Introduction 

This week, Unlimited Technology Systems – an Ohio-based revenue cycle management and practice management software provider serving more than 4,500 oncology practices and 6,500 specialty providers – confirmed that a breach in its commercial datacenter exposed the protected health information of 3,803,750 people. It is now the largest healthcare data breach reported to U.S. regulators in 2026, surpassing the 3.4-million-record breach at TriZetto Provider Solutions earlier this year. 

The intrusion happened between October 5 and October 10, 2025. UTS didn’t disclose it publicly until July 2026, and didn’t confirm the full scale until this week – a gap of close to nine months between attack and public accounting. 

No ransomware group has claimed responsibility. UTS has not named an attacker or explained how access was gained. What is confirmed: names, Social Security numbers, dates of birth, government ID scans, insurance policy numbers, claims data, medical record numbers, and diagnosis information for millions of patients who, in most cases, had never directly interacted with UTS at all. 

At Periscope Tech, we work with healthcare organizations and their technology vendors on exactly the exposure this breach represents. This isn’t a story about a hospital getting hacked. It’s a story about the vendor layer underneath every hospital – and why that layer is where 2026’s biggest breaches keep originating. 

What Is a Business Associate Breach, and Why Does It Matter More Than a Hospital Breach? 

A business associate breach is a data breach at a vendor that handles protected health information on behalf of a healthcare provider or health plan, rather than at the provider itself. Under HIPAA, these vendors – billing companies, software platforms, cloud hosts, revenue cycle management firms – are held to the same security obligations as the hospitals and clinics they serve. 

What makes a business associate breach different is scale. A single hospital breach exposes that hospital’s patients. A single vendor breach exposes every patient of every provider that vendor serves – which is exactly why a 4,500-practice software company can produce a bigger breach than most individual hospital systems ever will. 

Six of the top ten healthcare data breaches reported so far this year happened at business associates, not at providers directly. UTS is simply the newest and largest entry on that list. 

Reason 1: Patients Have No Relationship With the Vendor That Just Exposed Them 

Most of the 3.8 million people affected by this breach have likely never heard of Unlimited Technology Systems. They chose an oncologist or a specialty provider – not a revenue cycle management platform running in the background of that provider’s billing operation. 

Why This Makes the Risk Harder to Manage 

A patient can evaluate the security posture of the doctor they walk into. They have no visibility into, and no ability to evaluate, the dozens of software vendors that provider relies on to manage claims, billing, and records. That evaluation burden falls entirely on the healthcare organization – and most organizations still treat vendor risk as a one-time questionnaire at contract signing, not an ongoing, verified relationship. 

How Zero Trust Helps 

• Continuous vendor access verification, instead of a point-in-time security questionnaire that goes stale the day it’s signed 

• Least-privilege data sharing, so a vendor handling billing doesn’t have standing access to full clinical records it never needs 

• Segmented data flows, so a compromise at one vendor’s data center doesn’t cascade into every downstream provider relationship 

Business Impact: Providers stop inheriting the full blast radius of every vendor’s worst day. 

Reason 2: A Nine-Month Gap Between Breach and Disclosure Is a Detection Problem, Not Just a Reporting Problem 

UTS detected unauthorized activity in its datacenter on October 19, 2025 – nine days after the intrusion window closed. Public disclosure of the breach’s true scale didn’t happen until August 2026. That timeline means the compromised data was circulating, potentially being sold or used for fraud, for the better part of a year before affected patients could even take protective action like credit monitoring. 

Why Detection Lag Keeps Happening 

Traditional perimeter security is built to notice an intrusion when something breaks – a system goes down, a ransom note appears. A quiet data exfiltration, where an attacker copies files and leaves without disrupting operations, can sit undetected for months because nothing on the surface looks wrong. 

How Zero Trust Helps 

• Continuous behavioral monitoring of data access patterns, flagging unusual volume or unusual destinations even when systems keep running normally 

• Immutable, real-time audit logging, so forensic reconstruction takes days, not the months UTS needed 

• Automated anomaly alerts tied to specific data classes – an alert on unusual access to SSNs and diagnosis codes fires long before a human notices anything is wrong 

Business Impact: Shrinks the gap between compromise and containment from months to days – which is also the gap regulators are increasingly unwilling to tolerate. 

Reason 3: The Same Vendors Bleeding Data Are the Ones Deploying AI the Fastest 

UTS’s breach has not been linked to any AI system, and nothing here suggests it was. That’s precisely what makes the moment worth pausing on. Revenue cycle management and billing platforms – the exact category UTS sits in – are among the fastest adopters of AI agents for claims processing, coding, and administrative automation, because that’s where the labor cost savings are largest. 

Every one of those AI agents needs the same access to patient data that a human biller would have. If the underlying vendor infrastructure can be breached by a conventional intrusion with no AI involved at all, an AI agent layered on top of that same infrastructure inherits every one of those weaknesses – plus new ones, like being manipulated through the data it processes. 

How Zero Trust Helps 

• Treats every AI agent as its own identity, scoped to only the data it needs, not inherited standing access from the human role it replaced 

• Applies the same continuous verification to vendor AI systems as to vendor employees, so a vendor’s AI rollout doesn’t quietly expand your risk surface 

• Requires vendors to prove it, not just claim it – audit trails covering both human and AI access, reviewable on demand 

Business Impact: AI adoption at your vendors stops being an unknown you inherit and becomes something you can actually verify. 

How Periscope Tech Helps Organizations Close the Vendor Gap 

We built PDI Checker around a simple principle: an executive shouldn’t have to take a system’s word for it — they should be able to see the audit trail themselves. We apply that same standard to vendor and AI agent access through our Secure Access Platform. 

Our approach includes: 

Vendor & Business Associate Risk Mapping 

We identify every vendor and sub-vendor with access to your patient data, including the AI tools those vendors have layered on top of legacy systems. 

Zero Trust Access Architecture 

We design and implement continuous verification, least-privilege access, and segmentation across every vendor connection into your environment. 

Continuous Monitoring & Audit Logging 

We provide real-time visibility into vendor and AI agent data access, closing the detection gap that let the UTS breach run undetected for months. 

Compliance Alignment 

We help organizations meet HIPAA’s business associate oversight requirements with evidence, ahead of the proposed Security Rule update’s tighter vendor obligations. 

The Biggest Healthcare Breaches of 2026 Aren’t Happening at Hospitals – They’re Happening Behind Them 

UTS is now the largest healthcare breach of the year. It won’t be the last vendor to hold that title before 2026 is over. The pattern is consistent: attackers have realized that breaching one billing platform or software vendor is far more efficient than breaching hospitals one at a time – and as those same vendors race to bolt AI agents onto the same underlying infrastructure, the blast radius of the next breach only grows. 

Zero Trust for vendors and AI agents alike means verifying every connection into your patient data continuously – not trusting a vendor because they signed a Business Associate Agreement once and never asking again. 

Want to know which of your vendors carries this same exposure? Book a 20-minute Vendor & AI Risk Review and get a specific list of the connections into your environment worth a second look – no generic audit, just what applies to you. 

Website: periscope-tech.com 

Book a 20-Minute Vendor & AI Risk Review: periscope-tech.com/contact 

Email: info@periscope-tech.com