{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,10,6]],"date-time":"2026-10-06T19:52:30Z","timestamp":1791316350672,"version":"4.3.1"},"reference-count":32,"publisher":"JMIR Publications Inc.","content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["JMIR Med Inform"],"abstract":"Abstract<\/jats:title>\n \n Background<\/jats:title>\n Health care organizations increasingly rely on business associates (BAs) to provide clinical, administrative, and technology services that require access to protected health information. While the Health Information Technology for Economic and Clinical Health (HITECH) Act and the Health Insurance Portability and Accountability Act (HIPAA) Omnibus Rule extended legal liability to BAs, the frequency and characteristics of data breaches involving BAs have not been systematically tracked across the entire post-HITECH reporting era. Understanding these trends is critical for health information managers and cybersecurity professionals who are directly responsible for managing third-party risk.<\/jats:p>\n <\/jats:sec>\n \n Objective<\/jats:title>\n The author examined the longitudinal trends in BA involvement in health care data breaches reported to the US Department of Health and Human Services (HHS) Office for Civil Rights (OCR) from 2009 to 2025, including changes in frequency, breach mechanisms, breach locations, and severity profiles of BA-involved incidents across 3 regulatory periods.<\/jats:p>\n <\/jats:sec>\n \n Methods<\/jats:title>\n The author conducted a retrospective longitudinal analysis of health care data breaches (N=6612) reported to the HHS OCR breach portal between October 2009 and December 2025. The author operationalized BA involvement as breaches reported by BA entities or flagged as BA-related. Using logistic regression models, the author estimated annual trends in BA involvement, breach mechanism, and breach location. Chi-square tests assessed associations between BA status and breach characteristics across 3 regulatory periods: pre-Omnibus (2009\u20102013), post-Omnibus (2014\u20102019), and 2020\u20102025. Proportion tests compared BA-involvement rates across periods.<\/jats:p>\n <\/jats:sec>\n \n Results<\/jats:title>\n \n BA-involved breaches accounted for 1950 of 6612 (29.5%) incidents and 285,718,494 (48.8%) of all affected individuals. The annual BA-involvement rate increased from 22.1% in the pre-Omnibus period to 36.6% in the 2020\u20102025 period (\n z<\/jats:italic>\n score=8.29,\n P<\/jats:italic>\n <.001). Logistic regression confirmed an 8% annual increase in the odds of BA involvement (odds ratio [OR] 1.08, 95% CI 1.07\u20101.10;\n P<\/jats:italic>\n <.001). Hacking\/IT incidents shifted from a minority of incidents to the dominant breach mechanism (OR 1.41 per year, 95% CI 1.39\u20101.44;\n P<\/jats:italic>\n <.001), and the odds of network server breaches increased by 29% per year (OR 1.29, 95% CI 1.26\u20101.31;\n P<\/jats:italic>\n <.001). BA-involved breaches were significantly more concentrated in hacking (1282\/1950, 65.7% vs 2351\/4662, 50.4%) and network server locations (1084\/1950, 55.6% vs 1435\/4662, 30.8%) compared with non-BA breaches (\n P<\/jats:italic>\n <.001). The proportion of mega breaches (\u2265100,000 individuals) also increased annually (OR 1.16, 95% CI 1.13\u20101.19;\n P<\/jats:italic>\n <.001), with BA-involved breaches exhibiting a significantly higher rate of mega breaches (12.4% vs 8.2%;\n \u03c7<\/jats:italic>\n 2<\/jats:sup>\n 1<\/jats:sub>\n =28.44;\n P<\/jats:italic>\n <.001).\n <\/jats:p>\n <\/jats:sec>\n \n Conclusions<\/jats:title>\n Building on prior evidence linking BA involvement to breach severity, this study demonstrates that BA-involved health care data breaches accelerated substantially across the post-HITECH reporting era, with the steepest increase beginning in 2020. The concurrent growth of hacking and the concentration of breaches on network servers coincided with digital transformation, cloud migration, and the ransomware epidemic, which may have amplified third-party risk exposure. Health information managers and cybersecurity professionals should prioritize BA risk management strategies that account for the evolving threat landscape, including enhanced vendor security assessments and data compartmentalization requirements.<\/jats:p>\n <\/jats:sec>","DOI":"10.2196\/93588","type":"journal-article","created":{"date-parts":[[2026,8,18]],"date-time":"2026-08-18T18:40:07Z","timestamp":1787078407000},"page":"e93588-e93588","source":"Crossref","is-referenced-by-count":0,"title":["Business Associates\u2019 Involvement in US Health Care Data Breaches: Longitudinal Analysis"],"prefix":"10.2196","volume":"14","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-8320-3457","authenticated-orcid":false,"given":"Martin","family":"Ignatovski","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"1010","published-online":{"date-parts":[[2026,10,6]]},"reference":[{"key":"R1","unstructured":"Health Insurance Portability and Accountability Act of 1996 (HIPAA). Centers for Disease Control and Prevention. 2024. URL: https:\/\/www.cdc.gov\/phlp\/php\/resources\/health-insurance-portability-and-accountability-act-of-1996-hipaa.html [Accessed 03-09-2026]"},{"key":"R2","unstructured":"Summary of the HIPAA security rule. US Department of Health and Human Services. 2026. URL: https:\/\/www.hhs.gov\/hipaa\/for-professionals\/security\/laws-regulations\/index.html [Accessed 03-09-2026]"},{"key":"R3","unstructured":"Breach portal: notice to the secretary of HHS breach of unsecured protected health information. US Department of Health and Human Services, Office for Civil Rights. 2024. URL: https:\/\/ocrportal.hhs.gov\/ocr\/breach\/breach_frontpage.jsf?faces-redirect=true [Accessed 03-09-2026]"},{"issue":"2","key":"R4","doi-asserted-by":"publisher","DOI":"10.3390\/healthcare8020133","article-title":"Healthcare data breaches: insights and implications","volume":"8","author":"Seh","journal-title":"Healthcare (Basel)"},{"issue":"3","key":"R5","doi-asserted-by":"publisher","first-page":"346","DOI":"10.1080\/19393555.2021.2017522","article-title":"An analysis of data breaches in the U.S. healthcare industry: diversity, trends, and risk profiling","volume":"31","author":"Lee","journal-title":"Inf Secur J A Glob Perspect"},{"issue":"3","key":"R6","doi-asserted-by":"publisher","first-page":"893","DOI":"10.25300\/MISQ\/2017\/41.3.10","article-title":"When do IT security investments matter? Accounting for the influence of institutional factors in the context of healthcare data breaches","volume":"41","author":"Angst","journal-title":"MIS Q"},{"key":"R7","doi-asserted-by":"publisher","DOI":"10.1016\/j.maturitas.2018.04.008","article-title":"Cybersecurity in healthcare: a narrative review of trends, threats and ways forward","volume":"113","author":"Coventry","journal-title":"Maturitas"},{"key":"R8","unstructured":"Modifications to the HIPAA privacy, security, enforcement, and breach notification rules under the Health Information Technology for Economic and Clinical Health Act and the Genetic Information Nondiscrimination Act; other modifications to the HIPAA rules. Office of the Federal Register, National Archives and Records Administration; 2013. URL: https:\/\/www.govinfo.gov\/content\/pkg\/FR-2013-01-25\/pdf\/2013-01073.pdf [Accessed 03-09-2026]"},{"issue":"4","key":"R9","doi-asserted-by":"publisher","first-page":"269","DOI":"10.2967\/jnmt.119.227819","article-title":"Review of HIPAA, part 1: history, protected health information, and privacy and security rules","volume":"47","author":"Moore","journal-title":"J Nucl Med Technol"},{"issue":"6","key":"R10","doi-asserted-by":"publisher","first-page":"501","DOI":"10.1056\/NEJMp1006114","article-title":"The \u201cmeaningful use\u201d regulation for electronic health records","volume":"363","author":"Blumenthal","journal-title":"N Engl J Med"},{"issue":"1","key":"R11","doi-asserted-by":"publisher","DOI":"10.2196\/31246","article-title":"Key challenges and opportunities for cloud technology in health care: semistructured interview study","volume":"9","author":"Cresswell","journal-title":"JMIR Hum Factors"},{"issue":"4","key":"R12","volume":"19","author":"Ignatovski","journal-title":"Perspect Health Inf Manag"},{"issue":"2","key":"R13","doi-asserted-by":"publisher","first-page":"150","DOI":"10.1089\/tmj.2020.0201","article-title":"Applications of e-health to support person-centered health care at the time of COVID-19 pandemic","volume":"27","author":"Tebeje","journal-title":"Telemed J E Health"},{"key":"R14","doi-asserted-by":"publisher","DOI":"10.2196\/46904","article-title":"Vulnerability to cyberattacks and sociotechnical solutions for health care systems: systematic review","volume":"26","author":"Ewoh","journal-title":"J Med Internet Res"},{"issue":"4","key":"R15","doi-asserted-by":"publisher","DOI":"10.2196\/21747","article-title":"Health care cybersecurity challenges and solutions under the climate of COVID-19: scoping review","volume":"23","author":"He","journal-title":"J Med Internet Res"},{"issue":"2","key":"R16","first-page":"78","volume":"24","author":"Gabriel","journal-title":"Am J Manag Care"},{"issue":"Summer","key":"R17","volume":"16","author":"Dolezel","journal-title":"Perspect Health Inf Manag"},{"key":"R18","doi-asserted-by":"publisher","DOI":"10.1016\/j.dss.2018.02.007","article-title":"Cyber-analytics: modeling factors associated with healthcare data breaches","volume":"108","author":"McLeod","journal-title":"Decis Support Syst"},{"key":"R19","unstructured":"Ignatovski M . Contributing factors to the number of individuals impacted by data breaches in healthcare organizations [dissertation]. Capitol Technology University; 2021. URL: https:\/\/media.proquest.com\/media\/hms\/PFT\/2\/oqlKM?_s=iJIAwK5edfJFWVFYLvZeIbrqYG0%3D [Accessed 03-09-2026]"},{"issue":"3","key":"R20","doi-asserted-by":"publisher","first-page":"198","DOI":"10.1177\/18333583231158886","article-title":"For-profit versus non-profit cybersecurity posture: breach types and locations in healthcare organisations","volume":"53","author":"Ignatovski","journal-title":"Health Inf Manag"},{"issue":"4","key":"R21","doi-asserted-by":"publisher","first-page":"539","DOI":"10.1016\/j.bushor.2019.03.010","article-title":"Muddling through cybersecurity: insights from the U.S. healthcare industry","volume":"62","author":"Abraham","journal-title":"Bus Horiz"},{"issue":"8","key":"R22","doi-asserted-by":"publisher","DOI":"10.2196\/37756","article-title":"Twenty years of the Health Insurance Portability and Accountability Act safe harbor provision: unsolved challenges and ways forward","volume":"10","author":"Krzyzanowski","journal-title":"JMIR Med Inform"},{"issue":"1","key":"R23","doi-asserted-by":"publisher","DOI":"10.1093\/cybsec\/tyy004","article-title":"The costs of consumer-facing cybercrime: an empirical exploration of measurement issues and estimates","volume":"4","author":"Riek","journal-title":"Journal of Cybersecurity"},{"issue":"5","key":"R24","doi-asserted-by":"publisher","DOI":"10.1001\/jamanetworkopen.2025.10180","article-title":"Ransomware attacks and data breaches in US health care systems","volume":"8","author":"Jiang","journal-title":"JAMA Netw Open"},{"issue":"3","key":"R25","doi-asserted-by":"publisher","first-page":"609","DOI":"10.1007\/s12553-025-01036-9","article-title":"Third-party risk in U.S. health care ransomware incidents: business associate involvement and breach size","volume":"16","author":"Cornejo","journal-title":"Health Technol"},{"issue":"1","key":"R26","doi-asserted-by":"publisher","first-page":"175","DOI":"10.3390\/appliedmath3010011","article-title":"Analyzing health data breaches: a visual analytics approach","volume":"3","author":"Raghupathi","journal-title":"AppliedMath"},{"key":"R27","unstructured":"Framework for improving critical infrastructure cybersecurity: version 1.1. National Institute of Standards and Technology (NIST); 2018. URL: https:\/\/www.nist.gov\/publications\/framework-improving-critical-infrastructure-cybersecurity-version-11 [Accessed 03-09-2026]"},{"key":"R28","unstructured":"HITRUST. 2023. URL: https:\/\/www.hitrustalliance.net [Accessed 03-09-2026]"},{"key":"R29","doi-asserted-by":"publisher","DOI":"10.2196\/59674","article-title":"Patient health record protection beyond the Health Insurance Portability and Accountability Act: mixed methods study","volume":"26","author":"Subramanian","journal-title":"J Med Internet Res"},{"key":"R30","doi-asserted-by":"publisher","DOI":"10.1177\/20552076251343959","article-title":"Data privacy in healthcare: global challenges and solutions","volume":"11","author":"Conduah","journal-title":"Digit Health"},{"key":"R31","unstructured":"Electronic health information: HHS needs to improve communications for breach reporting. United States Government Accountability Office (GAO); 2022. URL: https:\/\/www.gao.gov\/products\/gao-22-105425 [Accessed 03-09-2026]"},{"issue":"7","key":"R32","doi-asserted-by":"publisher","first-page":"8639","DOI":"10.1007\/s10586-024-04507-2","article-title":"Data breaches in healthcare: security mechanisms for attack mitigation","volume":"27","author":"Nemec Zlatolas","journal-title":"Cluster Comput"}],"container-title":["JMIR Medical Informatics"],"original-title":[],"language":"en","deposited":{"date-parts":[[2026,10,6]],"date-time":"2026-10-06T19:15:33Z","timestamp":1791314133000},"score":1,"resource":{"primary":{"URL":"https:\/\/medinform.jmir.org\/2026\/1\/e93588"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,10,6]]},"references-count":32,"URL":"https:\/\/doi.org\/10.2196\/93588","relation":{},"ISSN":["2291-9694"],"issn-type":[{"value":"2291-9694","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,10,6]]},"article-number":"v14i2e93588"}}