Practice Security & Data Protection

The CareCloud breach is a reminder to ask harder questions about your EMR

A March 2026 breach at CareCloud exposed the records of more than 3.75 million patients. Here's what happened, why it matters even if you've never used CareCloud, and what to ask any vendor holding your patients' data.

What Happened

Between March 10 and 16, 2026, an unauthorized party gained access to one of CareCloud's cloud data environments. The company later confirmed that patient information — including names, addresses, dates of birth, Social Security numbers, and medical and insurance details — had been taken. By mid-2026, the confirmed number of affected individuals had grown to more than 3.75 million, making it one of the largest healthcare data breaches reported this year.

Why it matters beyond CareCloud's own customers: CareCloud is one of dozens of cloud EMR platforms holding sensitive patient data on behalf of tens of thousands of practices. This breach is a useful prompt for every practice — regardless of vendor — to revisit how well their EMR actually protects patient information, and what happens if something goes wrong.

Six Questions Worth Asking Your EMR Vendor

Whether you're evaluating OneTouch, staying with your current system, or just doing due diligence, these are the questions that actually reveal how seriously a vendor treats data security.

1. Is patient data encrypted at rest and in transit? Encryption should apply to stored records, not just data moving between your browser and their servers. OneTouch EMR: [confirm current encryption standard, e.g. AES-256 at rest / TLS 1.2+ in transit]

2. What independent audits or certifications back that up? Claims are only as good as the third party verifying them — look for SOC 2, HITRUST, or equivalent attestations. OneTouch EMR: [list current certifications, e.g. SOC 2 Type II, ONC-ATCB]

3. How often is the environment penetration-tested? Annual, at minimum — ask when the last test was completed and how findings are addressed. OneTouch EMR: [state testing cadence]

4. What's the breach notification commitment, in writing? HIPAA sets outer limits, but your Business Associate Agreement should specify how fast you'll actually be told. OneTouch EMR: [state contractual notification window]

5. Who can access patient data, and how is that logged? Role-based access controls and audit trails matter as much for internal misuse as external attacks. OneTouch EMR: [describe access control model]

6. What does support actually look like during an incident? A vendor's response in the first 24 hours of a problem tells you more than any marketing page. OneTouch EMR: [describe support model / SLA]

If You're Reevaluating Your EMR

Switching systems is a real undertaking, and it's reasonable to be cautious about it. OneTouch EMR was built by a practicing physician around how doctors actually chart, and we offer hands-on migration support so moving your records and workflows over doesn't fall on your staff alone. If you're simply trying to understand where your current vendor stands, we're glad to talk through the questions above with you either way.

Not Sure How Your Current EMR Stacks Up?

Get a free, no-obligation review of your practice's data security posture — or see how OneTouch handles patient data with a live walkthrough.

[Request a Security Review] [See a Demo]

Sources: CareCloud breach details are drawn from CareCloud's public regulatory notifications and reporting by TechCrunch, HIPAA Journal, and SecurityWeek (2026). This article is provided for informational purposes and is not a comparison of specific security controls between CareCloud and OneTouch EMR unless independently verified.