3.76 Million Patient Records Left Through One Vendor’s EHR Cloud. The Practices Could Not Audit It.

TLDR: The CareCloud breach shows a practice’s patient data is only as isolated as its vendor’s shared cloud, so business associate oversight has to collect tenant-isolation evidence alongside the signed agreement.

One incident, contained to one environment, reached 3.76 million people

CareCloud sells electronic health record (EHR), practice-management and revenue-cycle services, and its annual report states that it served approximately 45,000 providers in about 2,900 practices and hospitals¹ at the end of 2025. Its clients range from single-doctor independent practices to large medical groups¹. Under the Health Insurance Portability and Accountability Act (HIPAA), a vendor in that position is a business associate: it holds protected health information on behalf of the practices, which remain the covered entities answerable to their patients.

In March 2026 that structure was tested. CareCloud’s Form 8-K, its current report to the US Securities and Exchange Commission (SEC), told investors that a network disruption in its CareCloud Health division affected 1 of its 6 electronic health record environments² for about eight hours on 16 March, and that the company believed the incident was contained to that environment. The notice letter CareCloud later filed with the California Attorney General adds the window: between 10 and 16 March 2026, an unauthorised third party accessed one of CareCloud’s Amazon Web Services (AWS) environments³, and claimed to have taken data from databases inside it.

The federal record gives the scale. The breach portal of the Department of Health and Human Services (HHS) Office for Civil Rights (OCR) lists CareCloud, Inc. as a business associate with 3,756,469 individuals affected⁴ by a hacking incident on a network server. The OCR total of 3,756,469 is the vendor’s single figure for that incident.

The data was the full identity file. The Texas Attorney General’s record for the incident lists Social Security numbers, driver’s licence and government identity numbers, account and card numbers⁵, medical information, health insurance information and dates of birth, for 270,529 Texans alone.

The disclosure ran 130 days from the disruption to the federal filing

The public record moves in a fixed order, and each step is written by CareCloud or a regulator. CareCloud determined on 24 March that the incident was material² and filed the 8-K on 27 March. Its letter states that it established on 24 June which data³ the affected records may have included, 100 days after the disruption. CareCloud’s report to OCR carries a submission date of 24 July⁴, and Texas published its record on 18 August⁵ with notice sent to residents by post.

Read the table from a practice’s side. The OCR entry carries the business associate’s name, so a practice owner scanning the portal for exposure finds the vendor and a single total. The practice’s own share of that total arrives through the vendor, on the vendor’s schedule. HIPAA sets the outer limit of that schedule: a business associate must notify the covered entity without unreasonable delay and in no case later than 60 calendar days⁶ after discovering a breach. Anything faster is a term the practice negotiates.

A business associate agreement records a promise, and the regulation stops at that promise

HHS describes the business associate agreement (BAA) as the instrument through which a covered entity obtains satisfactory assurances that the business associate will appropriately safeguard the information⁷, and it names EHR vendors and cloud service providers among the parties who need one. The Security Rule, part of the Code of Federal Regulations (CFR), says the same at 45 CFR 164.308(b)(1)⁸: a covered entity may let a business associate hold electronic protected health information once it obtains those assurances.

The contract content is fixed at 45 CFR 164.504(e)⁹. The vendor agrees to use appropriate safeguards, to report unauthorised uses and breaches, to bind its subcontractors, and to return or destroy the data at termination. One clause grants inspection rights: paragraph (e)(2)(ii)(I) makes the vendor’s internal practices, books and records available to the Secretary of HHS. The regulation’s model of oversight places the audit right with the federal government. Any audit right the practice holds is one it wrote into the contract itself.

The duty to act also turns on knowledge. HHS guidance requires a covered entity that knows of a pattern of activity or practice that constitutes a material breach⁷ to take reasonable steps to cure it, and to terminate the agreement where feasible. Knowledge is the trigger, and on a shared platform the practice’s knowledge comes from the vendor. Under 45 CFR 164.314(a)(2)(i)(C)¹⁰ the vendor must report security incidents it becomes aware of, which keeps the practice downstream of the vendor’s own detection.

Agency adds a second clock, and it can run against the practice. A practice’s own duty to notify its patients runs no later than 60 calendar days after discovery¹¹, and 45 CFR 164.404(a)(2) treats a breach as known to the practice once it is known to any workforce member or agent of the practice, determined under the federal common law of agency. Where the vendor qualifies as the practice’s agent, the practice is deemed to know what the vendor knows, and both 60-day windows start on the same day. A practice sees the vendor’s environment through the vendor’s reports and can still be held to the vendor’s knowledge of it. Whether the vendor is an agent or an independent contractor turns on the relationship the agreement creates, which makes the contract’s control and reporting terms a compliance question as much as a commercial one.

This is where multi-tenancy matters. A signed BAA describes conduct. Tenancy describes architecture: whether a practice’s records sit in their own database, in a schema beside other customers, or in one environment with thousands of them. The CareCloud 8-K draws its containment line at the environment, the unit CareCloud itself treated as the boundary. For a practice inside that environment, the blast radius was the environment. The contract elements in 164.504(e) cover conduct and leave unspecified which environment holds a practice’s patients and who else shares it.

A vendor register lists every supplier, the data it holds and the basis for holding it. Kainjoo .life set out that discipline for health marketing in its piece on a register with a named approver for every vendor¹². The CareCloud record shows the column that register usually lacks: the vendor’s tenancy, and the evidence behind it.

The proposed Security Rule adds yearly written verification, still at proposal stage in October 2026

HHS has already drafted the control this article argues for. The Notice of Proposed Rulemaking (NPRM) published on 6 January 2025 would require a regulated entity to obtain written verification from the business associate at least once every 12 months¹³ that it has deployed the technical safeguards in 45 CFR 164.312. The verification would include a written analysis of the vendor’s relevant systems by a person with cybersecurity expertise, and a certification signed by someone with authority to bind the vendor. The same proposal would add a BAA term obliging the vendor to report activation of its contingency plan within 24 hours.

The rule remains a proposal. As of 14 October 2026, the Federal Register lists the January 2025 proposed rule as the only document¹⁴ under its regulation identifier number (RIN), 0945-AA22, and the final rule is still to be published. Until a final rule appears, yearly verification and the 24-hour clock exist only where a practice writes them into its own agreements. The draft gives practices a ready specification to borrow.

Ten questions expose whether a vendor’s cloud is shared

The vendor isolation audit below turns the proposed verification into questions a practice can send this month. Each one asks for a document the practice can check against the vendor’s own disclosures.

Questions 1, 2 and 3 carry the weight. A vendor that answers them with a named environment, a tenant count and a dated cross-tenant test has told the practice its blast radius. A vendor that answers with a copy of the signed BAA has restated the assurance the practice already holds. Questions 7 and 9 borrow directly from the proposed rule, so a vendor that meets them today is ready for the final text whenever it arrives.

CareCloud’s own filings set the benchmark for what a vendor can disclose. After the incident, its 8-K named the division, the count of EHR environments² and the length of the disruption, and its letter named the hosting provider and the access window³. A vendor able to publish those facts to investors and regulators after an incident can give the same facts to its customers before one, under a confidentiality clause if needed. The same facts requested in advance work as a control before any incident.

Monday actions: list every vendor, ask for evidence, set a 30-day deadline

The practice owner starts with an inventory: every business associate that holds patient records, from the EHR and practice-management platform to billing, transcription, patient messaging and cloud backup. For each one, the inventory records the BAA date, the person who signed it, and whether the agreement makes the vendor the practice’s agent, because that status decides when the practice’s own notification clock starts.

The compliance lead sends the ten questions to every vendor on that list, with a written reply deadline of 30 days. Replies go into the vendor register next to the BAA, with the date each request went out and the date the evidence came back, so the next annual review starts from a dated baseline, and a vendor that declines questions 1 to 3 is marked for renegotiation at the next renewal, with the notification clock and an audit right for the practice added as terms.

The information technology (IT) lead checks the replies against what the practice can see: a log export actually run, a named environment that matches the vendor’s own disclosures, a deletion procedure tested on a sample. The reply log then records, per vendor, whether the practice ran the test itself or received a document.

Practices that want this audit run against their own vendor list, with the questions adapted to their platforms, can talk to Kainjoo Life.

This article has been reviewed by Haider Alleg, Managing Partner at Kainjoo SA.

References

1. CareCloud, Inc. Annual Report on Form 10-K for the fiscal year ended 31 December 2025. SEC EDGAR, 2026. https://www.sec.gov/Archives/edgar/data/1582982/000149315226009872/form10-k.htm
2. CareCloud, Inc. Current Report on Form 8-K, Item 1.05 Material Cybersecurity Incidents. Date of report 24 March 2026, filed 27 March 2026. https://www.sec.gov/Archives/edgar/data/1582982/000149315226013239/form8-k.htm
3. CareCloud, Inc. Notice of Data Breach (sample consumer letter filed with the California Attorney General). 2026. https://oag.ca.gov/system/files/CareCloud_-_SSN_39739837v1.pdf
4. U.S. Department of Health and Human Services, Office for Civil Rights. Breach Portal: Cases Currently Under Investigation (entry: CareCloud, Inc., submitted 24 July 2026). Accessed 14 October 2026. https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf
5. Office of the Texas Attorney General. Data Security Breach Reports (entry: CareCloud, Inc., published 18 August 2026). Accessed 14 October 2026. https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage
6. Electronic Code of Federal Regulations. 45 CFR 164.410, Notification by a business associate. https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-D/section-164.410
7. U.S. Department of Health and Human Services. Business Associates (HIPAA guidance). https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/business-associates/index.html
8. Electronic Code of Federal Regulations. 45 CFR 164.308, Administrative safeguards. https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C/section-164.308
9. Electronic Code of Federal Regulations. 45 CFR 164.504, Uses and disclosures: Organizational requirements. https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.504
10. Electronic Code of Federal Regulations. 45 CFR 164.314, Organizational requirements. https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C/section-164.314
11. Electronic Code of Federal Regulations. 45 CFR 164.404, Notification to individuals. https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-D/section-164.404
12. Kainjoo .life. 1% of Health Marketers Can Tie Half Their Spend to Outcomes. 27 August 2026. https://kainjoo.life/health-marketing-measurement-consent-gap/
13. U.S. Department of Health and Human Services. HIPAA Security Rule To Strengthen the Cybersecurity of Electronic Protected Health Information (proposed rule, RIN 0945-AA22). 90 FR 898, 6 January 2025. https://www.federalregister.gov/documents/2025/01/06/2024-30983/hipaa-security-rule-to-strengthen-the-cybersecurity-of-electronic-protected-health-information
14. Federal Register. Documents search: regulation identifier RIN 0945-AA22. Accessed 14 October 2026. https://www.federalregister.gov/documents/search?conditions%5Bregulation_id_number%5D=0945-AA22