A revenue-cycle vendor found unauthorized access in its network last October. Patients did not hear about it until July. By then, the affected count was 3.8 million people.

Unlimited Technology Systems is now one of the largest healthcare breaches disclosed this year — behind DentaQuest in our tracking, and ahead of the TriZetto cascade from Q1. The delay is bad enough on its own. But the more useful detail is what was exposed: not just database fields, but scanned documents — licenses, insurance cards, intake forms — the kind of messy files many practices barely inventory.

Also this window: DentaQuest's number is now listed on the OCR portal, at exactly the figure we told you about last issue. And a familiar brand disclosed a breach involving data from a company it acquired roughly five years ago — still sitting in a vendor's storage system the whole time.

Since the last issue, August 5

No historical mega-breaches resurfaced with fresh dates this window — the check we run every issue came back clean this time.

DentaQuest is now listed at 15 million

Last issue, we told you DentaQuest had reportedly acknowledged at least 15 million affected, separate from the roughly 4.5 million that state filings could directly support at the time. HHS OCR now lists the figure at exactly 15,000,000. That is the confirmation we were waiting for. The unofficial 23M+ estimate remains just that: unofficial, and still unconfirmed by OCR.

Old data from an old acquisition, still sitting in a vendor's system

One Medical disclosed that an unauthorized party accessed a third-party file-storage system on June 13, 2026, with actual access dated June 8–11. The system held archived records for One Medical Seniors, formerly Iora Health, which One Medical acquired in 2021. Roughly five years later, those legacy patient files were still sitting in a vendor's storage platform. Current One Medical patient data was not involved, according to the company. But the operational question is obvious: when you change vendors, merge practices, or inherit records through an acquisition, who confirms the old data is actually gone?

There's a second HIPAA rule targeted for this month, too

The Security Rule update we've covered all summer isn't the only one in motion. A separate Privacy Rule update — faster patient access to records, in-person inspection and photographing of PHI, more room for family and caregiver involvement in care — was first released in late 2020 and published in the Federal Register in January 2021, then mostly sat still for years. OCR revived it this year, held a Tribal consultation in February, and the federal regulatory agenda now targets a final rule for August 2026. We checked and could not confirm it has actually published yet. If it lands before our next issue, we'll cover it properly. If your compliance calendar only has the Security Rule on it, this is the one to add.

A note on this issue's data

One entity we checked this window showed an implausible affected count that didn't match any independent reporting we could find, and closely matched a different, already-reported breach's figure. We held it back rather than publish a number we couldn't verify.

Seven issues in, the same problem keeps showing up in different forms. A vendor finds something. Months pass. Patients eventually hear about it. By then, the practice or health system is left answering for a timeline it did not fully control. Unlimited Technology Systems isn't a new kind of story so much as a very large version of the one we keep seeing.

Next Pulse drops September 2.

Editorial coverage at hipaapulse.com. Operational response at patient-protect.com/hipaa-pulse. This briefing comes from Patient Protect.