Published October 18, 2026. Vol. 1, Issue 3 (Review) of The State of Compliance Series. Full review available by request below.
Q3 2026 Healthcare Breach Review
161 healthcare data breach disclosures carrying HHS Office for Civil Rights portal submission dates in the third quarter of 2026 (July 1 through September 30), compiled and verified by the Secure Care Research Institute as of October 13, 2026. Together they list 42,710,667 affected individuals on the HHS portal, of which 40,745,632 (95.4%) sit in entries whose portal date and count the authors read directly from the portal or confirmed through concurring primary sources. Four upstream vendors and administrators — DentaQuest, Aesto Health, Unlimited Technology Systems, and CareCloud — account for 32,100,902 listed individuals, 75.2% of the quarter. 113 of the 161 disclosures involve fewer than 10,000 people and the median disclosure is 3,809.
161
Q3 portal disclosures
42.7M
HHS-listed affected individuals
75.2%
Impact from 4 upstream organizations
113
Disclosures under 10,000 people
Watch the Q3 2026 summary
On this page
Key takeaways
Six observations anchor the Q3 record.
Each maps to a layer of the quarter: upstream concentration deepened, retention emerged as its own category, and the public record's own instability became a finding.
Upstream concentration held, and may have deepened.
Four organizations that hold or process data for many client organizations account for 32,100,902 of the quarter's affected individuals — 75.2% of listed impact. That share is directionally higher than Q1's 67.6% multi-source concentration ratio, but the underlying populations differ and the two percentages are not strictly comparable.
Retention and legacy environments emerged as a distinct operational risk.
One Medical explicitly involved archived records from Iora Health, a company it acquired in 2021. Aesto provides healthcare data archiving services. The post-quarter Oracle Health disclosure traced to a legacy server that was never migrated. Data that survives a relationship or system without documented disposition remains a distinct, narrowly defined operational risk.
Where covered entities explained the initial vector, it was a person.
AdaptHealth and Clover Health explicitly attribute initial access to social engineering. Baylor Genetics describes unauthorized network access without identifying the initial vector. AdaptHealth's case is instructive for business-associate governance: the compromised identity belonged to a contractor.
Disclosure frequency remains concentrated in smaller events.
The median Q3 disclosure is 3,809 people. 113 of 161 entries involve fewer than 10,000. In the 58-entry directly read subset, 45 are HHS-classified healthcare providers; the review does not extrapolate that share to all 161.
The public record is fragmented and mutable, and that is now a finding rather than a caveat.
The quarter's largest entry stands at 15,000,000 on HHS and 27,400,000 on Indiana's list. One Q3 count was revised by 384,961 within a day. One Q3 incident appears on the federal portal only under a client plan's name. 21 entries list exactly 500 or 501. Three portal entries were missing from the compilation.
Enforcement continued to turn on the risk analysis.
Both Security Rule actions announced in Q3 (OSF HealthCare, Ambry Genetics) cite 45 CFR 164.308(a)(1)(ii)(A), on incidents from 2021 and 2020 respectively. The Security Rule update's final action target moved to July 2027. Four OCR enforcement matters totaling $1,442,250 resolved in the quarter.
Anatomy of Q3
Where the 42.7 Million Came From
The Upstream Four
Four upstream vendors and administrators — organizations that hold or process data for many client organizations — account for the overwhelming majority of Q3's listed impact.
DentaQuest, LLC
15.0M
Dental benefits administrator
Sun Life subsidiary. Unauthorized access to its network on May 20, 2026. HHS lists 15,000,000; Indiana's attorney general, in its October 2026 year-to-date report, lists the same incident at 27,400,000 total affected.
Aesto Health
9.5M
Archiving / migration vendor
Birmingham, Alabama vendor of healthcare data migration, legacy archiving, and EHR-exchange services. Network security incident affecting a limited portion of its AWS infrastructure, December 2025 through May 2026. Two dozen-plus provider clients across multiple states. Retention sits near the center of the vendor's risk profile.
Unlimited Technology Systems
3.8M
Revenue-cycle vendor
Montgomery, Ohio revenue-cycle and practice-management vendor serving 4,500+ clinical offices. Unauthorized activity in a commercial data center, October 2025. Potentially involved data included scanned documents: driver's licenses, insurance cards, intake forms. Eight to nine months from discovery to notification.
CareCloud, Inc.
3.8M
EHR / RCM vendor
EHR and revenue-cycle vendor. Unauthorized access to AWS environment between March 10 and July 2026. Affected count revised from 3,371,508 to 3,756,469 the day after first appearing on the HHS tracker.
Together these four account for 32,100,902 listed individuals — 75.2% of the quarter's HHS-listed total.
Covered-Entity Mega-Disclosures
AdaptHealth, LLC
4.1M
Healthcare provider (DME)
Publicly traded home medical equipment supplier with 668 locations in 48 states. SEC filing describes a social-engineering attack compromising a third-party contractor session. Data exfiltrated including billing information; Social Security numbers and financial-account information were not involved. ShinyHunters was reported to have listed AdaptHealth on its extortion site.
Baylor Genetics
2.8M
Healthcare provider (genetics)
Houston genomics and genetic testing company. Unauthorized party accessed portions of its network between June 11 and 17, 2026. Potentially involved information includes medical testing information, laboratory results, and for a very limited subset, Social Security numbers. No public claim of responsibility.
Clover Health
138,677
Health plan (Medicare Advantage)
A threat actor used social engineering to reach three non-managerial health plan employee accounts in early July. The accounts had no access to corporate financial or claims systems.
Retention and Legacy Environments
This category is defined narrowly: records held by a party after the relationship or system that generated them had ended. Q3 contains one explicit example and one adjacent signal. One Medical (153,174; July 17) learned on June 13 that an unauthorized person had accessed a third-party file-storage system used to retain archived Iora Health information. Iora Health was acquired by One Medical in 2021. The company said the accessed files were related to a limited number of legacy Iora Health and One Medical Seniors patients.
Aesto provides healthcare data migration and archiving services — retention sits near the center of the vendor's risk profile even though its notice does not establish the age or disposition status of the affected records. After the quarter closed, the Oracle Health disclosure traced to a legacy server that was never migrated — the clearest case of data that was never decommissioned.
The Long Tail
The other 155 disclosures account for 8.6% of the quarter's affected total. The median disclosure is 3,809 people. 39 entries list fewer than 1,000 affected individuals; 74 fall between 1,000 and 9,999. Hacking or IT incidents account for 132 of the 161 disclosures (82%). Texas (24), California (16), and Florida (10) lead the reporting-entity state distribution; that field locates the filing entity, not the affected individuals. In the directly read subset, healthcare providers make up 45 of 58 entries. The review does not infer organization size from that classification alone and does not characterize the entries as independent practices.
The public record
The Public Record: Fragmentation and Mutability
Five kinds of instability were observed in the Q3 public record, each of which affects any compilation that treats portal data as stable.
1. Regulators disagree about the same incident.
HHS lists DentaQuest at 15,000,000. Indiana's attorney general, in its October 2026 year-to-date report, lists the same incident at 27,400,000 total affected, with 119,600 Indiana residents, against a July 17 notification date. The HHS figure has not moved. Whichever number is closer to the eventual total, the quarter's largest disclosure differs by 12.4 million people depending on which official record a reader consults.
2. Counts move after they are posted.
CareCloud's HHS figure rose from 3,371,508 to 3,756,469 the day after it first appeared — a revision of 384,961.
3. Incidents appear under names other than the responsible party's.
MedImpact, a San Diego pharmacy benefit manager serving more than 20 million members, concluded its investigation July 17 and notified affected clients August 13. Its public record is split: California carries a MedImpact filing and Texas lists 8,199 Texans under MedImpact's own name; the HHS portal carries the Leggett & Platt Employee Benefit Plan at 61,702 and no MedImpact entry.
4. Preliminary counts can persist.
21 Q3 entries list exactly 500 or 501 affected individuals — values consistent with the preliminary estimates HHS permits when a final count is not yet known.
5. Compilations lag and omit.
The portal showed no submission dated after September 25 when read on October 13. Three of 58 portal entries read directly were absent from the October 13 compilation.
The verified set
Verified Q3 Breach Disclosures
Every Q3 disclosure of 100,000 or more affected individuals, with each entry's verification tier.
| Entity | Category | Affected | OCR Submitted | Tier |
|---|---|---|---|---|
| DentaQuest, LLC | Benefits administrator | 15,000,000 | Jul 16, 2026 | A |
| Aesto, LLC (Aesto Health) | Archiving / migration vendor (BA) | 9,540,683 | Jul 31, 2026 | A |
| AdaptHealth, LLC | Healthcare provider (DME) | 4,115,802 | Aug 14, 2026 | A |
| Unlimited Technology Systems, LLC | Revenue-cycle vendor (BA) | 3,803,750 | Jul 21, 2026 | A |
| CareCloud, Inc. | EHR / RCM vendor (BA) | 3,756,469* | Jul 24, 2026 | A |
| Baylor Genetics | Healthcare provider (genetics) | 2,810,878 | Aug 14, 2026 | A |
| DC Dept. of Health Care Finance | Government health plan | 399,086 | Sep 3, 2026 | A |
| American Addiction Centers | Business associate (per portal) | 327,754 | Aug 7, 2026 | B |
| Brown Health Medical Group (Lifespan) | Healthcare provider | 311,760 | Jul 16, 2026 | C |
| Premier Medical Group of the Hudson Valley | Healthcare provider | 282,075 | Aug 21, 2026 | C |
| Boston Healthcare for the Homeless Program | Healthcare provider | 201,260 | Aug 10, 2026 | C |
| One Medical Group, Inc. | Healthcare provider | 153,174 | Jul 17, 2026 | C |
| Madera Community Hospital | Hospital | 150,810 | Jul 13, 2026 | C |
| Clover Health | Health plan | 138,677 | Sep 14, 2026 | A |
| AngMar Management Services | Management services (BA) | 126,196 | Sep 16, 2026 | A |
| zHealth, Inc. | Business associate | 118,563 | Jul 29, 2026 | B |
| Midwest Spine & Brain Institute | Healthcare provider | 108,487 | Aug 14, 2026 | C |
* HHS tracker revision; the compilation carries 3,371,508.
Tier A(10 entries; 93.1% of affected): portal submission date and affected count read directly by the authors on the HHS portal, and corroborated by the entity's own notice, a securities filing, state attorney general filings, or concurring independent reporting. Tier B (55 entries; 2.3%): a portal record read directly by the authors on October 13, 2026, without a second source reviewed for this issue. Tier C (96 entries; 4.6%): an entry present only in the compilation, whose reliability rests on the population spot check described in the methodology.
Post-Quarter Signals — Not Added as Separate Q3 Records
Oracle Health (Cerner)
On October 2, the Texas attorney general published a Cerner Corporation breach report covering 2,992,244 Texans, with addresses, Social Security numbers, and medical information affected. Notification letters filed with state regulators trace the incident to legacy Cerner systems accessed at least as early as January 22, 2025. Oracle's customer notice describes an old legacy server not yet migrated to the Oracle Cloud. Bloomberg, citing the Texas report, puts the national figure at nearly 20 million. The only HHS entry under Cerner's own name is a June 17, 2025 filing listing 501 individuals, archived as closed.
iRhythm Technologies
The maker of the Zio cardiac monitor identified unauthorized activity on June 8, received an extortion demand June 9, and filed a Form 8-K on June 15. Texas lists 298,647 residents and South Carolina 69,526, posted October 6. It had no HHS portal entry as of October 13. A figure of 8,179,772 circulating in third-party trackers does not appear on the Texas public listing and is not adopted.
Structural analysis
The TARF Framework in Q3
The Q1 report applied the Transparency-Adjusted Risk Function qualitatively and concluded that the numerator of transparency-adjusted risk was stable to rising while the denominator deteriorated. Q3 is the first quarter since Q1 in which the reading rests on a quarter-wide portal compilation rather than a verified subset.
The reusability-and-retention component is reinforced by the two Q3 signals: at One Medical the entity's own notice establishes that the breached system retained archived records of a company acquired in 2021; at Aesto the notice establishes an archiving business and PHI on its network without establishing the age of every affected record. In both cases, PHI remained sensitive while being retained outside the organization or system that originally generated it.
The transparency component shows no clear improvement in the Q3 cases with usable timelines. This is consistent with the Q1 and Q2 readings and is offered, as before, as a hypothesis the series continues to track rather than an empirical demonstration.
Regulatory environment
Four OCR enforcement matters resolved in Q3, totaling $1,442,250.
OSF HealthCare System
$552,250
Nephilim ransomware, April 2021, 53,907 people. OCR's covered conduct cites the risk-analysis provision at 45 CFR 164.308(a)(1)(ii)(A), an impermissible disclosure, and late notification to individuals and to HHS, with a two-year corrective action plan.
Ambry Genetics
$700,000
January 2020 phishing attack on one employee's email account affecting 225,370 people. OCR cited the absence of an accurate and thorough risk analysis, of procedures to terminate access when a workforce member's employment ended, and of unique user identification, with a two-year corrective action plan.
Shen Smiles (Dr. Linda L. Shen)
$140,000
Right-of-access complaint. Agreed August 11 to resolve. Practice also found to lack Privacy and Breach Notification Rule policies and to not reasonably safeguard PHI.
Azul Vision
$50,000
Records request made January 9, 2023 and fulfilled January 6, 2025, with a two-year corrective action plan. Optometry and ophthalmology group with 31 California clinics.
Both Security Rule actions cite the risk-analysis provision, on incidents five and six years old at settlement. Separately, the proposed Security Rule update's regulatory-agenda target for final action moved from May 2026 to July 2027, and the Privacy Rule update covering patient record access and caregiver involvement passed its August 2026 agenda target without publication.
Recommendations
Concrete controls, derived directly from the verified Q3 record.
The following recommendations are derived from the verified Q3 record. They do not constitute legal advice; covered entities and business associates with specific compliance questions should consult qualified HIPAA counsel.
For covered entities
- 01
Inventory every former vendor and former system that may still hold patient data, and obtain written disposition. One Medical provides the clearest Q3 example: Aesto's role as a healthcare data-archiving provider and the post-quarter Oracle Health disclosure reinforce the need to include archive and legacy systems explicitly. A migration that leaves the source in place does not eliminate legacy exposure.
- 02
Treat contractor and vendor identities as part of your own attack surface. AdaptHealth's initial foothold was a contractor session. Ask vendors how their contractors authenticate and whether subcontractors with PHI access are covered by the vendor's own agreements and access controls.
- 03
Maintain a current, documented risk analysis independent of the Security Rule's timeline. Both Q3 Security Rule matters cite its absence, on incidents that predate the proposed update entirely.
- 04
Include unstructured files in scope. Scanned licenses, insurance cards, and intake forms can be missed by inventories or data-loss tools that are not configured to inspect unstructured content.
- 05
Know how each business associate agreement allocates individual notification, and prepare the patient-facing script either way. The covered entity remains ultimately responsible for required individual, HHS, and media notifications, although it may delegate the task. Whichever party sends the letter, patients call the practice they know.
For business associates and vendors
- 01
Publish a retention and disposition schedule clients can audit, and apply it to archives and legacy environments first. Aesto, One Medical, and the post-quarter Oracle Health disclosure show why archive and legacy environments deserve explicit retention and disposition controls.
- 02
Define notification roles, update obligations, and state-law filing responsibilities before an incident. A business associate's direct HIPAA duty is to notify the covered entity; the parties may agree that the business associate will perform downstream notification tasks on the covered entity's behalf, with the covered entity remaining ultimately responsible. MedImpact's split record and the closed 501-person entry under Cerner's name show what clients are left to explain when that information lags.
- 03
Hold business applications to the same standard as clinical systems. Clover Health's incident ran through scheduling and sales accounts, and the post-quarter iRhythm disclosure traces to third-party-hosted business applications rather than devices or clinical systems. Scheduling, billing, support, and CRM tools hold PHI too.
Cite this review
Suggested citation.
Permitted uses include academic citation with full attribution, fair-use quotation for commentary or news reporting, and sharing of publicly available excerpts with attribution.
APA
Perrin, A. (2026). State of Compliance: Q3 2026 Healthcare Breach Review (Vol. 1, Issue 3). Secure Care Research Institute, Patient Protect LLC.
Chicago
Perrin, Alexander. "State of Compliance: Q3 2026 Healthcare Breach Review." Secure Care Research Institute, Patient Protect LLC, 2026. Vol. 1, Issue 3.
BibTeX
@techreport{perrin2026soc_q3,
author = {Perrin, Alexander},
title = {State of Compliance: Q3 2026 Healthcare Breach Review},
series = {The State of Compliance Series},
number = {Vol. 1, Issue 3},
institution = {Secure Care Research Institute, Patient Protect LLC},
year = {2026},
type = {Review},
url = {https://patient-protect.com/research/state-of-compliance-q3-2026}
}Full review
Request the full Q3 2026 review
The complete review spans 20 pages with full methodology, source reconciliation, dataset, and appendices. Enter your email and a member of our research team will deliver a copy personally.
Get the next issue
Q4 2026 publishes January 2027.
Subscribe to the series and we will notify you when the Q4 review publishes.
Related research
Companion issue · 2026
Q2 2026 Healthcare Breach Brief
Ten verified disclosures, the AI-vendor cascade, and repeat-victim governance.
Companion issue · 2026
Q1 2026 Healthcare Breach Review
Multi-source compilation, the 67.6% concentration finding, and seven attack archetypes.
Working paper · 2025
The Economics of ePHI Exposure
Long-term impact model of healthcare data breaches. SSRN 5257628.
Working paper · 2025
The Cyber-Economic Stack
How AI turns healthcare data into a financialized attack asset. SSRN 5792382.
Live tool
Breach Intelligence Dashboard
Explore healthcare breach disclosures in real time.
Corrections & Updates
Healthcare security data changes as investigations progress, vendors update systems, and laws and guidance evolve. If you see something outdated, incomplete, or incorrect — or have newer source material — we’d appreciate hearing from you.