vendor lacking a BAA, excess PHI used in mailings, and inadequate safeguards and risk analysis. Triple-S settled with OCR for $3.5 million and adopted a comprehensive corrective action plan.
Affected (this filing): 11,531
HHS notified