One AI vendor held half the risk in Q2.
The Q2 2026 State of Compliance Brief — 10 independently verified U.S. healthcare breach disclosures, at least 2.7M affected. Headline finding: Xsolis, an AI-enabled utilization-management vendor, alone accounts for 51.7% of the verified floor — more than five times the next-largest verified entry.
Written and reviewed by the Patient Protect team — Joseph A. Perrin, CTO (former government CTO, military-grade security architecture), Angie Perrin, CSO (Certified HIPAA Consultant, 10+ years clinical practice), and Alexander Perrin, CEO (15 years enterprise SaaS).
Secure Care Research Institute
State of Compliance · Vol. 1, Issue 2 (Brief) · Q2 2026
One AI vendor held half the risk in Q2.
Today we publish the second issue of the State of Compliance series — a quarterly empirical review of the U.S. healthcare data breach landscape. Q1 2026 identified the concentration pattern: four upstream business-associate and platform-vendor cascades drove 67.6% of the period’s harm across less than 2% of the incident count. Q2 tells the next chapter of the same story.
Headline finding
51.7%
Of the Q2 verified breach impact came from a single AI-enabled utilization-management vendor. One incident, more than five times the next-largest verified entry.
§ 1 — The headline finding
Concentration didn’t go away. It migrated.
Q2 2026 publishes as a shorter issue than the inaugural Q1 report — by design, not by default. The brief reports only what could be independently verified against multiple sources within its cutoff, at the length that verification supports. The full quarter total was not achievable to a defensible standard by the July 2 cutoff, because the OCR portal continued to add entries on a rolling basis and the late-2025 federal shutdown compounded the reporting backlog. That is itself a documented finding, not an omission.
Ten disclosures met the brief’s verification standard: OCR submission confirmed within the April–June window, affected-population figure corroborated by at least one independent source. Together, they establish a floor of at least 2,698,826 affected individuals — grounded in individually confirmed incidents, not a claim about the quarter’s true total.
Even inside that smaller verified set, one finding is unambiguous. Xsolis, Inc. — an AI-driven utilization-management platform used by more than 600 hospitals and health systems — disclosed a breach affecting 1,396,519 individuals. That is 51.7% of the verified floor by itself, and more than five times the next-largest verified entry.
The concentration ratio, visualized
One of ten verified incidents drove more than half of the verified impact.
Xsolis · share of verified incident count
10%Xsolis · share of verified patient impact
51.7%Within the verified set, one AI vendor accounted for 10% of the incident count and 51.7% of the affected-individual floor. Q1’s cascades ran through business-associate and platform-vendor channels. Q2’s largest ran through an AI platform.
§ 2 — The four archetypes of Q2
One AI vendor. One repeat-victim practice. Three named extortion groups. Seven independent practices.
The ten verified disclosures are not interchangeable. Each represents a distinct structural pattern, and together they characterize the quarter more fully than any single lead incident can. Two archetypes carry the most consequential findings; two more, visible only once the verified set reached ten entries, describe the shape of the record beneath them.
No. 01 · AI-vendor cascade
Hacking / IT
Xsolis, Inc.
1,396,519
patients affected
AI-driven utilization-management platform used by 600+ hospitals and health systems. Phishing intrusion on or about Jan 20, 2026; detected Jan 22; disclosed to OCR June 5. The clearest continuation of the upstream-aggregation pattern — now through an AI channel.
No. 02 · Repeat-victim pattern
Second breach in 15 months
Radiology Associates of Richmond
266,183
patients affected
Virginia imaging practice disclosed a second breach within roughly fifteen months of its first (April 2024 incident, July 2025 federal filing). A governance pattern distinct from data aggregation — worth tracking on its own.
No. 03 · Named-group extortion
Insomnia · PEAR · Rhysida
Three verified attributions
3 of 10
verified disclosures claimed
Southern Illinois Dermatology (Insomnia, 160,312), Western Orthopaedics (PEAR, 113,330), Hematology Oncology Consultants (Rhysida, 62,972). PEAR is a newer exfiltration-only actor; Rhysida has run healthcare-sector campaigns since 2023.
No. 04 · The specialty long tail
Independent practices
7 of 10 at small specialty/imaging
70%
of verified disclosures
Dermatology, ophthalmology, orthopedics, oncology, neurology, radiology. Within the verified set, breach frequency concentrated downstream at independent specialty and imaging practices — a structural counterpoint to §1 and §2.
Case in point — the retention finding
Rochester Regional ended its Xsolis relationship in 2021. Its patient records were still exposed in the 2026 breach.
Rochester Regional Health, a confirmed affected system in the Xsolis disclosure, had terminated its business-associate relationship with Xsolis in 2021. Approximately 18,600 of its patients’ records were still present in the Xsolis environment at the time of the 2026 breach.
Data that survives a vendor relationship without documented disposition remains exposed years after the business relationship that justified holding it has ended. Vendor offboarding should include documented confirmation of data return or destruction, and a retention schedule that defines when records are purged from each system.
Whatever Xsolis’s internal retention practice was, no client-facing record confirmed disposition after the 2021 termination. That absence is itself the finding.
5 years
Between the end of the vendor relationship and the breach that still exposed the records
§ 3 — What this means for practices
The next breach is more likely to start at a vendor than at your own perimeter — and the vendor may be one you already left.
The Q2 record carries several concrete implications for any independent healthcare practice. Xsolis is the loudest, but the recommendations below are derived directly from the verified set as a whole.
Document vendor offboarding with proof of data disposition. When terminating a business-associate relationship, obtain and retain written confirmation of data return or destruction, not just a termination notice. The Xsolis case is, in part, a documentation failure — no client-facing record confirmed disposition after the 2021 termination.
Treat a completed breach investigation as the start of a remediation review, not the end of the incident. Radiology Associates of Richmond’s second breach began within weeks of its first breach’s federal reporting. A closed investigation should trigger a documented check of whether the access vector that caused it was actually closed, not merely disclosed.
Maintain a current, documented risk analysis regardless of Security Rule finalization. All four of OCR’s April 2026 settlements cited a risk-analysis failure under 45 CFR §164.308(a)(1)(ii)(A). It remains the most consistently cited enforcement gap and the one most directly within an entity’s control.
Independent and specialty practices should assume they are a primary target, not a low-priority one. Seven of the ten verified Q2 disclosures occurred at practices of this size. Attacker targeting does not track organizational size the way security budgets often do.
Where a named extortion group claims responsibility without encryption — as PEAR did at Western Orthopaedics — treat the claim as an immediate exposure event rather than a ransom negotiation. The data is already circulating.
§ 4 — What else is in the issue
Five additional findings from the Q2 record.
Detection-to-disclosure
~137 days
Xsolis: attack on or about Jan 20, 2026 → OCR filing June 5, 2026. Roughly 4-5 months. The Radiology Associates of Richmond first-breach interval was approximately 15 months (April 2024 → July 2025). Against the finance-sector 4-day benchmark, healthcare intervals remained one to two orders of magnitude longer.
Security Rule update
May 2026, missed
The proposed HIPAA Security Rule update passed its regulatory-agenda target for final action without a final rule. A coalition of 100+ hospital and provider groups continued to press HHS to withdraw the proposal, citing an OCR first-year compliance-cost estimate of approximately $9 billion.
OCR April 2026 settlements
4 of 4
Every one of OCR’s April 2026 settlements involved a risk-analysis failure. A missing or stale risk analysis under §164.308(a)(1)(ii)(A) remained the single most frequently cited deficiency — the enforcement floor did not move.
TARF framework · Q2 reading
Numerator ↑ · denominator flat
Applied qualitatively to the verified set, the Transparency-Adjusted Risk Function reads directionally consistent with Q1: the reusability component sharpened by the Xsolis retention finding, while the transparency component — detection-to-disclosure intervals — did not improve.
The brief also documents source reconciliation, exclusion logic, and verification tiers in Appendices A-D of the working document. Notable exclusions include the Saint Anthony Hospital 2026 upward revision (146,108, originally OCR-filed September 2025 at 6,679), the Wound Technology Network March notice (Q2 OCR submission unconfirmed), and the L.A. Care Health Plan raw count error (2,000,000 corrected to under 3,000).
Read the full brief
13 pages. Full methodology. Open for scrutiny.
The complete Q2 2026 working brief includes the four archetypes with source citations, the TARF Q2 reading, five covered-entity recommendations, two business-associate recommendations, and four appendices documenting the verification standard, source reconciliation, and exclusion log.
Working brief
Read the Q2 2026 brief
13-page PDF with full verification methodology and archetype analysis. Email-gated for research updates.
Open the brief →
Live data
Explore the breach dashboard
The same multi-source compilation behind this brief — filterable by entity, state, attack type, and impact band.
Open the dashboard →
A note on the data
Verification standard. Unlike the Q1 report’s multi-source compilation across 207 breaches, the Q2 issue publishes as a verified brief. Each of the ten disclosures met a specific standard: OCR submission date confirmed within the April 1–June 30 window, and affected-population figure corroborated by at least one source independent of the underlying compilation. Tier A entries were confirmed through multiple concurring primary or press sources; Tier B entries were corroborated against entity notification timing or a single independent source.
Cutoff. Analysis compiled on July 2, 2026. The HHS OCR breach portal is not a static record of a closed quarter; it adds entries on a rolling, frequently delayed basis. Figures here are a point-in-time reading, not a final quarter tally.
Why a brief rather than a full compilation. The raw Q2 compilation totaled approximately 291.7 million affected individuals across OCR and state AG filings before verification. The large majority traced to three identifiable mechanisms — prior-year incidents re-filed at the state level (Anthem, Kaiser, Excellus, others), genuine 2026 incidents whose original OCR submission fell before April, and one affected-count data error (L.A. Care Health Plan, 2,000,000 corrected to under 3,000). Rather than publish a headline number that survived only until its next revision, the brief reports only what could be independently verified, and documents the exclusion log.
Suggested citation. Perrin, A. (2026). State of Compliance: Q2 2026 Healthcare Breach Brief. The State of Compliance Series, Vol. 1, Issue 2 (Brief). Secure Care Research Institute, Patient Protect LLC.
The Secure Care Research Institute is an independent research program operating under Patient Protect LLC.