The State of Compliance
Where healthcare risk is concentrating right now.
An ongoing quarterly empirical review of U.S. healthcare breach activity — drawing on OCR, state attorney general filings, CISA advisories, and primary entity disclosures. Each issue tracks vendor concentration, disclosure quality, attack archetypes, and regulatory movement across the quarter.
Latest issue · October 2026
Four upstream organizations carried 75% of Q3 impact.
161 HHS portal disclosures. 42.7 million affected individuals. Four upstream vendors and administrators — DentaQuest, Aesto Health, Unlimited Technology Systems, and CareCloud — account for 75.2%of the quarter's listed impact. 113 of the 161 disclosures involve fewer than 10,000 people.
161
Q3 portal disclosures
42.7M
HHS-listed affected
75.2%
From 4 upstream orgs
113
Under 10,000 people
Series archive
Q2 2026 Healthcare Breach Brief
Ten independently verified Q2 disclosures affecting at least 2.7 million people. One AI-enabled utilization-management vendor (Xsolis) accounted for 51.7% of the verified population impact. The upstream-concentration pattern persisted through a new AI-vendor channel.
10
Verified disclosures
2.7M+
Affected (floor)
51.7%
From one AI vendor
7/10
At specialty practices
Q1 2026 Healthcare Breach Review
The inaugural issue — a multi-source empirical review of 207 unique Q1 breaches affecting ~15.9M individuals. Four upstream business-associate incidents accounted for 67.6% of population impact across just 1.9% of the incident count.
207
Unique breaches
15.9M
Affected
67.6%
From 4 incidents
+75%
Lift over OCR-only
Q4 2026 Healthcare Breach Review
Q4 opens with two disclosures already larger than most of Q3's count: the Oracle Health (Cerner) breach and iRhythm Technologies. The next issue will track whether upstream concentration persists and apply the TARF framework against the full-year record.
About the series
Empirical, quarterly, multi-source.
Each issue draws on seven authoritative channels — HHS OCR, state attorney general filings, FTC enforcement, CISA advisories, sector news reporting, primary entity disclosures, and dark-web leak-site publication. Records are deduplicated across channels before analysis. Scope filters exclude non-healthcare incidents and non-U.S. jurisdictions. Each issue publishes with version metadata, corrections policy, and open named-incident inventories where feasible.
Series metadata
- Publisher
- Secure Care Research Institute · Patient Protect LLC
- Series
- The State of Compliance
- Cadence
- Quarterly
- ISSN
- Pending
- First issue
- April 2026 (Q1 2026)
- License
- Academic citation with attribution · fair use
- Governance
- Editorial control resides with SCRI
Follow the series
Receive each new State of Compliance issue when it publishes.
No marketing. Quarterly issues, corrections, and dataset updates.
Corrections & Updates
Healthcare security data changes as investigations progress, vendors update systems, and laws and guidance evolve. If you see something outdated, incomplete, or incorrect — or have newer source material — we’d appreciate hearing from you.