A Business Associate Was Penalized $10,000 for a 15-Million-Record Breach. Read the Field List.

Names. Phone numbers. Mailing addresses. Email addresses. Dates of birth. And the dates and times of medical appointments.

That is the list of fields HHS Office for Civil Rights says were exposed in the MMG Fusion settlement announced in March 2026, affecting approximately 15 million individuals. No diagnoses. No clinical notes. No Social Security numbers. No payment data.

Read that list again and ask whether your appointment reminder vendor, your recall texting platform, your answering service, or your intake overflow partner holds anything less. Most of them hold exactly that, and several hold more.

What happened, in order

MMG Fusion, LLC was a Maryland software company that provided patient communication software to healthcare providers. That made it a business associate: it received protected health information from covered entities in order to do a job for them.

Per OCR, the breach occurred in December 2020. MMG did not report it. OCR opened its investigation in March 2023, after receiving a complaint about an unreported security incident and PHI posted to the dark web.

OCR identified three failures: impermissibly disclosing the PHI of approximately 15 million individuals; failing to conduct an accurate and thorough risk analysis; and failing to notify the covered entities affected by the incident. The resolution: $10,000 to OCR and a three-year corrective action plan.

The $10,000 is the least useful number in the story

It is tempting to read a five-figure settlement against a fifteen-million-record breach and conclude that enforcement risk is priced low. That is the wrong lesson, for a simple structural reason.

The monetary term of a resolution agreement reflects what OCR can practically collect, not what the conduct was worth. A vendor that has wound down its business has very little to give. Your agency, by contrast, is still operating, still enrolled, still surveyed, and still carrying the obligation to notify your own patients.

So the number that matters to an agency operator is not $10,000. It is 15 million — because those notification letters get sent by covered entities, under their own names, to their own patients. The vendor's insolvency does not transfer to you as relief. It transfers to you as work.

Why an appointment time is PHI

Operators sometimes assume that a record without a diagnosis is not really health information. The MMG field list is a clean counterexample. A name plus a phone number plus the date and time of a medical appointment identifies a person and connects them to the receipt of care. Attach the provider — and a patient communication vendor necessarily knows which practice sent the message — and the inference gets sharper. A list of everyone with an appointment at a hospice agency is sensitive whether or not a single ICD-10 code appears in it.

Home health, home care, and hospice agencies generate this data continuously and route it through outside systems constantly: scheduling confirmations, visit-window texts, missed-visit callbacks, recertification reminders, referral acknowledgments. The category of vendor that failed here is the category most agencies use most heavily.

The obligation that failed is the one you depend on

Under 45 CFR 164.410, a business associate that discovers a breach of unsecured PHI must notify the covered entity without unreasonable delay and in no case later than 60 calendar days after discovery. The notice must identify each individual whose PHI was, or is reasonably believed to have been, accessed, acquired, used, or disclosed, and must supply the other information the covered entity needs to notify those individuals.

That clause is the entire mechanism by which you learn you have a problem. If the vendor stays silent, your patient-notification clock does not start, your risk assessment never happens, and your first signal may be a reporter, a patient, or a complaint to OCR.

The second failure OCR named is just as ordinary. 45 CFR 164.308(a)(1)(ii)(A) makes risk analysis a required implementation specification — not addressable, not optional — and defines it as an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of ePHI. A vendor that cannot produce one has not met a baseline that has been in force for years.

What to do this week

This is a vendor-file exercise, not a technology project. It fits in an afternoon.

Write down every system that holds a patient name next to an appointment time. Scheduling, texting, IVR, answering service, referral portal, fax-to-email, transcription, analytics. Most agencies find two or three they had forgotten were separate companies.
Pull each BAA and find the breach clause. Check whether it says 60 days (the regulatory ceiling) or something shorter. If it restates the ceiling, you have given yourself no margin: the vendor can use 60 days and still leave you scrambling inside your own 60-day patient-notification window.
Ask each vendor, in writing, for the date of its most recent risk analysis and who performed it. Not the SOC 2 report — the risk analysis. The answer, or the silence, is informative.
Identify the subcontractors. A texting platform that routes through a carrier aggregator, or a call platform that sends audio to an AI subprocessor, has its own downstream chain. We walked through how that chain works in Your Call Recording Vendor Is a Business Associate. Its AI Subprocessor Is a Subcontractor.
Name the person who would run a notification. Fifteen million is somebody else's number. Yours might be four thousand. Either way, someone has to own the mailing list, the letter, the substitute notice decision, and the media threshold. Decide who before you need to.

Questions worth adding to your diligence set

Ask	What a weak answer sounds like
When did you last complete a security risk analysis, and who conducted it?	"We're SOC 2 Type II certified." Different artifact, different question.
What is your contractual breach-notification window to us?	"As required by HIPAA." That is the outer limit, not a commitment.
Which subcontractors touch our PHI, and do you have signed BAAs with each?	A list of product names with no legal entities behind them.
If your company ceased operations, what happens to our data and who notifies us?	Silence, or a pointer back to the master agreement.
What data fields do you actually retain, and for how long?	"Everything the integration sends." Retention you cannot describe is retention you cannot defend.

If you want a fuller version of that conversation, our checklist of security questions to ask any healthcare SaaS vendor before signing covers the diligence set in detail, including what to do when a vendor declines to answer.

One more thing the field list tells you

MMG's product category was patient communication. That means the exposed data was not a database export sitting in cold storage — it was the working set of an active messaging system, which is why it contained appointment dates and times rather than historical claims.

Operationally, that points at a question worth asking of every communication vendor you use: what does the system retain after the message is delivered? A reminder platform has no functional need to hold three years of appointment history. Many hold it anyway, because nobody specified otherwise at implementation. Retention you did not ask for is breach surface you did not price.

The structural point

Agencies tend to manage vendor risk at the moment of signature and then never again. The MMG facts describe a five-year arc — breach in 2020, investigation opened in 2023, resolution in 2026 — during which the covered entities involved presumably renewed contracts, expanded usage, and added integrations without a signal that anything was wrong.

The defensible posture is not a better contract. It is a current inventory, a short notification chain you have actually tested, and a habit of asking vendors for evidence on a schedule rather than at renewal.

SurfacerIQ works in an adjacent part of this problem: making the interaction record itself reviewable, so that what was said to a patient or a family member is something an agency can find and evaluate rather than reconstruct. It does not substitute for vendor diligence, and no platform does.

This post is general information for operators, not legal advice. Breach analysis is fact-specific, and you should involve privacy counsel before making a notification determination.

If you are working through your vendor inventory and want a second set of eyes on where patient conversations are actually going, talk to us.

A Business Associate Was Penalized $10,000 for a 15-Million-Record Breach. Read the Field List.