The 3.4 Million Patient Question — Jim Venuto

When TriZetto Provider Solutions disclosed that a breach had exposed records belonging to 3.4 million patients, most of the coverage focused on the company itself—its parent organization, the attack vector, the notification timeline. The facts, from the company’s notices and state filings: TriZetto, a Cognizant unit, found suspicious activity in a provider-facing web portal on October 2, 2025; an unauthorized actor had been accessing insurance eligibility verification records since November 2024; TriZetto began notifying affected providers in December 2025; patient letters followed in February 2026; and its March 2026 filing with the Maine Attorney General put the total at 3,433,965 people (Pafford EMS notice; BleepingComputer; Infosecurity Magazine). What got less attention was the downstream reality: thousands of healthcare practices, regional hospitals, and specialty clinics that had entrusted TriZetto with their claims processing, and who now faced their own regulatory obligations as a result of a breach they didn’t cause and couldn’t have prevented.

For a small or mid-size healthcare practice, the questions after a disclosure like this are predictable: “We use TriZetto. Are we affected? What do we have to do? Are we liable?” The honest answers are: probably, more than you think, and it depends on your business associate agreement.

This is the reality of healthcare data privacy in 2026. Your risk surface extends well beyond your own four walls. Every vendor that touches protected health information—claims processors, billing services, EHR platforms, transcription services, cloud storage providers—is a node in your compliance chain. When one of those nodes fails, the regulatory obligations flow back to you. The Office for Civil Rights does not accept “our vendor got hacked” as an answer to why you didn’t have appropriate safeguards governing that relationship.

A 40-physician orthopedic practice and a 4,000-bed hospital system have the same HIPAA obligations. They do not have the same resources. That disparity is where the risk concentrates.

Third-Party Risk Is the Primary Risk

The pattern repeats with numbing regularity. Since early 2024: Change Healthcare’s February 2024 ransomware attack disrupted claims processing for thousands of providers nationally, and Change Healthcare has told HHS that about 192.7 million people were affected (HHS OCR Change Healthcare FAQ). TriZetto’s disclosure added another 3.4 million. Smaller breaches at billing companies, transcription services, and cloud-hosted EHR platforms added thousands more, most never making national headlines but each triggering the same regulatory cascade for the covered entities downstream.

For a mid-size healthcare practice, the math is stark. A practice with 20 providers can easily have dozens of vendors touching PHI in some form. Each of those relationships should be governed by a HIPAA-compliant business associate agreement. Each vendor should have been assessed for adequate safeguards. Each should be monitored on an ongoing basis. In practice, many practices have BAAs with their major vendors—the EHR, the billing company, maybe the cloud provider—and little documentation beyond that. The transcription service. The patient messaging platform. The analytics tool the practice manager signed up for with a credit card. The AI-powered coding assistant the billing team started using last quarter. Each of those is a PHI exposure point, and many are ungoverned.

The BAA Gap

Many practices have business associate agreements with only a handful of their largest vendors, while far more vendors touch PHI. The gap between those numbers is unmanaged regulatory exposure.

The Assessment Gap

Having a BAA is necessary but not sufficient. HIPAA requires covered entities to assess whether their business associates have adequate safeguards. A signed agreement without due diligence is a compliance checkbox, not a control.

The Monitoring Gap

Vendor risk changes over time. The vendor you assessed two years ago may have changed ownership, infrastructure, or security posture. Without ongoing monitoring, your risk assessment is a historical document.

What OCR Expects—And What They Find

The Office for Civil Rights has been explicit in enforcement actions: a covered entity’s obligation to safeguard PHI does not end at the edge of its own network. When a business associate breach triggers a notification obligation, OCR investigators routinely examine whether the covered entity had appropriate oversight of that relationship. They look for a current, signed BAA. They look for evidence that the covered entity assessed the BA’s security practices. They look for documentation showing the CE monitored the relationship and took action when deficiencies were identified.

What they often find in mid-size practices is a signed BAA and little else. The BAA may be years old and may not reflect current data flows. The security assessment, if one exists, was often conducted at contract inception and never updated. Monitoring is typically nonexistent—no one reviews the BA’s security attestations (assuming they provide any), and no one verifies that the protections described in the BAA are actually in place.

This is not a hypothetical enforcement risk. OCR settlement agreements routinely cite inadequate business associate oversight as a contributing factor, even when the breach originated entirely at the business associate. The covered entity did not cause the breach. But the covered entity failed to manage the risk. In OCR’s framework, those are related failures.

Post-Breach Regulatory Checklist for Downstream Covered Entities

If your business associate has disclosed a breach, these are your immediate obligations:

Obtain the BA’s formal breach notification to you as a covered entity—not the press release, the actual HIPAA-compliant notification with specific data elements affected
Determine whether your patients’ PHI was included. If the BA cannot confirm exclusion, assume inclusion.
Review your BAA to determine breach notification responsibilities. Who notifies patients? Who notifies OCR? Who bears the cost?
If patient notification falls to you, the 60-day clock from the date of discovery (your discovery, not the BA’s) begins now
Document everything. Your response to this event is itself auditable. The documentation trail is your defense.
Assess whether additional safeguards are needed. Should you restrict data sharing with this BA? Require enhanced security attestations? Transition to an alternative?

Rural and Regional Healthcare: Disproportionate Exposure

The practices most exposed by a breach like TriZetto’s are not large hospital systems with compliance departments and legal teams on retainer. They are four-provider family medicine practices, regional urgent care chains with a handful of locations, behavioral health groups with a dozen clinicians, and solo surgeons with a shared office staff of three. These organizations have the same HIPAA obligations as any covered entity. They do not have the same infrastructure to meet them.

Rural and regional healthcare practices face a compounding problem. They are more dependent on third-party service providers because they lack the scale to build capabilities internally. They are more vulnerable to vendor breaches because they have fewer alternatives and less leverage to demand security assurances. And they have the least capacity to respond when a breach occurs—no CISO, no privacy officer (or one who carries that title alongside three others), and no incident response retainer.

Picture a four-provider family practice with one person handling billing, compliance, credentialing, and human resources. Three days after the disclosure, she still hasn’t determined whether the practice’s patients were affected because she can’t get a straight answer from the vendor’s notification process. She has no template for a breach response. She has no relationship with a privacy attorney. And she has a genuine question, asked with a mix of frustration and anxiety: “How am I supposed to do all of this?”

The answer is not that she needs to hire a full-time CISO. The answer is that she needs access to the expertise on a basis that matches her scale. Eight hours a month with someone who understands HIPAA, can manage vendor risk, and can coordinate breach response is worth more than a policy manual gathering dust.

Building a Vendor Privacy Program That Actually Works

A vendor privacy program for a mid-size healthcare practice does not need to be elaborate. It needs to be real. The difference between a program that protects the practice and a binder that satisfies an auditor is operational: does someone actually review these agreements, assess these vendors, and track these relationships? Or is it paperwork?

The Four-Part Vendor Privacy Framework

Inventory: List every vendor, service, and tool that touches PHI in any form. Include the obvious ones (EHR, billing, clearinghouse) and the ones people forget (patient communication apps, cloud fax services, transcription tools, AI coding assistants). If it touches PHI, it’s on the list.

Agreements: Every vendor on the list needs a current BAA. Not a BAA from 2019 that references data flows that no longer exist. A current agreement that reflects how PHI actually moves between your practice and that vendor today.

Assessment: For your top-tier vendors (highest volume of PHI, most critical to operations), conduct a basic security assessment. This can be a questionnaire, a review of their SOC 2 report, or a conversation with their security team. Document what you found. For lower-tier vendors, a lighter-touch review is acceptable—but document that you made a risk-based decision about the level of review.

Monitoring: Set a calendar. Review your vendor inventory annually. Re-assess high-risk vendors when contracts renew or when you become aware of a material change (acquisition, breach, infrastructure change). This doesn’t require a platform. It requires a calendar entry and someone accountable for doing the work.

A practice like that can implement this framework in about three weeks. The inventory might take two days and turn up vendors no one had identified as handling PHI—a patient intake form tool, a cloud-based scheduling service. Updated BAAs can be in place within ten days. A security assessment of the top five vendors (EHR, billing service, clearinghouse, lab interface, and cloud backup) can be completed in a week. After that, ongoing monitoring becomes a recurring quarterly task.

The effort is modest. The reduction in regulatory exposure is substantial. When the next vendor breach disclosure arrives—and it will—the practice will have documentation showing they managed the relationship with reasonable diligence. That documentation is the difference between a defensible position and an OCR finding.

Five Questions for Healthcare Practice Leaders

How many vendors in your practice touch PHI? If the number you can name off the top of your head is less than 10, you are likely undercounting.
When was the last time you reviewed and updated your business associate agreements? If the answer is “when we signed them,” they may not reflect current data flows.
If your largest vendor disclosed a breach tomorrow, do you know your notification obligations and timeline?
Who in your practice is accountable for vendor privacy oversight? If the answer is “no one specifically,” that is the gap.
Have you assessed whether any of your staff are using AI tools with patient data? Shadow AI in healthcare is a PHI exposure that many practices have not yet addressed.

The TriZetto breach will fade from the headlines. The next one will take its place. The practices that weather these events without regulatory consequence are not the ones that got lucky. They are the ones that built a manageable, documented, actively maintained vendor privacy program before the breach letter arrived. That work is available to any practice willing to invest a few weeks of focused effort. The alternative—discovering your exposure in the middle of someone else’s crisis—is more expensive in every way that matters.

References

U.S. Department of Health and Human Services, Office for Civil Rights. (2024). HIPAA Enforcement Highlights.

Infosecurity Magazine. (2026, March 9). TriZetto Provider Solutions Breach Hits 3.4 Million Patients. infosecurity-magazine.com

BleepingComputer. (2026, March 6). Cognizant TriZetto breach exposes health data of 3.4 million patients. bleepingcomputer.com

Office of the Maine Attorney General. (2026, March). Data breach notification: TriZetto Provider Solutions. maine.gov

Pafford Medical Services. (2026, February). Notice of data breach. paffordems.com

U.S. Department of Health and Human Services, Office for Civil Rights. (2025). Change Healthcare Cybersecurity Incident Frequently Asked Questions. hhs.gov

Healthcare Info Security. (2026). Navigating Cybersecurity Obstacles in Rural Healthcare.