What happened
Paubox, in an article dated June 30, 2026, reported that more than 19 million people were affected by healthcare data breaches in the first six months of 2026. Citing the HHS Office for Civil Rights breach portal, it reported 189 large breaches, of which 173 were attributed to hacking and IT incidents, 14 to unauthorized access or disclosure, one to theft and one to loss.
Paubox also reported that seven of the ten largest breaches in the period involved a business associate or a vendor system. It listed North Texas Behavioral Health Authority among the ten largest, at 285,086 affected individuals.
What we have not verified
We have not read the OCR breach portal ourselves, and portal counts change as entries are added or revised, so the figures above are as of the article’s date. We have not verified the Paubox statements about the number of vendor related breaches beyond what the article reports.
Analysis: The pattern in these figures is hacking first, with vendors and business associates showing up in most of the largest incidents. An ABA clinic rarely runs its own servers. Its records, billing, scheduling, portal and telehealth all live with vendors, which means a clinic’s exposure is often decided by how those vendors are chosen and tracked. The practical questions are whether every vendor that touches PHI is on a list, whether each has a current business associate agreement, and whether the risk analysis treats each of those vendors as a named system rather than a line item called third parties. This is reporting, not legal advice.
Compliance you can actually show.
WiseUpHIPAA is built for ABA clinics. It works out what applies to you, holds your decisions and the evidence behind them, and shows you honestly where you stand, including the parts that are not done yet.