Healthcare software company CareCloud just disclosed a breach of its electronic health record environment to the SEC. If your practice uses CareCloud or any cloud-based EHR, this is a reminder that your software vendor’s security is your problem too. Here is what happened and what to do about it.
What Happened
CareCloud, a healthcare software company that provides electronic health record (EHR) systems to medical practices, disclosed a breach of its EHR environment to the SEC on March 16, 2026. The details of the breach are still emerging, but the filing confirms that patient health records were potentially exposed.
For healthcare practices using CareCloud, this means patient data — the most sensitive category of personal information — may have been compromised through no fault of the practice itself. The breach happened at the vendor level, in the cloud environment that practices trusted to keep their records safe.
What This Means for Your Business
If you are a healthcare provider relying on your software vendor as your HIPAA-compliant safety net, this breach should give you pause. Your vendor’s security posture directly impacts your compliance obligations. A breach at your EHR provider does not absolve your practice of HIPAA responsibilities — you are still accountable for protecting patient data, even when a third party drops the ball.
This is not the first time a healthcare SaaS vendor has been breached, and it will not be the last. The bad press alone — having your patients’ medical records stolen — can devastate a practice’s reputation. Beyond that, HIPAA penalties and patient lawsuits add real financial risk.
The Bottom Line
Do not assume your software provider has your security covered. Work with your IT partner to audit what protections you have in place on your own network and endpoints. Due diligence on vendor security is not optional — it is your responsibility under HIPAA.
This story was covered on the latest episode of Nerds News. Read the full episode recap.
Concerned about your practice’s security posture? Schedule a free IT consultation and we will review your environment together.