Two healthcare organizations disclosed data breaches in November 2026, revealing a significant control gap. One involved a business associate whose employee outsourced their job, while the other was a hospital network spotting suspicious activity. Both cases highlight how much damage can occur before controls detect a problem.
Breach Details
Sutherland Healthcare Solutions, a HIPAA business associate, revealed that an employee allowed an unauthorized individual to perform their work duties, accessing data from July 29, 2024, to July 10, 2026. Exposed information included names, addresses, birth dates, health plan details, Social Security numbers, and claims data. No malicious intent or data misuse was identified.
Hoag Memorial Hospital Presbyterian, a nonprofit hospital network in Orange County, California, detected suspicious network activity on October 8, 2026. Forensic experts confirmed unauthorized access, and by October 25, 2026, Hoag confirmed exposure of personal and protected health information. Notification letters were sent in early November.
Neither organization disclosed the number of affected individuals.
Key Findings
1. Insider events can be reportable breaches. The Sutherland access wasn't malicious, but it exposed sensitive data to an unauthorized person. Under the HIPAA Privacy Rule and the HIPAA Security Rule, unauthorized access to protected health information is presumed a breach unless a risk assessment shows a low probability of compromise.
2. Detection time is critical. Sutherland's breach lasted nearly two years, while Hoag acted within weeks. This highlights the difference between network monitoring and verifying user identity. Most systems focus on the former and overlook the latter.
3. Credential legitimacy vs. user legitimacy. In Sutherland's case, valid credentials were used by an unauthorized person. Controls focusing only on account permissions can miss unauthorized users.
4. Business associates carry risk. Sutherland's breach required health plans to notify affected individuals, showing how vendor incidents affect clients under the HIPAA Security Rule and the Health Information Technology for Economic and Clinical Health Act.
5. Post-breach responses are standard. Both organizations offered identity theft protection and enhanced security measures. Regulators will focus on pre-incident controls.
Implications for Your Team
As a CISO, consider whether your organization can distinguish between employees and stand-ins. This is especially challenging for remote and offshore workforces handling sensitive tasks.
Several control frameworks apply. Under the NIST Cybersecurity Framework (CSF) 2.0, focus on the Govern and Detect functions. NIST SP 800-53 provides specific guidance: Personnel Security (PS) for screening, Audit and Accountability (AU) for log review, and Access Control (AC) for duties separation. ISO/IEC 27002 covers similar areas, including screening and monitoring.
The HIPAA Security Rule's administrative safeguards require system activity reviews and workforce security. An audit log without behavioral analysis is ineffective.
For third-party risks, ensure your business associate agreements are backed by verification of vendor controls. Attestations alone won't catch long-term unauthorized access.
Action Items by Priority
Immediate (this quarter):
- Review user activity for inconsistent patterns, such as unusual login locations or session timings.
- Ensure high-sensitivity data access is logged and reviewed regularly.
- Inventory business associates with access to protected health information, focusing on those with remote workforces.
Next Steps (this half):
- Add identity-assurance requirements to vendor contracts, including workforce verification and credential sharing prohibitions.
- Strengthen authentication with phishing-resistant multi-factor methods and periodic re-verification.
- Apply Role-Based Access Control and the Principle of Least Privilege to sensitive roles, with regular entitlement recertification.
Long-Term (this year):
- Move toward Zero Trust Architecture, considering device posture and behavior in access decisions.
- Rehearse insider-threat scenarios with your Computer Security Incident Response Team, focusing on breach notification timelines.
- Test detection speed against benchmarks like Hoag's response time.
