Triple-S Management Corporation, a Puerto Rico-based health insurance provider, has reached a settlement with the Department of Health and Human Services (HHS) over alleged violations of the Health Insurance Portability and Accountability Act (HIPAA).  Over the past five years, three subsidiaries of Triple-S have filed seven reports of data breaches with HHS, leading the agency to conduct investigations into Triple-S’s compliance with HIPAA’s Privacy, Security, and Breach Notification Rules. The company has agreed to pay $3.5 million to HHS and institute a corrective action plan involving risk assessments and updating the company’s privacy policies.