Third party vendors Archives

Are your Vendors Putting your Practice at Risk?

Suze Shaffer November 3, 2026November 3, 2026

Vendors and business associates increasingly expose healthcare organizations to cybersecurity threats. Meanwhile, OCR continues to focus on familiar compliance failures. Healthcare data breaches continue at a rapid pace in 2026. Hacking and IT incidents dominate reports to the HHS Office for Civil Rights (OCR). Large breaches affect 500 or more individuals. Reports of these breaches have declined slightly from 2025’s record, but third-party risks have intensified.

The Landscape So Far

Organizations reported 397 large healthcare breaches to OCR during the first half of 2026. Those breaches affected approximately 33.8 million individuals, fewer than during the same period last year. Business associates played a role in approximately 43% of those reports, exceeding historical averages. Hacking and IT incidents accounted for most cases.

Several 2026 incidents illustrate these risks.

DentaQuest – A May cyber incident affected approximately 15 million individuals at DentaQuest, a Sun Life subsidiary. The ShinyHunters extortion group claimed responsibility. Attackers stole names, addresses, Social Security numbers, and Medicaid or Medicare identifiers. They also obtained dental or vision information, including diagnoses, treatment details, and billing records. DentaQuest began notifications in July after the group leaked information following failed negotiations.

iRhythm Technologies – A June incident affected approximately 8.18 million people. Attackers used social engineering to access business applications that a third party hosted. The incident did not involve clinical systems or medical devices. Exposed information included names, contact details, birth dates, insurance numbers, account or serial numbers, and service dates. The company began notifications in October. At that time, iRhythm reported no evidence of identity theft.

Blueberry Pediatrics – Attackers exploited a vulnerability in Metabase, a business intelligence and reporting tool. The incident affected approximately 341,000 individuals, including children. A related incident involving prescription partner Photon involved the same vulnerability. Exposed information included names, birth dates, health-plan details, and certain medical and billing information. Blueberry Pediatrics discovered the incident in August and began notifications in October.

Earlier Breaches Continue to Carry Consequences

Conduent’s 2024–2025 breach affected approximately 62.2 million records, making it the third-largest reported incident. The incident recently prompted an $80 million class-action settlement agreement.

Change Healthcare’s 2024 ransomware attack remains the largest reported healthcare breach, affecting approximately 192.7 million individuals.

Enforcement Priorities Remain Consistent

OCR continues its Risk Analysis Initiative. Nearly every recent settlement identifies failures involving an accurate and thorough risk analysis. The HIPAA Security Rule establishes this requirement under 45 CFR § 164.308(a)(1)(ii)(A).

Several 2026 settlements illustrate OCR’s priorities.

Ambry Genetics agreed to a $700,000 settlement following a phishing incident affecting approximately 225,000 people. OCR also identified concerns involving access termination and unique user identifiers.

OSF Healthcare System agreed to a $552,250 settlement involving a ransomware incident affecting approximately 54,000 individuals. OCR identified potential violations involving risk analysis, impermissible disclosures, and breach notifications.

Spencer Gifts agreed to a $450,000 settlement involving its employer-sponsored health plan following a ransomware attack. The case demonstrates that HIPAA obligations can extend beyond traditional healthcare providers.

Patient Access Still Drives Enforcement

OCR also continues its Right of Access Initiative. A recent $140,000 settlement with Pennsylvania dental practice Shen Smiles addressed delayed patient access and related Privacy Rule concerns. The case reinforces that organizations can face enforcement without experiencing a cyberattack.

What These Trends Mean for Organizations

Vendors expand your exposure. Business associates, software platforms, reporting tools, and revenue-cycle partners create additional opportunities for attackers. Healthcare organizations must address vendor relationships within their HIPAA compliance programs.

Risk analysis supports effective security.

OCR repeatedly identifies incomplete or outdated risk analyses during breach investigations. Organizations should document risks across their operations and update their analyses as threats and systems change. Analyses should address phishing, social engineering, third-party applications, and ransomware.

Notifications and contracts require attention.

Enforcement findings frequently address delayed notifications to affected individuals and OCR. Clear business associate agreements help establish reporting duties and other responsibilities. Organizations should understand these obligations before an incident occurs.

Financial consequences extend beyond regulatory payments.

Organizations may also face class actions, state enforcement, forensic investigations, notification expenses, and credit-monitoring costs. Operational disruptions and lost patient trust can increase the damage.

Actionable Steps

Update your organization-wide risk analysis to address third-party systems and current threats.
Inventory vendors and prioritize those with significant access to sensitive information.
Request evidence of vendor security controls and verify their effectiveness where appropriate.
Test incident response procedures, including notification timelines and decisions involving third-party incidents.
Document patient record requests and confirm that staff consistently follow access procedures.
Review cybersecurity insurance coverage, including exclusions involving vendor incidents.

OCR Continues to Examine Core Safeguards

Attackers exploit weaknesses across healthcare organizations and their vendors. OCR continues to examine how organizations implement core HIPAA Security Rule requirements. Treat risk analysis, vendor oversight, and incident response as ongoing responsibilities. Regular reviews and documented improvements help organizations respond as threats evolve.

When was the last time your organization reviewed your Business Associates?

HIPAA compliance isn’t a one-time project; it’s an ongoing process. At Aris Medical Solutions, our HIPAA Keeper™ system simplifies compliance with a cloud-based platform that walks you through each requirement, step by step. From risk analyses, risk management, policies to employee training, and required documentation, you’ll have everything needed to remain compliant.

Schedule your HIPAA compliance review today and protect your organization from the next enforcement headline.

Your Trusted Partner for HIPAA Compliance since 2009

Healthcare Data Breaches Remain High as New Risks Emerge

Suze Shaffer November 2, 2026November 3, 2026

Healthcare organizations continue to face significant data protection challenges in 2026, despite occasional monthly declines in breach reports. Through August, organizations reported approximately 593 large breaches to the HHS Office for Civil Rights (OCR). These breaches affected 500 or more individuals each and represented a 6.7% increase compared with the previous year. The incidents exposed protected health information (PHI) belonging to approximately 78.6 million people. That figure increased 14.8% compared with the same period in 2025.

Hacking and IT incidents continue to dominate breach reports. However, attackers and workforce members increasingly expose information through different pathways. Third-party vendors and business associates account for a growing share of reports. Unauthorized AI use also creates risks alongside ransomware and phishing.

Recent Incidents and Settlements

iRhythm Technologies reported a June 2026 incident involving business applications that a third party hosted. Attackers used social engineering to gain unauthorized access. OCR portal filings identify more than 8.1 million affected individuals. Compromised information included names, contact details, birth dates, insurance numbers, account or device serial numbers, and service dates. According to reports, the incident did not affect clinical systems or devices.

AdaptHealth disclosed a hacking incident that exposed information belonging to more than 4.1 million individuals. The incident ranks among the year’s larger breach reports.

Lehigh Valley Health Network agreed to an $800,000 OCR settlement involving a 2023 ransomware incident. The attack affected 248,359 individuals. The settlement marked OCR’s 22nd ransomware enforcement action. OCR identified potential failures involving risk analysis, system activity reviews, and timely notifications to individuals and HHS. The organization also agreed to a $65 million settlement resolving related class-action litigation. Attackers stole sensitive clinical information, including some images of patients undergoing treatment.

Ambry Genetics agreed to a $700,000 settlement following a phishing attack affecting approximately 225,000 individuals. OCR identified deficiencies involving risk analysis, access termination, and unique user identification.

Patient Access Remains an Enforcement Priority

OCR continues to pursue complaints involving delayed patient access to medical records. Pennsylvania dental practice Shen Smiles paid $140,000, while Azul Vision paid $50,000. Both cases involved delays in providing patients with their records. These settlements reinforce OCR’s continued focus on patient access rights.

Emerging Risk: Unauthorized AI Use

A Johns Hopkins Bayview Medical Center staff member uploaded a spreadsheet to an unapproved public AI tool. The spreadsheet contained information about 3,182 patients who received admissions or treatments between May and September 2026. The information may have included names, medical record numbers, account numbers, admission dates, departments, medications, and provider names. The hospital reported that the information excluded Social Security numbers and financial account details. The hospital discovered the issue that same day. It directed deletion of the prompt and file, contacted the vendor, and began notifying patients. The hospital also offered credit monitoring.

This incident highlights the risks employees create when they use unauthorized AI tools for analysis or summarization. Uploading PHI outside approved systems can trigger breach assessments, notification obligations, and regulatory scrutiny. Organizations must also determine whether vendors retain copies after users delete uploaded information.

Common Gaps in OCR Investigations

OCR settlements repeatedly identify foundational weaknesses.

Organizations often fail to:

Complete thorough risk analyses and update them as circumstances change.
Implement effective access controls and audit logging.
Notify affected individuals and regulators promptly.
Establish clear policies for workforce use of new technologies.

Third-party involvement also remains a significant concern across recent large breaches.

Practical Steps for Healthcare Leaders

Keep risk analysis current. Document findings and maintain a risk management plan that addresses identified vulnerabilities.
Establish clear AI rules. Identify approved tools, restrict PHI uploads, and explain the risks of public platforms.
Strengthen vendor oversight. Request evidence of risk assessments, establish incident reporting expectations, and maintain appropriate contractual safeguards.
Improve notification procedures. Assign responsibilities, track deadlines, and address reporting requirements during incident response planning.
Monitor patient access requests. Train staff, document requests, and resolve delays before they generate complaints.

Build Ongoing Accountability

The volume of incidents and affected individuals remains high even as monthly counts fluctuate. Organizations that invest in continuous risk assessment, clear technology governance (especially around AI), and disciplined vendor management are better positioned to reduce both the likelihood of incidents and the severity of regulatory and litigation outcomes when they occur.

When did your organization last review and update its HIPAA Security Risk Analysis?

At Aris Medical Solutions, our HIPAA Keeper™ cloud-based platform makes HIPAA compliance simple. It guides your organization through every requirement with a clear, step-by-step process. From risk analyses, risk management, policies to employee training, and required documentation, you’ll have everything needed to remain compliant, protected, and audit-ready. Best of all, your HIPAA Compliance Officer is never on their own. Every client has access to a Certified HIPAA Security Analyst who provides expert guidance, answers questions, and helps ensure your compliance program is implemented correctly.

Schedule your HIPAA compliance review today and protect your organization from the next data breach.

Your Trusted Partner for HIPAA Compliance since 2009

The OCR and FTC are investigating online tracking technologies

Suze Shaffer August 1, 2023February 2, 2024

We wrote about this back in December 2022, but the Office for Civil Rights (OCR) and the Federal Trade Commission (FTC) has added an additional warning. The OCR has confirmed its active investigations nationwide to ensure compliance with HIPAA. The use of online tracking technologies and HIPAA requirements must be reviewed on all medical websites.

The OCR and the FTC are cautioning providers about the privacy and security risks when utilizing online tracking technologies. These may be integrated into websites or mobile apps. Depending on how they are created and set up, these technologies may be disclosing personal health information to third parties. Tracking technologies collect and analyze information when visitors use websites or apps. Most of the time, this information is shared directly with third parties and even track the visitor when they navigate away from the website or app.

Online tracking technology can be used for good, but patients should not have to sacrifice their personal information in the process. The OCR and FTC sent letters to 130 hospital systems and telehealth providers to emphasize the risks and concerns about the use of these technologies, such as the Meta/Facebook pixel and Google Analytics. These are just a couple that are known to track a user’s online activities. These tracking technologies gather identifiable information about visitors, usually without their knowledge.

The minimum necessary rule must be followed even with modern technology. This means only the minimum necessary information can be shared to complete the task, nothing more. The OCR enforces the HIPAA rules and will review all aspects of your compliance if they receive a complaint, or if you have a data breach.

The FTC’s role in is protecting the public from deceptive or unfair business practices. This includes unfair methods of competition, promotion, research, and education. Through FTC’s recent enforcement actions against BetterHelp, GoodRx, and Premom, the FTC has put companies on notice that they must monitor the flow of health information to third parties that use tracking technologies integrated into websites and apps. The unauthorized disclosure of such information may violate the FTC Act and could constitute a breach of security under the FTC’s Health Breach Notification Rule.

Companies not covered by HIPAA still have a responsibility to protect against the unauthorized disclosure of personal health information—even when a third party developed their website or mobile app. When working with a website designer or marketing group, be sure to fully vet them for their HIPAA compliance efforts. Even if they have worked with other medical practices. Being HIPAA compliant is more complicated now with all the modern technology and they must jump through the same hoops as a medical practice. Just because they say it will help you with your practice, doesn’t mean it is acceptable under the HIPAA rules. Trust but verify!

Aris Medical Solutions has an online system called the HIPAA Keeper™, to help covered entities and business associates get compliant and stay compliant with HIPAA!

Or to schedule a demo click the contact us tab and scroll down.

“Simplifying HIPAA through Automation, Education, and Support”

To read about actual HIPAA fines, click on our Education tab!