15 Million Records Exposed in Year's Largest US Health Data Breach

DentaQuest just handed the HHS OCR a number that should make every small practice owner sweat: 15 million. That's how many people had their health data exposed in the biggest US breach of 2026 so far.

When you see a figure like that, it's easy to tell yourself you're too small to matter. You aren't managing millions of records; you're managing a few thousand on a server in a closet or a cloud instance you pay for monthly. You think the regulators only care about the whales.

They don't.

The regulator doesn't care if you lost 15 million files or 1,500. What they care about is whether you left the digital door unlocked. Most small firms waste their tiny budgets on "compliance software" that generates pretty charts but doesn't actually stop a breach. They buy a dashboard and think they've bought security.

They haven't.

The cheapest, most effective control isn't a piece of software. It's a manual audit of who has administrative access to your data and why. I'm talking about the "former employee" check. You'd be surprised how many firms are still paying for licenses—and granting access—to people who left the company two years ago.

Some will argue that they can't spend hours manually reviewing user lists when they have a business to run. That's a fair point, but it's the wrong trade-off. Spending two hours on a spreadsheet once a quarter is significantly cheaper than a forensic audit after a breach. If you can't afford a compliance officer, you can certainly afford to spend an afternoon deleting old accounts.

The second-order effect here isn't just about your own risk. It's about your insurance. When these massive breaches hit the news, cyber insurers don't just look at the company that failed; they look at the sector. They see 15 million records go missing and suddenly every small health provider's premiums climb because the "aggregate risk" of the industry has spiked. You pay for DentaQuest's mistakes through your monthly premium.

You might think you're safe if you use a reputable third-party vendor. You aren't. If your data is sitting in their cloud, it's still your liability when it leaks.

The real question is whether you actually know where your most sensitive data lives right now. Not "where it should be" according to your handbook, but where it actually is. If a disgruntled admin decided to dump your client list onto a public forum tomorrow, do you know which folder they'd go to?

If the answer is no, your compliance is purely theatrical.

Check your active user list for your primary database today. Delete anyone who doesn't need to be there.