"Since 2010, these companies have reported five major breaches and two minor ones. Five of the reported breaches involved mailing errors.... Former employees of Triple-S and its business associates also were a recurring problem ... The $3.5 million resolution amount is the highest OCR has levied on a single entity by settlement."