Third-party and business associate risk

How often is a business associate involved, and do those breaches run larger?

A business associate was involved in 35% of reports (1,250 of 3,609) but 66% of the individuals affected. The share of reports naming a business associate went from 35% in 2022 to 36% in 2026. Reports involving a business associate have a median of 5,202 individuals against 6,691 without one (difference -1,489, 95% CI -2,645 to -527); the difference is not statistically significant (Mann-Whitney p = 0.110). 4.6% of BA reports reached 1 million or more, against 1.8% of the rest.

What this means for you

A business associate was involved in 35% of reports (1,250 of 3,609) but 66% of the individuals affected.

Do this next

Inventory every business associate that touches ePHI

This chapter's program actions come with a subscription

Lessons from resolved cases

Start free and set your program

35%

Reports naming a business associate

1,250 of 3,609

66%

Individuals in those breaches

498.5M people

5,202

Median size, BA involved

No BA: 6,691

4.6%

BA reports reaching 1M+

No BA: 1.8%

Trend

How often a vendor is in the story

Share of reports each year where OCR records a business associate as present. Click a year to open that year's vendor breaches.

Share of reports with a business associate present, by yearIn 2026, 36% of reports named a business associate.

Table view


2022	718	254	35%
2023	745	277	37%
2024	741	222	30%
2025	807	283	35%
2026	598	214	36%

How this is calculated

OCR's “Business Associate Present” flag, as reported by the covered entity. It records involvement, not fault. Years with fewer than 20 reports are marked in the tooltip because their shares swing widely.

Subscriber feature · $5 a month or $50 a year

Read the rest of Chapter 3: Third-party and business associate risk

The findings, every chart with drill-down to the reports behind it, and what to do about it, recalculated for any state, entity type or year range you choose. Unlock all 14 chapters with a subscription.

Do vendor breaches run larger?
Which entities and breach types lean on business associates
What this means for your program: 2 key points
3 program actions mapped to HIPAA and NIST CSF 2.0, starting with “Inventory every business associate that touches ePHI”
Exam angle for 4 CISSP, CISM and CISA domains, with a study prompt
2,072 lessons from resolved OCR cases filed under this chapter

Start free Or subscribe for $5 a month

Included with an ExamPrep subscription or as a DueCare site administrator. How linking works