Puerto Rico Department of Health - Triple S Management

On November 5, 2010, the Puerto Rico Department of Health (DOH), a hybrid entity, reported on behalf of the covered entity (CE), Puerto Rico Health Insurance Administration, also known as the Administracion de Seguros Salud de Puerto Rico, that it discovered that two former staff members of the business associates (BAs) Triple-S Salud (TSS) and Triple-C, improperly accessed restricted areas of TSS’ proprietary internet IPA database managed by Triple-C, Inc. The staff members, who were employed by a competitor, were able to gain access to the database because their access rights were not terminated upon leaving the employment of TSS. As a result, the electronic protected health information in the database, including 400,000 of the CE’s members’ names, contract numbers, home addresses, diagnostic codes, and treatment codes, was accessed. DOH provided breach notification to HHS, and TSS provided breach notification to affected individuals, and the media. Due to OCR’s investigation, the CE committed to conduct a risk analysis, implement a risk management plan, revise its policies and procedures, and retrain its staff within a specified period.