Triple-S Salud, Inc.

Triple-S Management Corporation, on behalf of its subsidiaries including Triple-S Salud Inc., agreed to a $3.5 million settlement with the U.S. Department of Health and Human Services, Office for Civil Rights (OCR) for potential HIPAA violations. Following multiple breach notifications, OCR investigations found widespread non-compliance, including failure to implement proper safeguards, impermissible disclosure of PHI to a vendor without a business associate agreement, disclosing more PHI than necessary, and failure to conduct a thorough risk analysis. The settlement requires a comprehensive corrective action plan to address these deficiencies.

Affected (this filing): 398,000