Updated 19 hours ago ()
Third-party and business associate risk
How often is a business associate involved, and do those breaches run larger?
A business associate was involved in 35% of reports (1,241 of 3,584) but 66% of the individuals affected. The share of reports naming a business associate went from 35% in 2022 to 36% in 2026. Reports involving a business associate have a median of 5,112 individuals against 6,684 without one (difference -1,572, 95% CI -2,644 to -457); the difference is not statistically significant (Mann-Whitney p = 0.086). 4.6% of BA reports reached 1 million or more, against 1.8% of the rest.
What this means for you
A business associate was involved in 35% of reports (1,241 of 3,584) but 66% of the individuals affected.
Do this next
This chapter's program actions come with a subscription
Trend
How often a vendor is in the story
Share of reports with a business associate present, by year
In 2026, 36% of reports named a business associate.
Table view
| 2022 | 718 | 254 | 35% |
| 2023 | 745 | 277 | 37% |
| 2024 | 741 | 222 | 30% |
| 2025 | 807 | 283 | 35% |
| 2026 | 573 | 205 | 36% |
How this is calculated
OCR's “Business Associate Present” flag, as reported by the covered entity. It records involvement, not fault. Years with fewer than 20 reports are marked in the tooltip because their shares swing widely.
Subscriber feature · $5 a month or $50 a year
Read the rest of Chapter 3: Third-party and business associate risk
- Do vendor breaches run larger?
- Which entities and breach types lean on business associates
- What this means for your program: 2 key points
- 3 program actions mapped to HIPAA and NIST CSF 2.0, starting with “Inventory every business associate that touches ePHI”
- Exam angle for 4 CISSP, CISM and CISA domains, with a study prompt
- 2,060 lessons from resolved OCR cases filed under this chapter
Included with an ExamPrep subscription or as a DueCare site administrator. How linking works