PRHHS OCRFirst filing
Filed Apr 3, 2014bd_e5dce1934612be45
American Health Inc. (a subsidiary of Triple-S Management Corporation, San Juan, PR) reported to HHS OCR on 2014-04-03 a Theft breach affecting 17,776 individuals, with breached PHI located on 'Other' media. OCR investigated multiple breach notifications from Triple-S subsidiaries, finding widespread HIPAA non-compliance including impermissible PHI disclosures to a vendor without a BA agreement, excess PHI use in mailings, and inadequate ePHI risk analysis. Triple-S settled for $3.5 million and adopted a Corrective Action Plan.
Affected (this filing): 17,776
HHS notified