Triple S Salud Inc.

On November 8, 2013, the covered entity (CE), Puerto Rico Health Insurance Administration, also known as the Administracion de Seguros Salud de Puerto Rico reported to HHS that on September 23, 2013, they became aware that a vendor doing business with its business associate (BA), Triple-S Salud, disclosed protected health information (PHI) on the outside of a pamphlet mailed to beneficiaries on September 20, 2013. The PHI disclosed in the breach included the names, mailing addresses, and the health insurance claim numbers of 13,336 of the CE’s members. The CE and BA each provided breach notification to affected individuals and the CE provided breach notification to the media. As a result of OCR’s investigation, the CE committed to conduct a risk analysis, implement a risk management plan, revise its policies and procedures, and retrain its staff within a specified time.