Insurance
Home›Insurance›Health Insurance›Business associates accounted for 43% of large health…
Business associates accounted for 43% of large health data breaches in 2026
In June, the two biggest breaches reported to OCR both hit business associates, exposing more than 2.6 million people combined.
Business associate vendors, rather than hospitals or health plans, accounted for most of the largest healthcare data breaches reported to US regulators in 2026, underscoring how third-party systems are concentrating risk in health insurance and care delivery.
Insurance Business reports that an analysis of the HHS Office for Civil Rights breach portal found business associates were involved in 43 percent of all large healthcare breaches in the first half of 2026, up from an average of 20 percent between 2009 and 2017.
The outlet cites June as a stark example: among 66 large healthcare data breaches reported to OCR that month, the two biggest incidents involved business associates and together exposed the protected health information of more than 2.6 million people.
The larger breach involved Xsolis, a Tennessee-based company providing AI-powered utilization management, where a phishing email in January gave an attacker four days of network access and exposed about 1.4 million records, and the second involved MCBS, a Georgia-based billing and revenue cycle management firm, where a data theft and extortion group exfiltrated files affecting more than 1.25 million people, including Social Security numbers, medical histories, and health insurance information. Both incidents are the type of vendor that processes claims, manages utilization, and stores member data for health plans, meaning breaches can trigger HIPAA notification obligations for every covered entity they serve.