"A small clinic like ours would never be targeted." Many clinic directors and office managers think this way. But personal data leaks are not a problem only for large hospitals. Handing documents to the wrong patient, staff reusing passwords, and unauthorized logins to cloud services a clinic subscribes to are all routes that exist regardless of size.
In October 2026, unauthorized logins to clinic and patient accounts on the online consultation service "Curon Online Consultation" were disclosed (we explain the case in Why Is Two-Factor Authentication Necessary?). The clinics' own systems were not attacked; accounts on a cloud service the clinics used became the entry point.
This article uses public data to look at where clinic data breaches start, and sets out where to begin for each leak route. A checklist you can work through this week is at the end.
This article is general information based on information published as of October 31, 2026. For individual legal judgments or whether a report is required, check the guidance of the Personal Information Protection Commission or consult a professional.
Where breaches at medical institutions start
More than 6,000 breach reports a quarter
According to the Personal Information Protection Commission (PPC), it processed 6,101 breach reports involving personal information in the first quarter of FY2026 (April–June 2026). In FY2025, quarterly figures ranged from about 4,500 to 5,700, with no sign of decline.
The PPC points to these trends in the reports:
- Leaks of personal data that include special care-required personal information remain frequent (medical history and clinical information fall into this category)
- In FY2025, many of these were caused by documents handed to the wrong person at hospitals and pharmacies. In Q1 FY2026, such errors were also notable outside hospitals and pharmacies, including at non-life insurers
- Unauthorized access also accounts for many cases
Because clinics handle clinical information, a leak at a clinic tends to be reportable. We cover the reporting rules in Reporting Obligations After a Personal Data Breach.
The top threats organizations face
In the organizational edition of the "10 Major Information Security Threats 2026" published by the Information-technology Promotion Agency (IPA) in January 2026, first place was "damage from ransom attacks," second was "attacks targeting supply chains and contractors," fourth was "attacks exploiting system vulnerabilities," and seventh was "data leaks through insider misconduct."
At medical institutions, too, there are repeated reports of ransomware stopping electronic medical records and of intrusions through contractors' maintenance connections. On top of these come everyday handover errors and unauthorized logins enabled by reused passwords.
Four leak routes
Data breaches at clinics fall broadly into four routes. Because the countermeasures differ by route, the first step is to separate where leaks come from.
| Route | Typical examples | Main countermeasures |
|---|---|---|
| ① Human error | Handing a prescription or test result to the wrong patient, misdirected fax or email, lost USB drives | Identity checks at handover, double-checking before sending, rules for removable media |
| ② Compromised authentication | Reused or guessable passwords, leaked shared IDs, accounts of former staff left active | Two-factor authentication, one ID per person, account reviews |
| ③ External attacks | Ransomware, exploitation of VPN device vulnerabilities, infection from suspicious email | Applying patches, backups, staff training |
| ④ Contractors and cloud services | Intrusion via a maintenance vendor's connection, unauthorized logins to cloud service accounts | Contractor management, vendor checks, log review |
There is also improper viewing or taking of data by staff (insider misconduct). Regularly reviewing EMR access logs acts as a deterrent (Reviewing EMR Access Logs).
By route: where to start
① Human error: prevent it with procedures
The largest number of incidents come from mistakes at the front desk and in administrative work. Reminders alone do not reduce them, so the basic approach is to build checks into procedures.
- When handing over documents, confirm identity with two or more items, such as date of birth, not just the name
- For fax and email, select recipients from a registered list, and have two people check any send to a new recipient
- Do not take patient information out on USB drives. When necessary, use encrypted media and a checkout log (Managing USB Drives and Removable Media)
② Compromised authentication: two-factor authentication and one ID per person
Most unauthorized logins from outside use a valid ID and password. In a credential-stuffing attack, which tries passwords leaked from other services, a reused password is broken however complex it is.
- Turn on two-factor authentication for every service reachable from outside the clinic, such as EMRs, online consultations, web booking and email
- Stop using shared IDs and issue one per staff member. With a shared ID, you cannot trace who did what
- Disable accounts whenever someone leaves or changes roles, and review all accounts at least once a year
The MHLW "Guidelines for the Safe Management of Medical Information Systems, Edition 6.0" require that, where users are authenticated with passwords, medical information systems expected to be in operation as of FY2027 adopt two-factor authentication, or an equivalent measure, when newly introduced or updated. We explain how to roll it out in Deploying Multi-Factor Authentication, and password rules in Designing a Password Policy.
③ External attacks: close the entry points and make recovery possible
Ransomware often enters through vulnerabilities in devices such as VPN appliances, or through stolen credentials.
- Apply patches to VPN devices, routers and operating systems. If a maintenance vendor handles this, ask them to report the patch status (VPN Vulnerability Management)
- Keep a backup in a location disconnected from the network (Backup Design and the 3-2-1 Rule)
- Make it easy for staff to report right away when they open a suspicious email, and give them a contact (Designing Staff Training)
The overall picture is in Ransomware Countermeasures for Medical Institutions.
④ Contractors and cloud services: confirm who is responsible for what
With cloud EMRs and online consultation services, the vendor carries many of the security measures. Even so, account management remains the medical institution's responsibility.
- List the cloud services you use, and note the administrator and two-factor authentication status for each
- Ask vendors about login attempt limits, mandatory two-factor authentication, access log provision, and how they will contact you in case of unauthorized logins (Questions to Ask Vendors)
- At contract time, confirm where the vendor's responsibility ends (What Is a Responsibility Demarcation Point?)
A checklist for this week
Start with these ten items. Work on the ones marked "No" first.
| No. | Item | Yes / No |
|---|---|---|
| 1 | We have a list of services reachable from outside the clinic (EMR, online consultation, web booking, email, etc.) | |
| 2 | Two-factor authentication is enabled on those services | |
| 3 | Each staff member has their own ID; we do not use shared IDs | |
| 4 | Accounts of former staff are disabled | |
| 5 | We have a rule against reusing work passwords on other services | |
| 6 | At document handover, we confirm identity with two or more items | |
| 7 | We know the patch status of operating systems and VPN devices | |
| 8 | We have a backup disconnected from the network | |
| 9 | We have decided contacts and roles for when a data breach occurs | |
| 10 | We have confirmed with our main vendors how they will contact us about unauthorized logins |
For which parts of the guidelines a small clinic should prioritize, see Guideline Compliance for Small Clinics.
If a breach occurs: know the reporting deadlines
If special care-required personal information such as clinical information is leaked (or may have been), a report to the PPC and notification of the individuals are required in principle. Reporting happens in two stages, each with a deadline.
| Report | Deadline guideline |
|---|---|
| Preliminary report | Roughly 3 to 5 days from when you became aware of the situation |
| Final report | 30 days in principle; 60 days where the incident may have been carried out for an improper purpose, such as unauthorized access |
Items unknown at the preliminary stage go into the final report once known. To avoid delaying the preliminary report while waiting for an investigation, it is important to decide in advance who judges and who reports (Incident Response Plans for Medical Institutions).
Frequently asked questions
Q. Does a small clinic also have to report? A. The Act on the Protection of Personal Information applies to businesses handling personal information regardless of size. Because clinical information is special care-required personal information, even a single leaked record can be reportable.
Q. If a leak happens at a cloud service, who reports — the vendor or the clinic? A. The PPC states that where handling is entrusted to a contractor, in principle both the entrusting party and the contractor are obliged to report. Do not just wait for the vendor; check whether your clinic needs to report.
Q. Where should we start? A. The steps that cost nothing and have the largest effect are listing the services reachable from outside the clinic and turning on two-factor authentication. We recommend starting with items 1 to 5 of the checklist.
Summary
- Clinic data breaches happen through four routes: human error, compromised authentication, external attacks and contractors
- The most frequent cause is human error such as handing documents to the wrong person; prevent it with procedures, not reminders
- Most unauthorized logins use a valid ID and password. Two-factor authentication and one ID per person are the basics
- Even with cloud services, account management remains the medical institution's responsibility
- Know the reporting deadlines (preliminary roughly within 3 to 5 days, final within 30 or 60 days) and decide roles in advance
Pottech provides EMR and medical DX services for medical institutions and supports building healthcare information security practices. If you want to check how far your clinic's measures go, please feel free to contact us.
References
- Personal Information Protection Commission, "Status of Processing of Breach Reports in Q1 FY2026" (September 2, 2026) https://www.ppc.go.jp/files/pdf/260902quarter-report_roueihoukoku.pdf
- Personal Information Protection Commission, "Responding to Breaches and Useful Materials" https://www.ppc.go.jp/personalinfo/legal/leakAction/
- Personal Information Protection Commission, "Guidelines on the Act on the Protection of Personal Information (General Rules)" https://www.ppc.go.jp/personalinfo/legal/guidelines_tsusoku/
- Information-technology Promotion Agency (IPA), "10 Major Information Security Threats 2026" https://www.ipa.go.jp/security/10threats/10threats2026.html
- MHLW, "Guidelines for the Safe Management of Medical Information Systems, Edition 6.0: System Operations" https://www.mhlw.go.jp/content/10808000/001582980.pdf
- MICIN, Inc., "Report on Unauthorized Logins to the Online Consultation Service 'Curon Online Consultation'" (October 27, 2026) https://micin.jp/news/14859/