My partner Bill Maruca was quoted in Jeff Overley’s article “Historic HIPAA Fine Will Push Feds To Get Tougher” published in Law360 on Friday, February 20, 2014.   The article reports on the nearly $7 million fine imposed by the Puerto Rico Health Insurance Administration on a contractor, health plan Triple-S Salud Inc. (“Triple-S”).  Bill’s quote sums it up:  “This is a shocking fine, given the circumstances.”  The breach affected roughly 13,000 individuals eligible for both Medicare and Medicaid (“dual eligibles”), but what were the circumstances that made this fine so large as to be shocking to my esteemed colleague and other observers? 

Here’s my take.  First, the fine was imposed by Puerto Rico, not the Office of Civil Rights (“OCR”) within the Department of Health and Human Services (“HHS”), which is the federal agency generally associated with penalties for breaches involving protected health information (“PHI”), and is significantly higher than fines that have been reported by OCR as having been levied for breaches affecting many more individuals than the 13,000 affected here.  OCR has created training tools for state attorneys general and states that it “welcomes” collaborations with state attorneys general seeking to bring civil actions to enforce HIPAA, but no state has imposed such a large penalty for a HIPAA violation, either on its own or in collaboration with OCR. 

Second, the breach was not the result of a sophisticated hacking incident or careless laptop loss or theft capable of exposing thousands of individuals’ information in a single view.  Here, the breach resulted from Triple-S’s inclusion of individual Medicare health insurance claim numbers in plain sight on mailings addressed to the individuals.  This PHI would only have been viewed by those delivering or otherwise physically handling the mail addressed to the individuals, thereby subjecting the PHI to a relatively limited scope of potential viewers (presumably, the postal service and anyone retrieving a specific individual’s mail, with or without permission).    

Finally, while the disclosure of an individual’s Medicare health insurance claim number is a disclosure of PHI (and potentially might be used in an attempt to improperly claim health care benefits), it is not the type of PHI that most people are likely to consider sensitive and private.

More information about Triple-S and this incident (and perhaps past incidents involving HIPAA violations, such as the 2010 incident reported to HHS) is likely to surface in the coming weeks and months.