Triple-S Management Corporation, a Puerto Rican insurance company, reports that the Puerto Rico Health Insurance Administration will impose a $6.8 million penalty stemming from the company’s subsidiary, Triple-S Salud, Inc. (TSS), violation of privacy and security rules under the Health Insurance Portability and Accountability Act of 1996 (HIPAA).
In September 2013, TSS mailed pamphlets to 70,000 Medicare Advantage customers inadvertently containing protected health information of over 13,000 Dual Eligible Medicare beneficiaries.
In addition to the monetary penalty, Triple-S faces other administrative sanctions, including the suspension of all new enrollments of Dual Eligible Medicare beneficiaries and the obligation to notify patients affected by the breach of their right to disenrollment.
This case could put pressure on the U.S. Department of Health and Human Services (HHS) to take a more aggressive approach to enforcement of HIPAA breaches. HHS has only imposed civil monetary penalties on one instance, a 2011 case involving $4.3 million in penalties.
