Thirty-three million people. One month.

That is how many individuals had their health information exposed in the 77 large breaches reported to OCR in July: at least 33,485,970. It is 642% higher than June and 154% above the 12-month average of 13.2 million.

Four organizations account for more than 32 million of them, which is more than 9% of the population of the United States. Patients rarely choose their provider's vendors.

I am mad as hell, and everyone in this industry should also be. The anger belongs with the vendors that held the data, with a regulatory process that moves in years, and with all of us for treating a number like this as routine.

I have served as a CISO and Privacy Officer for 16 years, and I founded ClearDATA. I hold the CISSP, CCSP, CIPP/US, and CIPT. My team and I protected 300 million patient records with zero reportable data breaches, so I know firsthand what it takes to protect patient data at that scale. That is why these numbers anger me.

The Numbers Behind The Anger

The breach count rose 10% in July. Through July, the year-to-date count matches 2025 exactly, while individuals affected rose 35.1% to 67,400,422. Hacking and IT incidents drove 87% of July's breaches and 99.9% of the people affected.

Attackers are getting into the same number of organizations. Each breach now reaches far more people.

Who Held The Data

The four largest July breaches:

Three of the four were business associates, and together they exposed 17.1 million people, just over half of July's total. The fourth, DentaQuest, is a benefits administrator holding member data for health plans.

Each one holds data for many other organizations. Aesto's single incident affected at least 39 of its healthcare clients.

Patients Had No Say

DentaQuest first described its incident as involving a limited part of its computer network. That limited part held the records of 15 million people. DentaQuest administers Medicaid and Medicare Advantage dental programs across all 50 states, so many of those people never chose it.

Then ShinyHunters began leaking the stolen data after it failed to reach an agreement with DentaQuest on a ransom payment. People who enrolled in a dental benefit became leverage in a negotiation they did not know was happening.

The dates are hard to accept. Unlimited Technology Systems was accessed in October 2025, Aesto in December 2025, and CareCloud in March 2026. Each was months old when it reached the OCR data. Investigations take time, and I understand why. The people in those records are owed speed.

They are also owed an explanation. Across all sectors, only 24% of breach notices in the first half of 2026 disclosed how the breach occurred, down from 100% in 2020. A notice without a cause gives every other organization nothing to defend against.

Holding Business Associates Accountable

Aesto, Unlimited Technology Systems, and CareCloud sell scale and convenience. Aesto offers data migration and legacy archiving, CareCloud offers cloud-based EHR and revenue cycle tools, and Unlimited Technology Systems offers revenue cycle and practice management software. Their customers hand over patient data trusting that the vendor will protect it better than they could alone.

That concentration is the product. It is also the exposure.

The law is clear. HHS states that business associates are directly liable for failing to comply with the Security Rule and for failing to provide breach notification to a covered entity. A BAA is a contract, and the rule applies regardless.

I do not know what these companies' risk analyses found, and I am not asserting a violation. I do know what happened. Unlimited Technology Systems' network was accessed for five days, and an intruder was in CareCloud's AWS environment for six. Two of the three incidents involved AWS environments, and no threat group appears to have claimed responsibility for any of the three.

The public record says little about how the intruders got in. I want that answer. Their customers are owed it, and so are the patients.

Customers carry the burden. A covered entity may delegate breach reporting to its business associate, and it remains ultimately responsible for ensuring notifications are issued. A community health center in Idaho reported a breach affecting 88,000 patients, and it answers to those patients for an incident that began in Aesto's environment.

Customers paid these vendors for protection. Patients are living with the result.

Covered entities chose these vendors, and the vendor risk section below is aimed at us. The business associates hold the data and carry a direct legal duty. They owe their customers more than these July filings show.

Putting Teeth Behind The Wall Of Shame

Each month the numbers post to OCR's breach portal, which the industry calls the Wall of Shame. The name promises consequences.

Here is what consequences looked like in July. OCR announced one enforcement action, a settlement with OSF Healthcare System over a ransomware attack discovered in April 2021 that exposed 53,907 individuals. The penalty was $552,250, roughly ten dollars per person, announced more than five years after the discovery.

I give OCR credit for acting. Since the start of 2025, eight HIPAA settlements have included penalties for Breach Notification Rule failures. The pace is the problem. Attackers had access to DentaQuest's network for about three days. Enforcement takes years.

A listing on the portal records what happened. Patients need it to lead to something.

Rethinking Vendor Risk

The more records a vendor holds, the more damage one breach can do. Put your review time there first.

Most programs send every vendor the same questionnaire. That spreads the effort evenly, and most of it lands on vendors that can do the least damage.

Smaller vendors still get a baseline review, because a small vendor can be breached too. The extra time goes to the vendors where one failure would reach the most patients.

  • Rank By Records Held. Sort vendors by the number of patient records they store. Contract value and importance to daily operations say little about exposure.
  • Test Segmentation. Ask how your data is separated from other customers' data, and ask to see evidence.
  • Test Retention. Ask what the vendor keeps and what it deletes when a contract ends. Aesto's services include legacy data archiving, and a vendor in that position holds PHI long after daily use has moved on.
  • Put It In The BAA. Retention limits, deletion on termination, and notification timelines belong in the contract.
  • Keep The Baseline Light. Give smaller vendors a short standard review, and save the deep reviews for the largest holders.

Actionable Steps To Prevent Ransomware And Data Theft

Ransomware remains part of the picture. Five of the 23 July breaches affecting 10,000 or more individuals were ransomware attacks. The largest incidents followed another pattern: DentaQuest was a data theft and extortion case, and CareCloud involved access to an AWS environment over six days. Backups address encryption and do nothing about stolen data, so prevention has to cover both.

I have completed more than 700 security risk assessments, and this is the order in which I would fund the work:

  1. Require Phishing-Resistant MFA. Apply it to email, VPN, cloud consoles, and every account vendors use to reach your systems.
  2. Shrink And Patch The Edge. Remove what does not need to face the internet, and patch the rest on a short clock, starting with known exploited vulnerabilities.
  3. Segment And Limit Privilege. An attacker who lands on one workstation should have no clear path to the EHR or the backup console.
  4. Make Backups Immutable. Test a full restore and record how long it takes, because that number is your real downtime.
  5. Watch Data Leaving. Alert on unusual bulk reads and outbound transfers. Faster detection shortens the window attackers get.
  6. Keep Less Data. Retention schedules and timely deletion reduce what an attacker can take.
  7. Rehearse The Response. Run a tabletop that includes an extortion demand for stolen data, and settle in advance who has authority to act.

No set of controls eliminates the risk. These reduce the likelihood of an incident and limit its impact. They also sit on top of your risk analysis, and OCR continues to enforce that requirement. Its July settlement with OSF Healthcare System cited a failure to conduct a HIPAA-compliant risk analysis. The risk analysis is where you decide which of these seven gets funded first.

Reading The Numbers Carefully

Individuals affected counts a person once per breach, so the same person can appear in several incidents. The 67.4 million figure measures exposure events and differs from unique patients. DentaQuest's total may also rise. The direction holds either way.

What I Am Calling For

I am calling on business associates that hold aggregated PHI to prove their segmentation, enforce retention limits, tell their customers quickly and plainly how an intrusion happened, and size their security programs to the number of records they hold.

I am calling on covered entities to rank their vendors by records held and write retention and deletion requirements into every agreement.

I am calling on our regulators to resolve investigations of breaches this size in months rather than years, and to require breach notifications to state how the intrusion occurred.

The people in these records had no say in who held their data. The rest of us do, and it is time we acted like it.