Healthcare Breaches in 2026: Can Your Team Prove What Was Read?

566 large healthcare breaches reached HHS between January 1 and September 21, 2026. After a breach, one question shapes the notice and much of what follows: which records did the attacker read? Here is what the reports, the regulations and the fines say, and how to make that answer provable.

If an attacker had access to your patient data last month, how long would it take your team to prove which records they opened?

For many organizations, the answer is weeks or months, and sometimes the records needed to answer it do not exist. That gap shapes the size of breach notices, the scope of regulatory investigations and the exposure in class actions. This post looks at what the 2026 numbers show, what HIPAA requires, what regulators have enforced, and how to make "what did they read?" a question your team can answer in hours.

2026 in numbers

We counted every large breach (500 or more people) posted to the HHS Office for Civil Rights breach portal between January 1 and September 21, 2026:

• 566 breaches affecting 76.7 million people.
• 85% were hacking or IT incidents, and they account for 97% of the people affected.
• 72% listed a network server as the location of the breached information.
• 202 involved a business associate, the vendors that handle PHI for providers and health plans.

2025 set the record, with more than 800 large breaches on the HHS portal. The three largest so far in 2026 are DentaQuest (15 million people), Aesto Health (9.5 million) and Lumexa Imaging (5.8 million).

Industry reports point the same way:

• IBM Cost of a Data Breach 2026: healthcare again had the highest average breach cost of any industry worldwide, at $6.64 million.
• BakerHostetler 2026 Data Security Incident Response Report: healthcare was the most affected sector, at 27% of the more than 1,250 incidents the firm handled in 2025. 35% of its healthcare incidents came from vendors.

The attack ends in the data layer

Ransomware used to mean encrypted servers. Today it often means stolen data, with or without encryption.

Verizon's 2026 Data Breach Investigations Report says System Intrusion is still the top breach pattern in healthcare, driven largely by ransomware, with attackers getting in through stolen credentials or exploited vulnerabilities. BakerHostetler found that 72% of the network intrusions it handled in 2025 involved data exfiltration. It notes that attackers increasingly rely "only on exfiltration as leverage, including incidents involving access to or exfiltration of entire databases, sometimes without encrypting systems at all." Sophos's 2025 healthcare survey found that extortion without encryption tripled, to 12% of attacks, the highest rate of any sector it surveyed.

Three 2026 notices show where the access happened:

• CareCloud told the SEC that an unauthorized third party gained access to a cloud account supporting one of its electronic health record environments. Its notice to patients says the party accessed one of its AWS environments between March 10 and 16, 2026, and claimed to have taken data from databases there. HHS lists 3,756,469 people affected.
• One Medical says an unauthorized person gained access to a third-party file storage system that held archived records and was able to access patient files between June 8 and 11, 2026.
• DentaQuest says unauthorized individuals accessed data on its computer network between May 17 and 20, 2026, and that affected information was later posted on the internet.

In all three, the notices describe access to stored patient data in a cloud environment, a file store or a company network. Under HIPAA, the scope of that access sets who must be notified.

"May have been accessed": why notices get so broad

HIPAA starts from a presumption. Under 45 CFR 164.402, an impermissible access to PHI "is presumed to be a breach" unless the organization demonstrates a low probability that the information has been compromised. One of the four factors it must weigh is "whether the protected health information was actually acquired or viewed."

Without records of what was actually read, that factor is hard to support. So many organizations take the cautious path and notify everyone whose data sat in systems the attacker could reach.

Many 2026 notices use this conditional wording. Aesto Health, a health data archiving vendor, said a security incident affected "a limited portion" of its Amazon Web Services infrastructure, with access from about December 2 to December 18, 2025. After "an extensive forensic investigation and manual document review," it said in May 2026 that patient information "may have been accessed and/or acquired." Its HHS filing lists 9,540,683 people. Insightin Health, a health plan data analytics vendor, told people they were receiving a letter because their information "was in the files that may have been accessed." Notices use cautious wording for many reasons, and these examples do not show why each company chose it.

Mandiant states the general risk plainly in M-Trends 2026: "If you cannot prove the scope of an intrusion due to logging gaps, you risk a loss of customer trust by being forced to assume and disclose a worst-case data theft."

The rules are getting more specific

The current HIPAA Security Rule already requires the basics:

• Audit controls, 164.312(b): "hardware, software, and/or procedural mechanisms that record and examine activity in information systems that contain or use electronic protected health information."
• Information system activity review, 164.308(a)(1)(ii)(D): regularly review records such as "audit logs, access reports, and security incident tracking reports."
• Unique user identification, 164.312(a)(2)(i): assign a unique name or number "for identifying and tracking user identity."
• Breach notification: notify individuals without unreasonable delay, and no later than 60 calendar days after discovery. A business associate must notify the covered entity on the same timeline and identify each affected person, to the extent possible.

Several changes are coming or already here:

• HIPAA Security Rule update (proposed). The January 2025 proposal would require organizations to record "in real-time all activity" in relevant systems, including access to and copying of ePHI. It would also require encryption, MFA and an asset inventory with a map of how ePHI moves. It is still a proposed rule, and the current federal regulatory agenda projects final action in July 2027.
• New York hospitals, 10 NYCRR 405.46. Fully in force since October 2025. It requires audit trail records kept for at least six years, controls to "monitor the activity of authorized users and detect unauthorized access," least-privilege access and incident reporting within 72 hours.
• FTC Health Breach Notification Rule. For health apps and other companies outside HIPAA, unauthorized access is presumed to be acquisition unless the company has reliable evidence that it was not, and violations can cost up to $53,088 each.
• 42 CFR Part 2. OCR began enforcing the confidentiality rules for substance use disorder records in February 2026, with penalties aligned to HIPAA.

What it costs: fines, settlements and lawsuits

Civil money penalties. HHS adjusted HIPAA penalties for inflation in January 2026. Per violation, penalties now run from $145 in the lowest culpability tier to $2,190,294 for uncorrected willful neglect, and $2,190,294 is also the published calendar-year cap for identical violations. Since 2019, HHS has applied lower annual caps to the less culpable tiers as a matter of enforcement discretion.

OCR enforcement keeps naming the same issues. Every Security Rule settlement OCR announced in 2026, through October 12, cited a failure to conduct an accurate and thorough risk analysis. Several also cited the record keeping this post is about. Settlements resolve potential violations and are not findings of liability.

• Ambry Genetics paid $700,000 in September 2026. PHI of 225,370 people was potentially exfiltrated. The potential violations OCR listed include not assigning a unique name or number to identify and track users in systems that hold ePHI, and lacking procedures to end access when employment ends.
• Four ransomware settlements announced in April 2026 totaled $1,165,000 and covered more than 427,000 people.
• OSF HealthCare paid $552,250 in July 2026 after ransomware exfiltrated PHI of 53,907 people. OCR also cited late notice to individuals and to HHS.
• Warby Parker: OCR announced a $1.5 million civil money penalty in February 2025, imposed in December 2024. One of the three violations was a failure to regularly review records of information system activity.
• BayCare Health System paid $800,000 in 2025 after the credentials of a former staff member at a physician practice were used to access a patient's records. The potential violations OCR listed included a failure to regularly review information system activity.
• Northeast Radiology paid $350,000 in 2025 after unauthorized individuals accessed radiology images on its PACS server for about nine months. Its corrective action plan requires a written process to review audit logs and access reports.

State attorneys general are acting too. New York's attorney general secured $500,000 from OrthopedicsNY in December 2025 and required "a system designed to monitor networks and systems for anomalous activity." Connecticut and Massachusetts settled with Comstar, an ambulance billing vendor, for $515,000 in January 2026. In September 2026, a multistate coalition settled with LabCorp for $2,287,455 over a breach at one of its vendors.

Class actions often follow large breaches. Duane Morris counted about 1,822 data privacy class actions filed in 2025. Yale New Haven Health agreed to an $18 million settlement over a 2025 breach that affected about 5.6 million people. In June 2026, the Judicial Panel on Multidistrict Litigation centralized 19 lawsuits over the TriZetto breach in a single federal court, and flagged nine more as related cases.

Slow investigations cost more. IBM found that breaches with a lifecycle over 200 days cost $5.65 million on average, against $4.32 million for those resolved faster. The average breach took 247 days to identify and contain.

Why the read logs are often missing

Most data platforms can record reads. Object stores and common databases such as S3, PostgreSQL and MongoDB do not do it by default, and the platforms that do keep the records for days or months, not years.

A few details matter in an investigation:

• S3 server access logs are best effort. AWS says "the completeness and timeliness of server logging is not guaranteed." CloudTrail data events are more dependable, and cost $0.10 per 100,000 events.
• ClickHouse Cloud keeps query_log on each node. Querying the log on one replica shows only that replica's activity, so investigators must query all replicas.
• Redshift system tables keep seven days of history unless you export them.
• MongoDB warns that logging successful reads degrades performance, which is one reason it is often left off.
• Shared service accounts erase the "who." If five applications use one database user, the log shows the user, not the application. HIPAA's unique user identification requirement exists to close exactly this gap.

Retention is the other mismatch. HIPAA does not set a retention period for raw logs, but it requires six years for Security Rule documentation, and New York hospitals must keep audit trail records for six years. Mandiant warns that standard 90-day log retention is not enough: in one set of espionage cases, attackers stayed hidden for an average of 393 days.

How to make "what did they read?" answerable

• Map where PHI lives. OCR's own guidance starts here: identify where ePHI is located and how it enters, moves through and leaves your systems. Include warehouses, data lakes, archives and vendor environments.
• Turn on read logging for every store that holds PHI. Enable CloudTrail data events on PHI buckets, and use advanced event selectors to keep the cost down. Turn on pgAudit, Redshift user activity logging and Databricks verbose audit logs where PHI lives, and confirm that Snowflake accounts holding PHI run Enterprise Edition or above so ACCESS_HISTORY is available.
• Give every application and person its own identity. Retire shared database users and service accounts, and tie each role and key to a named owner.
• Keep the records longer than an attacker can hide. Export system tables before they roll off. Aim for at least 12 months, and agree on a retention period with counsel.
• Learn who reads what, and alert on change. The HHS 405(d) cybersecurity practices recommend user behavior analytics to catch "downloading an unusual number of records," and alerts when access to sensitive files crosses set thresholds. Two practical signals to start with are new readers on sensitive tables and unusually large reads.
• Review and document. HIPAA requires regular activity review. NIST SP 800-66r2 says to consider automating it.
• Ask your vendors the same question. 202 of this year's 566 large breaches involved a business associate. Your business associate agreement should say how fast a vendor can tell you which of your patients' records were read.
• Rehearse it. Run a tabletop where a service account key leaks, and give the team 24 hours to name the records it read.

Takeaway

Many healthcare breaches now end with someone reading patient data, and with a notice that says it "may have been accessed." HIPAA already requires audit controls and activity review, and OCR has cited activity review in recent enforcement. Turn on read logging where PHI lives, give every identity its own name, keep the records long enough, and practice answering one question: what did they read?

Where Trailox fits

Trailox reads the access logs and metadata your data platforms produce, across more than 10 data platforms, including S3 (with Iceberg, Delta Lake and Hudi tables), Snowflake, Databricks, ClickHouse and Redshift. It ties each logged read to the role or key that made it and, where the logs allow, to the person, service account or AI agent behind it. It learns who normally reads which data, and flags new readers and unusual volumes. It can also look back over past activity, as far back as your retained logs go.

It is agentless and read-only, and it does not read the contents of your tables or files. It cannot see reads that were never logged, so the logging steps above come first. It helps you see reads sooner and gives you evidence to scope an incident, rather than starting from the worst case.

FAQ

Does HIPAA require logging who reads PHI? The Security Rule requires audit controls that "record and examine activity" in systems that contain ePHI, and regular review of audit logs and access reports. It does not name specific log types. The proposed 2025 update would require real-time recording of all activity, including access to ePHI, but it is not final.

If we cannot tell what was accessed, do we have to notify everyone? HIPAA presumes a breach unless you can demonstrate a low probability of compromise, and one required factor is whether PHI was actually acquired or viewed. Without read-level records, many organizations notify everyone whose data was reachable. Talk to counsel about your specific case.

How long should we keep access logs? HIPAA does not set a retention period for raw audit logs. It requires six years for Security Rule documentation, such as policies and records of required reviews, and New York hospitals must keep audit trail records for six years. Many native logs keep only 7 to 365 days, so plan an export and agree on a retention period with counsel.

Are S3 object reads logged by default? No. S3 server access logs and CloudTrail data events are both off by default.

Sources

This post draws only on public filings, notices and regulator announcements. Naming an organization does not suggest that it failed to meet its obligations, or that any product would have changed the outcome of its incident.

• HHS Office for Civil Rights, Breach Portal: large breaches submitted January 1 to September 21, 2026 (Trailox analysis, October 12, 2026)
• 45 CFR 164.308, 164.312, 164.316, 164.402, 164.404 and 164.410; 45 CFR 102.3, as adjusted at 91 FR 3665 (January 28, 2026)
• HHS OCR press releases: Top of the World Ranch (February 19, 2026), MMG Fusion (March 5, 2026), four ransomware settlements (April 23, 2026), Spencer Gifts health plans (June 18, 2026), OSF HealthCare (July 29, 2026), Ambry Genetics (September 17, 2026), Warby Parker (February 20, 2025), BayCare (May 28, 2025), Northeast Radiology (April 10, 2025)
• HIPAA Security Rule proposed rule, 90 FR 898 (January 6, 2025), and the Unified Agenda entry for RIN 0945-AA22
• IBM, Cost of a Data Breach Report 2026
• Verizon, 2026 Data Breach Investigations Report
• Mandiant, M-Trends 2026 Executive Edition
• Sophos, The State of Ransomware in Healthcare 2025
• BakerHostetler, 2026 Data Security Incident Response Report
• HHS 405(d), Health Industry Cybersecurity Practices (2023 edition); NIST SP 800-66r2
• 10 NYCRR 405.46; FTC Health Breach Notification Rule, 16 CFR Part 318
• Company notices and filings: Aesto Health, Insightin Health, CareCloud, One Medical, DentaQuest
• New York, Connecticut, Massachusetts and Michigan attorney general announcements; JPML MDL No. 3185 transfer order; Duane Morris Class Action Review 2026
• AWS, Snowflake, Databricks, ClickHouse, PostgreSQL, pgAudit and MongoDB product documentation