Latest news
Hospitals spent October 2026 learning an uncomfortable lesson about healthcare data governance: the biggest exposures did not come from a front-door hack. They came from a spreadsheet pasted into a public AI tool, an analytics vendor’s access key left on a public website, and a business-intelligence platform with an unpatched flaw. Johns Hopkins Bayview Medical Center told 3,182 patients that their records reached an unapproved AI platform, according to HIPAA Journal, with letters going out from October 22.
The timing matters. Federal regulators have delayed the long-promised overhaul of the HIPAA Security Rule, while Florida’s health regulators are moving the other direction, with an offshore data-storage statute already on the books and a proposed 24-hour incident reporting rule in development. Healthcare privacy teams now work in a gap between a slow federal process and a fast-moving threat picture, and the incidents below show how wide that gap has become.
This analysis pulls together the month’s confirmed incidents, the latest breach-count data, and the regulatory changes that matter most to providers, health plans, and the vendors that serve them. It also covers the rising role of AI in clinical settings, a topic we explored when we looked at a primary care AI study with 98 patients, and asks what the industry should do before the next notification letter goes out.
The Shattered Newsletter
The week’s biggest stories in tech, gaming and security, in one email.
Free, once a week. Unsubscribe any time.
Don't miss new tech stories on Google
Add Shattered once in the Google app and our stories show up in your news suggestions.
Three disclosures from the past several weeks share a structure. In each, the organization that owed patients a duty of care was not the point of failure. A tool, a vendor, or an employee’s shortcut was.
At Johns Hopkins Bayview, an employee uploaded a spreadsheet containing patient information to a public AI platform that the hospital had not approved. The hospital discovered it on September 21, 2026, and began mailing notification letters on October 22, according to CBS Baltimore and WYPR, which published on October 26. The exposed data covered admissions between May and September 2026.
At Blueberry Pediatrics, a vulnerability in Metabase, a third-party business-intelligence tool, exposed records for 340,915 current and former patients, per HIPAA Journal’s report of October 28. The practice learned of the exploitation on August 22, 2026. A prescription-service provider called Photon separately told the practice on August 24 that a different threat actor had exploited its own systems.
At Denver Health Medical Plan, a vendor named SquareML, which provides AI and machine-learning analytics, inadvertently placed an access key on a public website on June 27, 2025. Denver Health did not learn of it until August 14, 2026, and the key was deactivated four days later. HIPAA Journal reports that the plan notified 238,083 members. The key allowed read-only access, and Denver Health found no evidence of misuse.
Put the three together and the pattern is plain. A governance failure (an unapproved tool, an unmonitored vendor key, an unpatched third-party platform) turned into a privacy event. Better perimeter security would not have stopped any of them.
HIPAA Journal’s August 2026 report counts 52 breaches of 500 or more records, a 34% drop from July and the second-lowest monthly total in the past 12 months. The 12-month average sits at 66 breaches per month. The headline count looks calmer than the record count, though. Those 52 breaches exposed 8,377,327 individuals, and year-to-date exposure for 2026 has reached 78.6 million people, up 14.8% from the same period in 2025.
July was the outlier. HIPAA Journal puts July’s exposure above 33 million people, so August’s total represents a 75% decline from a very high base. Individual breaches drive the swings. AdaptHealth alone accounted for 4,115,802 people in August, and Baylor Genetics added 2,810,878.
One more detail from that table deserves attention. Hacking and IT incidents made up 78.8% of August breaches but 98% of the people affected, which means attackers who get in tend to take a lot. Business associates filed only eight of the 52 reports, yet vendor-related incidents keep producing some of the largest notification lists, a pattern we return to below.
The latest monthly breakdown, from Paubox’s HIPAA Breach Report for October 2026, covers breaches that organizations reported to HHS during September. It lists 42 incidents affecting 500 or more people, with 1,043,266 individuals affected in total. That is an order of magnitude below July’s tally.
The composition changed more than the volume. Network server breaches affected 578,713 people across 30 incidents, the most common vector, but Paubox notes that this is the lowest network-server total in five years, down from 1,359,914 in 2025. Electronic medical record breaches moved the other way. They hit 414,273 people in just three incidents, compared with 16,281 a year earlier.
Two named entities led the month. The District of Columbia Department of Health Care Finance reported 399,086 people, and Clover Health reported 138,677. A small number of large filings again set the monthly total, which is why single-month swings tell you less than the year-to-date curve.
The Hopkins Bayview case offers the cleanest example of what security teams call shadow AI. A staff member, probably trying to save time, put a spreadsheet of patient information into a public AI platform. CBS Baltimore lists the exposed fields: patient names, admission and treatment dates, medical record numbers, account numbers, departments of service, medications administered, and provider names. Social Security numbers and financial account information were not involved.
That field list is still sensitive. Medication names plus a department and a date reveal a lot about a person’s health, and a medical record number can link back to a full chart. The hospital offered 12 months of credit monitoring through Experian IdentityWorks, though credit monitoring does little for a patient whose concern is clinical privacy, not identity theft.
Per CBS Baltimore, Hopkins directed the employee to delete the AI prompt, conversation thread, and document, and contacted the platform operator to request deletion. It reinforced training on handling protected health information, restricted unauthorized applications and AI tools, and educated staff on approved options. Deletion requests to a third-party AI operator carry no guarantee, and the public reporting does not say whether the operator confirmed removal.
The lesson reaches beyond one hospital. Banning public AI tools on paper changes little unless the network blocks them and an approved alternative exists. Clinicians and administrators reach for generative AI because it speeds up tedious work. If the sanctioned option is slow or missing, staff will use whatever is open in a browser tab. Teams building controls for AI access should look at the layered model we outlined in our piece on zero trust for AI agents, which applies the same logic to systems that act on a user’s behalf.
Third-party risk is not a new theme in healthcare, but this month’s vendor cases show how many quiet dependencies a modern practice carries. Blueberry Pediatrics ran a business-intelligence tool that attackers exploited. HIPAA Journal lists the exposed data as patient names, dates of birth, health plan names and policy numbers, medical records, dates of service, medical codes, and service charges. Photon’s separate incident touched names, addresses, phone numbers, email addresses, member IDs, and medication information. Photos, videos, financial information, and Social Security numbers were not compromised.
Blueberry says it applied the patch within hours of learning of the vulnerability, blocked unauthorized access, and changed passwords and security protocols. It also plans stronger authentication controls, more frequent security reviews, and monitoring for vulnerabilities in critical vendors. As of HIPAA Journal’s October 28 report, the incident had not yet appeared on the HHS Office for Civil Rights breach portal. The Oregon Attorney General had been informed of 340,915 affected people, and the Texas Attorney General had received two reports covering 60,581 and 7,249 residents.
The Denver Health episode shows a different failure. The SquareML access key sat on a public website for more than a year before anyone noticed. Nobody attacked Denver Health. A vendor’s configuration error created the exposure, and the plan’s own monitoring never saw it. That gap between “a vendor made a mistake” and “the covered entity knew about it” is where most vendor-driven breaches live. Our coverage of the Malaysia Airlines and Amadeus breach described the same dynamic outside healthcare, where a third party’s systems held customer data across a multi-year window.
A third case rounds out the month. BASS Medical Group discovered an incident on September 4, 2026, and began mailing notices on October 22. HIPAA Journal reports that a ransomware group has claimed responsibility and alleged it exfiltrated 100 GB of data. The group’s claim is unverified, and the practice has not publicly confirmed the volume or the number of people affected.
Florida has become a useful test case for state-level healthcare data governance. Fox Rothschild’s Healthcare Law Matters blog, in an October 2026 analysis by attorney Mark Clare of the firm’s Sarasota office, describes Florida as building a layered regulatory structure around where health data lives and who may touch it. The structure has three parts.
The insurance-code framework has already produced a real case. On March 23, 2026, Florida’s Office of Insurance Regulation moved against Mirra Health Care, LLC, a Brooksville-based third-party administrator licensed in 2012. According to Fox Rothschild’s summary, regulators found that Mirra delegated claims processing to four unlicensed offshore entities without advance written approval from the health maintenance organizations it served. The delegations affected 23,119 Medicare Advantage enrollees in Florida, mostly in special needs plans. Regulators also found missing contract cancellation provisions and a failure to produce one vendor contract during examination.
The penalty was a suspension of Mirra’s license, effective 31 days after execution of the order and lasting no more than one year, with a 30-day service continuation window to limit disruption to enrollees.
The Agency for Health Care Administration first floated its breach rule in August 2025. HIPAA Journal reported on August 29, 2025 that the proposal would require covered providers to report an information technology incident to the agency within 24 hours of determining that one occurred. It also required written contingency plans covering critical operations, regular and redundant backups with verified restores, and the production of police reports, forensics reports, and response documentation on request. A rule development workshop took place on September 17, 2025. Fox Rothschild now lists the measure as Proposed Rule 59A-35.112 and notes that it defines “data” more broadly than HIPAA or Florida’s information-protection law does, capturing non-clinical operational data. The firm also says it would bar off-site backups outside the continental U.S. These requirements would apply on top of existing HIPAA duties.
Fox Rothschild adds one limit worth knowing. The Electronic Health Records Exchange Act restricts where data is stored, but it does not prohibit real-time offshore access to a U.S.-hosted system as long as nothing is downloaded or cached locally. For global vendors with follow-the-sun support teams, that distinction decides whether their operating model survives.
Some compliance marketing in circulation treats the “2026 HIPAA Security Rule” as settled law. It is not. HHS’s Office for Civil Rights issued the notice of proposed rulemaking on December 27, 2024, and the Federal Register published it on January 6, 2025. It would be the first major rewrite of the Security Rule since 2013, and it aims to remove the “addressable” label that let covered entities skip certain safeguards.
According to Paubox, Alston and Bird, and HIPAA Journal, OCR had targeted May 2026 for final action and has since pushed that out. The Office of Management and Budget’s 2026 regulatory agenda now pencils in a final rule by July 2027, and the item has moved on the federal tracking site from the “final rule stage” to “long-term actions.” Compliance firms report that OCR is still working through more than 4,700 public comments. The current Security Rule remains fully in effect and enforceable until a final rule replaces it.
For compliance officers, that leaves a planning problem. Waiting for a final rule is a defensible budgeting decision, but the incidents above all involve basics the current rule already expects: risk analysis that includes vendors, access controls, and workforce training. A hospital that cannot show it assessed risks from third-party analytics tools or generative AI is exposed today, not in 2027.
Security teams often get funded for the thing they can see: firewalls, endpoint detection, and email filters. Governance covers the less visible questions of who is allowed to move patient data, where it may go, and who checks. October’s incidents hit the governance layer. No one at Hopkins Bayview had the technical means to stop a spreadsheet leaving for a public AI site. No one at Denver Health had a process that would catch a vendor’s key on a public page. No one at Blueberry Pediatrics could patch a third-party platform’s flaw before attackers got there.
Governance work usually starts with an inventory. Every system that stores or processes patient data needs an owner, a data classification, a documented location, and an exit plan. Few organizations can produce that list for their analytics stack, let alone for AI tools staff adopt on their own. Florida’s offshore rules force the issue in one dimension, because a provider cannot attest to in-country storage without knowing where its vendors’ backups sit.
Similar failures show up in other regulated sectors. When we covered the STP Nuclear Operating Company breach affecting 1,173 Texans, the common thread was the same: sensitive records reached outsiders through a process that nobody owned end to end.
The financial effects here are mostly analysis rather than reported fact, because the incident disclosures do not publish cost figures. Still, the direction of travel is visible. Three groups face pressure.
Public-company disclosures show how fast this kind of event reaches earnings. Boston Scientific cut its earnings outlook after a cyberattack, as we detailed in our look at the Boston Scientific guidance cut. Healthcare delivery and device companies are no longer far from that kind of exposure.
Federal rules, the proposed federal update, and Florida’s state approach differ in what they require and when. The table compares them using only the details documented above.
The comparison shows two different philosophies. The federal approach sets a national baseline and moves slowly. Florida targets specific risks (offshore storage, delegation, notification speed) and moves quickly. Providers that operate across states will probably end up building to the strictest standard, because running separate data architectures for each state costs more than meeting the highest bar once.
The last major rewrite of the Security Rule landed in 2013. That version assumed on-premises servers, desktop workstations, and paper-adjacent workflows. It predates generative AI, modern SaaS analytics, and the idea that a nurse might paste a spreadsheet into a chatbot. The 2024 proposal tried to close that gap, and it drew over 4,700 comments before stalling.
Florida’s offshore statute has an older lineage. The Electronic Health Records Exchange Act traces to Chapter 2009-172 of the Laws of Florida and was amended in 2023 by Chapter 2023-33. State officials have had the legal tools for years. What changed in 2026 is application: the Mirra order on March 23 turned a dormant statute into an active enforcement tool, and the AHCA’s proposed breach rule shows the agency wants visibility into incidents as they happen.
Year-to-date exposure of 78.6 million people also sets a backdrop. Even with month-to-month dips, the 2026 total is running ahead of 2025’s pace by 14.8%. Organizations that treated breach risk as a rare event now face an environment where affected-patient counts reach the tens of millions in a single quarter.
Regulatory timelines can slip, but the practical steps do not depend on them. Based on the incidents and the Fox Rothschild compliance priorities, a sensible 90-day sequence looks like this:
Teams that handle contact and clinical data through marketing and analytics vendors should also review incident handling at those partners. Our write-up of the Coinbase and Amplitude third-party incident shows how a vendor’s analytics environment can expose contact data even when the customer’s own systems hold firm. More security coverage sits in our security section.
These are analytical forecasts, not reported facts, and each rests on the evidence above.
Several caveats apply. Breach-count data from HIPAA Journal and Paubox covers filings to HHS, and organizations can submit reports weeks after discovery, so monthly totals shift as late filings arrive. Different outlets also report slightly different victim counts for the same incident (Hopkins Bayview appears as more than 3,100 at CBS Baltimore and 3,182 at HIPAA Journal), and this article uses the more specific figure where it exists.
The BASS Medical Group ransomware claim is unverified. The Denver Health and Hopkins incidents carry no confirmed evidence of misuse in the public record. And the proposed Florida rule is still a proposal, so its final text, effective date, and penalties may differ from the descriptions above. This analysis draws on named reports from HIPAA Journal, Paubox, CBS Baltimore, WYPR, and Fox Rothschild, and it does not rely on any claim we could not trace to those publications.
No. OCR proposed the update in a notice published on January 6, 2025, and it remains a proposal. The OMB’s 2026 regulatory agenda points to a final rule around July 2027. The existing Security Rule stays enforceable in the meantime.
An employee uploaded a spreadsheet of patient information to an unapproved public AI tool. HIPAA Journal lists 3,182 affected patients. The hospital found the problem on September 21, 2026, and mailed notification letters starting October 22. Social Security numbers and financial account details were not exposed.
HIPAA Journal’s August report puts the year-to-date total at 78.6 million individuals, up 14.8% from the same period in 2025. That count includes people who appear in multiple breaches, so it measures exposures rather than unique people.
Under Section 408.051(3) of the Florida Statutes, patient information stored in an offsite physical or virtual environment must be physically kept in the continental United States, its territories, or Canada. Licensed facilities and practitioners attest to compliance, and violations can trigger disciplinary action by the Agency for Health Care Administration.
It is Proposed Rule 59A-35.112. Covered providers would report an information technology incident to AHCA within 24 hours of determining that one has occurred, and they would maintain written continuity plans and tested backups. It is still a proposal and could change before adoption.
The two cases differ. Blueberry’s exposure came from exploitation of a vulnerability in Metabase, a third-party tool. Denver Health’s came from a vendor, SquareML, leaving a read-only access key on a public website, and Denver Health reported no evidence that anyone misused it.
Start with an inventory of every tool that touches patient data and where each stores it. Then block unapproved AI tools, ask vendors how they protect access keys and patch flaws, and restore-test your backups. Those steps cost little and address the failures seen this month.
The Shattered Newsletter
The week’s biggest stories in tech, gaming and security, in one email.
Free, once a week. Unsubscribe any time.
Tom Vance writes practical security explainers, from password hygiene to spotting social-engineering attacks, for readers who want the why and not just the what.
Independent explainers on cryptography, security, privacy and the technology behind provably-fair systems. Home of the original SHA-1 collision research.
The Shattered Newsletter: the week’s biggest stories in tech, gaming and security.
About the Author
