Triple-S Management Corp., an insurance holding company based in San Juan, Puerto Rico, has agreed to settle an investigation of HIPAA violations by the Office for Civil Rights (OCR) for $3.5 million. According to the OCR press release dated November 30, Triple-S, formerly known as American Health Medicare Inc., will pay the fine and “adopt a robust corrective action plan to correct deficiencies in its HIPAA compliance program…”
OCR started an investigation “after receiving multiple breach notifications…involving unsecured protected health information. The investigation “indicated widespread non-compliance throughout the various subsidiaries of Triple-S, including…impermissible disclosure of its beneficiaries’ PHI to an outside vendor with which it did not have an appropriate business associate agreement; use or disclosure of more PHI than was necessary to carry out mailings; failing to conduct an accurate and thorough risk analysis…and failure to implement…security measures…”
A series of self-reports revealed 7 different data breaches leading up to the investigation. The breaches ranged from failing to terminate access rights of previous employees, their vendor mailing brochures to members which included health claim numbers on the outside of the envelope, and an employee of a business associate downloading member information, including Social Security numbers onto a CD, took it home and then downloaded onto his new employer’s system, mailing the wrong medical ID cards to the wrong members, and putting the wrong member’s letter into another member’s envelope.
In addition to the fine, Triple-S has agreed to enter into a Resolution Agreement, which is typical of settlements with the OCR, including conducting a risk assessment and developing a risk management plan, implement and distribute policies and procedures, and train employees annually.
The OCR fines are always a teaching moment for covered entities and business associates. One of the lessons in this case is to evaluate whether business associate agreements are in place with each entity that has access to PHI of the organization.
[View source.]
