Third-party vendors are tied to 41% of the major health data breaches reported to federal regulators so far in 2026, affecting 9.94 million people-nearly half of all breach victims this year. Security experts warn that rapidly advancing AI tools will make these attacks faster and more effective, putting healthcare organizations at even greater risk through their business associates.
Vendor breaches dominate 2026 health data incidents
As of July 10, the U.S. Department of Health and Human Services listed 351 major health data breaches in 2026, affecting nearly 20.7 million people. Business associates were involved in 145 of those incidents, accounting for roughly 48% of affected individuals. Tom Walsh, founder of privacy and security firm tw-Security, said the percentage of breaches tied to third parties has climbed from around 25% in 2010 to 41% this year.
"This means third parties are a major cybersecurity problem for healthcare," Walsh said. The 2024 ransomware attack on UnitedHealth Group's Change Healthcare IT services unit, which affected nearly 193 million people, underscored the scale of damage a single vendor compromise can cause. That year, business associates were at the center of 30% of major breaches but accounted for 78% of patients affected by hacks.
Regulatory delay leaves security gaps
Federal regulators proposed updating the HIPAA Security Rule in 2024 to convert several addressable safeguards-including multifactor authentication, encryption, segmentation, and vulnerability scanning-into mandatory requirements. The update would also require covered entities to obtain annual written verification that business associates have implemented the controls. But HHS recently pushed the final rule to at least 2027, and some observers doubt it will be taken up at all under the current administration.
Mike Hamilton, CISO emeritus of Datec and former CISO of Seattle, said the delay gives organizations another reason to postpone critical defenses. "This suggests that there is a real effort underway to identify the 'unlocked window' to crawl through in order to get to the real victim, as well as inadequate controls deployed at these third parties," he said.
AI accelerates the threat
New AI systems such as Anthropic's Mythos can generate exploit code, identify vulnerabilities, and automate reconnaissance, dramatically increasing the speed and scale of attacks. Hamilton noted that business associates are the least likely to invest in the tools needed to detect these AI-driven methods. "The adversary is known to be more nimble and adaptable than typical business associates," he said.
Walsh emphasized that AI itself won't cause more breaches, but it will help attackers and expand the amount of data third parties handle, creating more opportunities for incidents. "Attacks are becoming larger, more sophisticated-perhaps because of AI-and increasingly concentrated around third-party service providers rather than individual healthcare organizations," he said.
Even healthcare organizations with mature security programs remain vulnerable. Walsh pointed out that the fear of public breach notifications, along with PCI DSS compliance and cyber insurance requirements, have become the main drivers for new safeguards-not HHS rules. But a single compromised vendor can still trigger a reportable breach.
Why this matters for healthcare
Healthcare organizations cannot wait for regulatory mandates to address third-party risk. With AI-enabled attacks accelerating, the security posture of every vendor, software provider, and business associate directly impacts patient data safety. Leaders must now enforce rigorous security standards across their vendor ecosystem-requiring multifactor authentication, encryption, and regular audits-or face larger, more concentrated breaches that exploit the weakest link in the supply chain.
Your membership also unlocks:
