You Missed a Whole Season of Healthcare Breaches This Summer

The Breach Count Kept Climbing

The Identity Theft Resource Center’s midyear report, released July 22, counted 281 healthcare data breaches in the first half of 2026, up from 270 during the same stretch of 2025. Only financial services logged more. The same report found that just 24% of breach notices across all sectors disclosed how the breach happened, which makes learning from other people’s mistakes a lot harder than it ought to be.

Then came the season’s headliner. DentaQuest, a Massachusetts dental and vision benefits administrator with roughly 32 million beneficiaries, reported that attackers were inside its network from May 17 to May 20, and it began mailing notification letters on July 17. The count reported to regulators was 15 million people, the largest healthcare breach reported to the government so far this year. (An independent researcher who examined the leaked data thinks the real number could top 23.4 million.)

Multiple outlets attributed the attack to ShinyHunters, and the group’s method is the part you should care about. Health-ISAC describes it as a pay-or-leak extortion operation that steals data without bothering to encrypt anything, and its July threat bulletin warned that the group gets in through social engineering, including phone calls that talk employees into handing over access. A convincing voice and a help desk eager to be helpful will get an attacker further than most malware ever does, and your front desk answers the phone all day.

Your Vendors Had a Rough Summer, Too

CareCloud, a publicly traded health IT company that provides cloud-based EHR, practice management, and billing services to more than 40,000 providers, disclosed that attackers reached its AWS cloud environment between March 10 and March 16 and pulled data from its database. Notification letters to 3.7 million affected patients started going out on July 25, more than 4 months after the intrusion.

If you’ve read the last few issues of this newsletter, you already know where this is going. Your vendor’s breach becomes your problem, your patients get a letter they’ll associate with your practice, and the breach notification terms in your Business Associate Agreement suddenly matter a great deal. Under 45 CFR § 164.410, a business associate has up to 60 days from discovery to notify you, and your BAA can (and should) set a shorter window. If you don’t know what yours says, this is a fine week to find out.

OCR Kept Its Foot on the Risk Analysis Pedal

OCR spent the summer doing what it’s done all year, which is settling with organizations that couldn’t show an accurate and thorough risk analysis. Early in the summer, it announced a $450,000 settlement with the Spencer Gifts employee benefit plans (yes, the mall store), which counted as OCR’s 20th ransomware enforcement action and the 14th under its Risk Analysis Initiative. If a novelty retailer’s health plan can’t hide from OCR, your 6-provider practice isn’t going to manage it either.

On July 29, OSF Healthcare System agreed to pay $552,250 and accept a corrective action plan, monitored for 2 years, that requires a new risk analysis and a risk management plan following a ransomware investigation involving 53,907 people. On August 27, OCR announced its 55th Right of Access settlement, this time with a California provider, as a reminder that the agency still cares whether your patients can get copies of their own records. The two ransomware settlements produced corrective action plans that read like the same document with different names typed in, and both of them start with the risk analysis.

Washington Had a Slow Summer

I know. That header is probably the most shocking thing you’ve heard so far (yes, that’s sarcasm). The proposed HIPAA Security Rule overhaul, the one that would make MFA and encryption explicitly required, lost a year in July when the federal regulatory agenda moved its projected final action from May 2026 to July 2027. The current Security Rule remains fully enforceable in the meantime, a detail that OSF and the Spencer Gifts plans can confirm firsthand.

The Privacy Rule’s coordinated care update, first proposed in January 2021, was slated for final action in August after HHS sent it to OMB on April 4. August came and went without a final rule (OMB’s customary 90-day review window closed somewhere around the 4th of July), and as of late September it still hadn’t appeared in the Federal Register. If you were planning to update your Notice of Privacy Practices, holding off until that rule lands will spare you from doing it twice.

Congress moved at its usual, glacial pace. The Senate’s Health Care Cybersecurity and Resiliency Act, which would require minimum practices like MFA and encryption across HIPAA-regulated entities, cleared the HELP Committee 22-1 in February and has been sitting on the Senate calendar since. In July, a bipartisan group in the House introduced the Rural Hospital Cybersecurity Enhancement Act, aimed at workforce development and training for rural hospital staff. Neither bill changes your obligations today, but both point in the same direction as the stalled Security Rule.

Summer Ended on Paper

On September 1, Luminis Health in Maryland lost its MyChart patient portal to a cyberattack. Phone service came back on September 16, and MyChart returned on September 29, 4 weeks after it went dark. Luminis said the system storing patient records wasn’t affected, yet staff still worked under downtime procedures that included paper medical records, and the organization was still scanning downtime notes and results back into the chart weeks later (not to spoil anything, but you should watch Season 2 of HBO’s The Pitt if you want to see how such a downtime procedure works at a busy (albeit fictional) emergency department on a holiday weekend).

The timing was almost poetic. In June, AHA cybersecurity advisor John Riggi told healthsystemCIO that hospitals should plan for a 30-day outage, based on data from hundreds of attacks. A July Health-ISAC survey found that only 22% of health sector CISOs rated their recovery capabilities in the top 2 of 5 maturity levels. A Michigan CISO described a rounding exercise where nurse after nurse admitted they’d never charted on paper (a fun thing to learn during a drill, and a considerably less fun thing to learn on day 1 of a real outage).

Your contingency plan under 45 CFR § 164.308(a)(7) exists to answer how you keep seeing patients when the technology disappears. If your answer assumes the outage lasts an afternoon, it’s due for a rewrite.

Before the Fall Season Premieres

None of this summer’s storylines needed a new regulation to become your problem. Start by asking your front desk and IT support how they verify the identity of someone who calls asking for a password reset, and whether that process would survive a caller who already knows your office manager’s name. Pull your Business Associate Agreements and check the breach notification windows, starting with your EHR and billing vendors. Confirm that your risk analysis covers the cloud systems your vendors run on your behalf, since both of this summer’s ransomware settlements traced back to that document. Then run a tabletop exercise that assumes the outage lasts a month, and have somebody count how much paper you’ve got in the supply closet.

Welcome back from vacation. Go call your own help desk, pretend to be your office manager, and see how far you get.