HIPAA Risk Analysis Archives

What are the Identified Risks in Healthcare Data Breaches?

Suze Shaffer October 29, 2026November 2, 2026

Vendor Risk Is the New Front Line

Healthcare organizations continue to report substantial data breaches in 2026. Hacking and IT incidents dominate reports to the HHS Office for Civil Rights (OCR). Large breach reports have eased slightly compared with 2025. However, third-party vendors and business associates continue to concentrate risk across healthcare.

The Healthcare Breach Landscape

During the first half of 2026, organizations reported 397 large healthcare breaches to OCR. These incidents affected approximately 33.8 million individuals. Although those figures declined from the previous year’s first half, they still represent substantial exposure.

Business associates played a role in approximately 43% of large breach reports. Hacking and IT incidents accounted for most cases. Several incidents illustrate how vendors, applications, and shared technology can expose patient information.

Notable 2026 examples illustrate the pattern:

DentaQuest

A May 2026 cyber incident affected approximately 15 million individuals connected to DentaQuest, a Sun Life subsidiary. The ShinyHunters extortion group claimed responsibility for the incident. The compromised information included names, addresses, Social Security numbers, and Medicare or Medicaid identifiers. It also included dental or vision information, such as diagnoses, treatment details, and billing records. DentaQuest began notifying individuals in July after the group reportedly leaked data following failed negotiations.

iRhythm Technologies

A June 2026 incident affected approximately 8.18 million people connected to iRhythm Technologies. Attackers used social engineering to access business applications hosted by third parties. The incident did not involve clinical systems or medical devices. The exposed information included names, contact details, birth dates, insurance numbers, account identifiers, serial numbers, and service dates. The company began notifications in October. At that time, it reported no evidence of identity theft.

Blueberry Pediatrics

An incident involving Blueberry Pediatrics affected approximately 341,000 individuals, including children. Attackers exploited a vulnerability in Metabase, a business intelligence and reporting tool. A related incident involving prescription partner Photon stemmed from the same vulnerability. The exposed information included names, birth dates, health plan details, and certain medical and billing information. Blueberry Pediatrics discovered the incident in August 2026 and began notifications in October.

Earlier Breaches Continue to Create Financial Consequences

Conduent’s 2024–2025 breach affected approximately 62.2 million individuals. The incident recently prompted an $80 million class-action settlement agreement.

Change Healthcare’s 2024 ransomware attack remains the largest reported healthcare breach, affecting approximately 192.7 million individuals.

These incidents show how one organization’s security failures can affect patients and healthcare partners nationwide.

OCR Continues to Prioritize Risk Analysis

OCR continues its Risk Analysis Initiative. Recent settlements repeatedly identify failures to conduct accurate and thorough risk analyses under the HIPAA Security Rule. The requirement appears at 45 CFR § 164.308(a)(1)(ii)(A). Several 2026 settlements highlight these recurring weaknesses.

Ambry Genetics

Ambry Genetics agreed to a $700,000 settlement following a phishing incident affecting approximately 225,000 people. OCR also identified concerns involving access termination and unique user identifiers.

OSF HealthCare System

OSF HealthCare System agreed to a $552,250 settlement involving a ransomware incident affecting approximately 54,000 individuals. OCR identified failures involving risk analysis, impermissible disclosures, and breach notification.

Spencer Gifts LLC

Spencer Gifts LLC agreed to a $450,000 settlement involving its employer-sponsored health plan after a ransomware attack. The case demonstrates that HIPAA obligations can extend beyond traditional healthcare providers.

Patient Access Still Drives Enforcement

OCR also continues its Right of Access Initiative. Shen Smiles, a Pennsylvania dental practice, agreed to a $140,000 settlement involving delayed patient access to records. OCR also identified related Privacy Rule deficiencies. The case reinforces a critical point: organizations can face HIPAA enforcement without experiencing a cyberattack.

What These Cases Mean for Healthcare Organizations

Vendor oversight requires ongoing attention.

Business associates, cloud applications, reporting tools, and billing partners create additional opportunities for unauthorized access. Identify which vendors create, receive, maintain, or transmit protected health information. Evaluate their safeguards and document your oversight. Address your organization’s HIPAA responsibilities when vendors handle patient information.

Risk analysis must reflect actual operations

An incomplete or outdated assessment can overlook significant threats. Include third-party applications, connected devices, remote access, and every location that stores or processes electronic protected health information. Evaluate phishing, social engineering, ransomware, and vendor vulnerabilities. Document identified risks, assign responsibility, and track corrective actions.

Contracts and notification procedures need clear ownership

Business associate agreements should clearly define incident reporting duties and applicable responsibilities. Organizations must also understand their own patient and OCR notification obligations. Practice your response before an incident forces urgent decisions.

Financial consequences extend beyond regulatory settlements

Breaches can trigger class action lawsuits, state investigations, operational disruptions, and substantial recovery expenses. Organizations may also pay for forensic investigations, notifications, monitoring, and system restoration. Patient trust can take much longer to rebuild.

Five Actions to Take Now

Update your risk analysis. Include third-party systems, current threats, and changes in your operations.
Review high-risk vendors. Request meaningful evidence of security controls and evaluate how those safeguards protect your information.
Test your incident response procedures. Confirm reporting contacts, notification timelines, decision responsibilities, and procedures for vendor incidents.
Strengthen patient access procedures. Train staff to recognize requests, track deadlines, document responses, and escalate delays.
Review cyber insurance. Examine coverage limits, vendor-related incidents, exclusions, and policy conditions with your insurance professional.

Attackers exploit weaknesses throughout the healthcare ecosystem. OCR continues to evaluate organizations against core HIPAA requirements.

Organizations that treat risk analysis, vendor management, and incident response as continuous disciplines, not annual checkboxes, will be better positioned as these trends evolve.

This article is for informational purposes only and does not constitute legal advice. Organizations should consult qualified counsel regarding specific compliance obligations.

When was the last time your organization updated its HIPAA security risk analysis?

Aris Medical Solutions can help you identify compliance gaps and prevent costly data breaches.

Schedule your HIPAA compliance review today and protect your organization from the next enforcement headline.

Your Trusted Partner for HIPAA Compliance since 2009

NIST OCR conference highlights

Suze Shaffer September 4, 2026

HIPAA Risk Analysis Is More Than a Checklist

The message from the NIST OCR conference was clear: a HIPAA risk analysis is not a checklist. It must be comprehensive, accurate, and specific to your organization. Once a thorough and accurate risk analysis is completed, then the mitigation process must be documented. Again, not simply a checklist.

Where is ePHI?

The risk analysis must identify every location where electronic protected health information (ePHI) is created, received, maintained, or transmitted. This includes EHR systems, email, mobile devices, cloud applications, medical equipment, patient portals, billing platforms, databases, websites, backups, and third-party vendors.

Medical practices must map how ePHI flows into, throughout, and outside their systems. This data-flow mapping helps identify unauthorized access, transmission, storage, and disclosure risks that a simple checklist may overlook.

Risk Management

Identifying vulnerabilities is only the beginning. The practice must maintain a documented risk management plan that:

Prioritizes identified risks
Lists the corrective actions taken
Assigns responsibility
Establishes completion dates
Demonstrates how each vulnerability was mitigated
Documents any remaining risk the organization accepts

What is NOT a Risk Analysis?

Several security assessments can support the process, but they do not replace an SRA:

A penetration test is useful, but it is not an SRA.
A vulnerability scan is useful, but it is not an SRA.
A gap analysis is helpful, but it is not an SRA.
Completing the HHS SRA Tool does not create a compliant risk analysis if questions are unanswered or marked “Don’t Know.”

Another common problem is leaving the physical safeguards section incomplete. An SRA must evaluate administrative, physical, and technical safeguards and not just cybersecurity controls.

Integrating AI

Before adding an AI tool to a medical practice, the organization should complete the proper privacy, security, and compliance review. Determine whether the AI vendor will access, store, or transmit ePHI. Understand where the data is stored and whether it is used to train AI models. Update the organization’s risk analysis and data-flow map. Establish user access controls, authentication, encryption, and audit logging. Whether ePHI will be shared with third party vendors. Create policies for appropriate AI use and human review. Once this is outlined, then the organization must:

Develop procedures for errors, security incidents, and potential breaches
Train employees on privacy risks and prohibited uses
Obtain a Business Associate Agreement
Address patient consent and state-law requirements when applicable

AI can improve efficiency, but it should not be integrated until the practice understands how patient information will be handled and has documented safeguards in place.

Breach Notification

The breach notification clock starts when the breach is discovered, not when the investigation is completed. An organization should not delay the required notification solely because the final number of affected individuals is unknown. File the initial breach report within the applicable deadline using the best information available, and submit an addendum when the investigation confirms the affected-record count or provides additional details. Be sure to follow state law requirement if they are more stringent.

FTC and HIPAA

The FTC does not enforce HIPAA. That responsibility belongs to HHS’s Office for Civil Rights (OCR). However, the FTC can intervene when a healthcare organization’s conduct involves an unfair or deceptive business practice under the FTC Act. A provider could face FTC scrutiny if it misrepresents how patient information is protected. For example, the practice has a “Seal of HIPAA Compliance” on their website and fails to use reasonable security safeguards. The use of online trackers may be sharing health information with advertising or tracking companies contrary to their privacy promises. Therefore, HIPAA compliance does not automatically protect an organization from FTC enforcement. The FTC’s separate Health Breach Notification Rule (HBNR) generally applies to health apps, personal health-record vendors, and related businesses that are not regulated by HIPAA; in some situations, an organization with both HIPAA-regulated and consumer-facing operations may have obligations under both regulatory frameworks.

Summary

The NIST OCR conference clarified the HIPAA compliance requirements. It is crystal clear that more enforcement in on the way due to the increased data breach activity and the lack of documented compliance efforts. They even specifically mentioned that even small providers are required to implement reasonable and appropriate safeguards. No provider is immune from investigations and enforcement.

Protect Your Organization and Your Patients Before It’s Too Late

At Aris Medical Solutions, our HIPAA Keeper™ cloud-based platform makes HIPAA compliance simple. It guides your organization through every requirement with a clear, step-by-step process. From risk analyses and policies to employee training and required documentation, you’ll have everything needed to remain compliant, protected, and audit-ready. Best of all, your HIPAA Compliance Officer is never on their own. Every client has access to a Certified HIPAA Security Analyst who provides expert guidance, answers questions, and helps ensure your compliance program is implemented correctly.

Schedule a free HIPAA checkup today at Aris Medical Solutions.

HIPAA Risk Analysis Requirements

Suze Shaffer November 1, 2023November 1, 2023

Nefarious characters see healthcare organizations as high value yet relatively easy targets. These are referred to as target rich, cyber poor.  Given that healthcare organizations have a combination of personally identifiable information, financial information, health records, and countless medical devices, they are essentially a one-stop shop for a bad actor. Understanding the HIPAA risk analysis requirements can help save your organization from these criminals.

There has been a significant rise in the number and severity of cyber-attacks against hospitals and medical practices in the last few years. These attacks expose vulnerabilities and endanger patient safety. The more they happen, the more expensive, and dangerous they become.

Although the HIPAA Security Rule does not specify how often a risk analysis must be conducted, it is recommended to review your systems at least once a year. Keep in mind if you introduce new equipment, software, or suffer a security incident, you may need to evaluate your risks more often.

If you need a HIPAA Security Risk Analysis, check out our:

The OCR conducted a webinar regarding Risk Analysis Requirements and discussed the areas that are deficient.

The OCR mentioned the following:

The lack of a system wide accurate and thorough analysis. (Step 1 Questionnaire)
Performing only the MIPS risk analysis does not encompass the system wide requirements.
PCI/DSS is more than likely not a complete risk assessment since it does not include ePHI.
Instead of a system wide accurate and thorough risk assessment, a summary or heat map is provided without the backup documentation.
Lack of inventory list to track which devices access, transmit, or store ePHI. (Located in the Profile)
No method to track operating systems that become out of date. (Documented in the inventory list)
Lack of mitigation documentation after the risk analysis was completed. (Step 1 Risk Management Plan)
Lack of sanctions against staff who violate HIPAA. (Step 3 Policies and Procedures)
Lack of security software / equipment updates. (Documented in reports from your IT company and stored in the Profile under Uploads)

Let’s all work together to keep patient data safe and secure. If you need assistance with HIPAA Compliance, check out our HIPAA Keeper™. It’s an online compliance system that has everything you need to get compliant and stay compliant. Best of all you will have a HIPAA security analyst to guide you every step of the way!

“Simplifying HIPAA through Automation, Education, and Support”

Data Breaches in Healthcare are Increasing

Suze Shaffer August 1, 2022July 15, 2025

Since 2015 the number of data breaches in healthcare has steadily been rising. This includes medical offices, health plans, and business associates. These breaches range from unauthorized access, loss, theft, but mostly from hacking. Hacking was determined to be from emails, network servers, desktop computers, to electronic medical records. No office is immune. Starting with a system wide HIPAA risk analysis is the first step in protecting your data. Modern technology helps us in many ways, but it is ever so important to keep up with data security. Many medical offices think once their office is set up, they are set for life or at least “a while”. Technology is growing faster and faster, and you must be diligent to keep up. This is not a do-it-yourself job anymore!

Let’s look at some of the numbers from the data breaches over 500 patient records that were reported:

From January – July 2022 there have been 380 breaches reported.

In 2021 there are 457 still being investigated and 258 that have been archived, that is a total of 715 reported.

In 2020 there are 63 still being investigated and 601 that have been archived, totaling 663.

In 2019 there were 512 reported breaches.

In 2018 there were 368.

In 2017 there were 357.

In 2016 there were 329.

In 2015 there were 270.

I think it is important to note that the number of breaches are increasing each year. Now more than ever anyone involved in healthcare must approach HIPAA compliance and data security as necessary as having insurance to protect your organization. Instead of being reactive to “when” this happens, being proactive can help this “from” happening.

To find out more about how our online HIPAA Keeper™ can help your organization with HIPAA Compliance click here:

https://arismedicalsolutions.com/aris-hipaa-compliance-system-for-medical-offices/

Or to schedule a demo click the contact us tab and scroll down.

“Simplifying HIPAA through Automation, Education, and Support”