What happened
Paubox, in a report dated September 15, 2026, reported on breaches affecting 500 or more people that were reported to HHS in August 2026. It reported 34 breaches affecting 7,690,666 individuals in total.
By type, it reported 22 network server breaches, 10 email breaches and 2 involving paper or films. It reported that network server breaches affected 7,621,331 people and email breaches affected 63,903 people. It named AdaptHealth, LLC as the largest breach at 4,115,802 people and Baylor Genetics as the second largest at 2,810,878 people.
What we have not verified
We have not read the OCR breach portal ourselves, and portal figures change as entries are added or revised, so these are the figures as the outlet reported them on its date. The report does not break out vendor or business associate breaches or behavioral health providers, and we are not inferring those.
Analysis: Two breach types account for almost all of the incidents, and one of them is email. Server side breaches usually sit with whoever hosts the systems, which for many small clinics is a vendor, but email is something a clinic controls directly. Where email carries PHI, the useful checks are whether messages are protected in transit, whether staff know what may not be sent, and whether the risk analysis lists email by system. The very large totals come from a few big breaches, so the count of incidents says more about how common they are than the total number of people does. This is reporting, not legal advice.
Compliance you can actually show.
WiseUpHIPAA is built for ABA clinics. It works out what applies to you, holds your decisions and the evidence behind them, and shows you honestly where you stand, including the parts that are not done yet.