Vendors and business associates increasingly expose healthcare organizations to cybersecurity threats. Meanwhile, OCR continues to focus on familiar compliance failures. Healthcare data breaches continue at a rapid pace in 2026. Hacking and IT incidents dominate reports to the HHS Office for Civil Rights (OCR). Large breaches affect 500 or more individuals. Reports of these breaches have declined slightly from 2025’s record, but third-party risks have intensified.
The Landscape So Far
Organizations reported 397 large healthcare breaches to OCR during the first half of 2026. Those breaches affected approximately 33.8 million individuals, fewer than during the same period last year. Business associates played a role in approximately 43% of those reports, exceeding historical averages. Hacking and IT incidents accounted for most cases.
Several 2026 incidents illustrate these risks.
DentaQuest – A May cyber incident affected approximately 15 million individuals at DentaQuest, a Sun Life subsidiary. The ShinyHunters extortion group claimed responsibility. Attackers stole names, addresses, Social Security numbers, and Medicaid or Medicare identifiers. They also obtained dental or vision information, including diagnoses, treatment details, and billing records. DentaQuest began notifications in July after the group leaked information following failed negotiations.
iRhythm Technologies – A June incident affected approximately 8.18 million people. Attackers used social engineering to access business applications that a third party hosted. The incident did not involve clinical systems or medical devices. Exposed information included names, contact details, birth dates, insurance numbers, account or serial numbers, and service dates. The company began notifications in October. At that time, iRhythm reported no evidence of identity theft.
Blueberry Pediatrics – Attackers exploited a vulnerability in Metabase, a business intelligence and reporting tool. The incident affected approximately 341,000 individuals, including children. A related incident involving prescription partner Photon involved the same vulnerability. Exposed information included names, birth dates, health-plan details, and certain medical and billing information. Blueberry Pediatrics discovered the incident in August and began notifications in October.
Earlier Breaches Continue to Carry Consequences
Conduent’s 2024–2025 breach affected approximately 62.2 million records, making it the third-largest reported incident. The incident recently prompted an $80 million class-action settlement agreement.
Change Healthcare’s 2024 ransomware attack remains the largest reported healthcare breach, affecting approximately 192.7 million individuals.
Enforcement Priorities Remain Consistent
OCR continues its Risk Analysis Initiative. Nearly every recent settlement identifies failures involving an accurate and thorough risk analysis. The HIPAA Security Rule establishes this requirement under 45 CFR § 164.308(a)(1)(ii)(A).
Several 2026 settlements illustrate OCR’s priorities.
Ambry Genetics agreed to a $700,000 settlement following a phishing incident affecting approximately 225,000 people. OCR also identified concerns involving access termination and unique user identifiers.
OSF Healthcare System agreed to a $552,250 settlement involving a ransomware incident affecting approximately 54,000 individuals. OCR identified potential violations involving risk analysis, impermissible disclosures, and breach notifications.
Spencer Gifts agreed to a $450,000 settlement involving its employer-sponsored health plan following a ransomware attack. The case demonstrates that HIPAA obligations can extend beyond traditional healthcare providers.
Patient Access Still Drives Enforcement
OCR also continues its Right of Access Initiative. A recent $140,000 settlement with Pennsylvania dental practice Shen Smiles addressed delayed patient access and related Privacy Rule concerns. The case reinforces that organizations can face enforcement without experiencing a cyberattack.
What These Trends Mean for Organizations
Vendors expand your exposure. Business associates, software platforms, reporting tools, and revenue-cycle partners create additional opportunities for attackers. Healthcare organizations must address vendor relationships within their HIPAA compliance programs.
Risk analysis supports effective security.
OCR repeatedly identifies incomplete or outdated risk analyses during breach investigations. Organizations should document risks across their operations and update their analyses as threats and systems change. Analyses should address phishing, social engineering, third-party applications, and ransomware.
Notifications and contracts require attention.
Enforcement findings frequently address delayed notifications to affected individuals and OCR. Clear business associate agreements help establish reporting duties and other responsibilities. Organizations should understand these obligations before an incident occurs.
Financial consequences extend beyond regulatory payments.
Organizations may also face class actions, state enforcement, forensic investigations, notification expenses, and credit-monitoring costs. Operational disruptions and lost patient trust can increase the damage.
Actionable Steps
- Update your organization-wide risk analysis to address third-party systems and current threats.
- Inventory vendors and prioritize those with significant access to sensitive information.
- Request evidence of vendor security controls and verify their effectiveness where appropriate.
- Test incident response procedures, including notification timelines and decisions involving third-party incidents.
- Document patient record requests and confirm that staff consistently follow access procedures.
- Review cybersecurity insurance coverage, including exclusions involving vendor incidents.
OCR Continues to Examine Core Safeguards
Attackers exploit weaknesses across healthcare organizations and their vendors. OCR continues to examine how organizations implement core HIPAA Security Rule requirements. Treat risk analysis, vendor oversight, and incident response as ongoing responsibilities. Regular reviews and documented improvements help organizations respond as threats evolve.
When was the last time your organization reviewed your Business Associates?
HIPAA compliance isn’t a one-time project; it’s an ongoing process. At Aris Medical Solutions, our HIPAA Keeper™ system simplifies compliance with a cloud-based platform that walks you through each requirement, step by step. From risk analyses, risk management, policies to employee training, and required documentation, you’ll have everything needed to remain compliant.
Schedule your HIPAA compliance review today and protect your organization from the next enforcement headline.
Your Trusted Partner for HIPAA Compliance since 2009
