The breach wasn't at the company you gave your data to: six 2026 US healthcare breaches, and how to check a notice from a company you don't know

A vendor's letter usually names the provider you actually used, or says it's being sent on that provider's behalf. Xsolis's sample letter, for example, opens by explaining that your healthcare provider uses a vendor, Xsolis, for case and utilization management services. Baylor Genetics says it received patients' information from its third-party clients, such as the providers who ordered tests. Look first for a hospital, insurer or employer name you recognize.

Type ocrportal.hhs.gov into your browser yourself (not through a link or QR code in the letter), choose "View HIPAA Breach Reports", and look for the company. The list shows the entity name, state, type (provider or business associate), number of people affected and submission date. It only includes breaches affecting 500 or more people, and a vendor's breach is sometimes reported under the provider's name, so absence alone doesn't prove a letter is fake.

The California Attorney General's breach list (oag.ca.gov/privacy/databreach/list) posts the sample notification letter each company submits. Five of our six cases were listed there (we could not find NYC Health + Hospitals when we checked). Hold your letter next to the sample and compare the help line number, the domain of the credit monitoring enrollment site and the enrollment deadline. Samples are templates with names and codes left blank, so what you're checking is that the format and contact details match.

Genuine credit monitoring enrollment asks for your SSN, which is exactly why you should never enter it on a site you haven't verified. QR codes appear on genuine letters too (the Baylor Genetics and CareCloud samples both have enrollment QR codes), so don't judge by whether there's a QR code. Judge by whether the destination domain matches the sample filed with the state. Don't "confirm" your SSN, card number or password on a call or text you didn't initiate (see what is phishing?).

Enroll in the monitoring before the deadline. If your SSN was involved, place a credit freeze with Equifax, Experian and TransUnion, get an IRS IP PIN, and read your Explanation of Benefits statements for care you didn't receive. The full US checklist, including children, is on one page in our DentaQuest article. If online account credentials were involved, as NYC Health + Hospitals lists, change those passwords too.

EHR, billing and practice management, utilization management, benefits administration, lab work, record archiving. List every company that holds patient or member data, whichever department signed the contract, with the fields you hand over (including SSNs, ID scans or biometrics), the number of records and how many years. Most of these notices travel from vendor to provider to patient. Without that sheet, when a vendor calls you can't quickly say how many of your patients are affected and which fields. The approach is the same as a security inventory.

Federal regulations require business associate contracts to provide that the business associate will: (1) report to the covered entity any use or disclosure not provided for by the contract, including breaches (45 CFR 164.504(e)(2)(ii)(C)); (2) ensure its subcontractors agree to the same restrictions (paragraph (D)); and (3) at termination, if feasible, return or destroy all protected health information and retain no copies (paragraph (J)). Clause (3) only works if you have a step that confirms the return or destruction actually happened when the contract ended. Use the "ended contracts" column on your sheet to check whether former vendors still hold patient data.

Xsolis says its incident resulted from a targeted phishing attack. The US Cybersecurity and Infrastructure Security Agency (CISA) points to FIDO/WebAuthn (passkeys and FIDO2 security keys) as the widely available phishing-resistant option. Start with admin accounts that touch patient data, and remote access. Add one line to your vendor questionnaire at selection and renewal: "Do you use phishing-resistant MFA for admin accounts and remote access?" How code-based MFA gets handed over is covered in the DentaQuest article.

Unlimited Technology Systems' breach included scans of government IDs and insurance cards; NYC Health + Hospitals' included fingerprints and palm prints. SSNs and biometrics can't be changed. Going field by field through what you send each vendor and asking whether that job really needs it is the most reliable way to shrink the damage when a breach does happen.

As the letters show, every incident is followed by a review of whose records and which fields were affected. In general, if you know in normal times which files hold whose records and which fields, identifying affected people after an incident goes faster. For the overall baseline, see the minimum security baseline for organizations.