In May 2026, healthcare data breaches rose 27.1% from the previous month, yet the number of affected individuals dropped by 34.8%. The HHS Office for Civil Rights breach portal recorded 61 large breaches affecting 879,447 individuals, down from April's average of 28,116 individuals per breach. This isn't due to improved security, it's the absence of mega-breaches that usually skew the numbers.
Hacking incidents still accounted for 88.5% of reported breaches, a consistent threat vector in healthcare. This pattern demands a reassessment of how you test cybersecurity controls and manage third-party risks.
What the Numbers Reveal About Control Gaps
Hacking incidents compromised 853,532 individuals' protected health information across 54 breaches in May. Network servers were the most common breach location, followed by email systems.
Seven breaches used placeholder estimates of 500 or 501 individuals, indicating organizations reached their 60-day HIPAA notification deadline before completing forensic investigations. While technically compliant, this signals inadequate incident response capabilities, something your audit program should flag.
Business associate breaches accounted for 22 of the 61 incidents, yet only 10 were reported by the associates themselves. This gap shows covered entities are taking on notification responsibilities for vendor failures, complicating audit trails and accountability.
Key Findings That Should Reshape Your Audit Approach
Network server vulnerabilities remain unaddressed. The prevalence of server-based breaches shows a lack of defense-in-depth controls. Your audit should verify whether entities have segmented networks, deployed endpoint detection and response tools on servers, and enforced the Principle of Least Privilege for administrative access. Test whether these controls are configured correctly and monitored actively.
Email security controls are failing. Multiple breaches resulted from unauthorized email access. This is a technical control failure, not a training issue. Audit whether multi-factor authentication is enforced for all email access, whether conditional access policies block logins from impossible travel scenarios, and whether mailbox audit logging is configured and reviewed.
Incident response timelines expose preparation gaps. Organizations using placeholder estimates couldn't determine breach scope within 60 days. This suggests they lack documented data flow maps, current asset inventories, and tested incident response procedures. Your audit should verify these elements exist before an incident occurs.
Third-party risk management isn't working. With business associates involved in 36% of breaches, vendor due diligence is inadequate. Audit whether your organization requires SOC 2 Type II reports from business associates handling electronic protected health information, whether business associate agreements include specific security requirements from HIPAA Security Rule § 164.308-316, and whether vendor security assessments happen annually.
Placeholder reporting creates compliance risk. Reporting 500 individuals as a placeholder can lead to issues. If the actual count exceeds 500, organizations must file an amended report. If it's under 500, they've triggered unnecessary regulatory scrutiny. Audit whether incident response plans include forensic investigation timelines that allow accurate counts before the 60-day deadline.
What This Means for Your Audit Program
You can't audit cybersecurity like financial controls. A checklist confirming that policies exist won't identify configuration errors and monitoring gaps that enable breaches.
Start testing whether security controls operate as designed. If your organization claims to enforce multi-factor authentication, attempt to log in without it from a test account. If network segmentation is documented, verify whether a workstation on the general network can reach database servers directly. If privileged access is supposedly restricted, check whether former administrators still have elevated credentials.
Expand your business associate audit procedures beyond contract review. Request evidence that vendors have completed HIPAA Security Rule risk assessments under § 164.308(a)(1)(ii)(A), not generic cybersecurity assessments. Verify whether your organization receives and reviews vendor SOC 2 reports and whether someone with technical expertise actually reads the complementary user entity controls section.
Test incident response capabilities before incidents occur. Schedule tabletop exercises that simulate ransomware attacks or email compromises. Verify whether your team can identify which systems contain protected health information, determine the scope of compromise, and meet notification deadlines. If they can't do this in a controlled exercise, they won't manage it during an actual breach.
Priority Actions for Internal Auditors
Immediate (next 30 days): Review your organization's breach notification procedures. Confirm whether documented data flow maps exist for all systems containing protected health information. If your organization would need to use a placeholder estimate today, that's your highest-priority finding.
Short-term (next quarter): Audit technical controls on network servers and email systems. Test whether Privileged Access Management is enforced, whether Just-in-Time Access is used for administrative functions, and whether audit logs capture privileged actions. Verify email security beyond basic spam filtering, check conditional access policies and account compromise detection.
Medium-term (next six months): Assess business associate risk management. Inventory all vendors with access to protected health information. Confirm current business associate agreements include required HIPAA Security Rule provisions. Obtain and review SOC 2 Type II reports, focusing on whether trust services criteria align with your security requirements.
Ongoing: Shift from compliance checklists to control effectiveness testing. Document not just whether controls exist but whether they operate correctly under realistic conditions. Report control gaps in terms of breach likelihood and potential impact, not just regulatory citations.
The 88.5% hacking incident rate isn't changing because organizations keep auditing the same way. Your audit program needs to test whether controls actually prevent the attacks that are already happening, not just whether policies document what should happen.
