Five and a Half Million Patients From One Health System

Yale New Haven Health System reported a breach affecting 5,556,702 individuals following an intrusion into its network dated to 8 March 2025.

Five and a half million is larger than the population of Connecticut. A health system’s record count is not its current patient list — it is everyone who has ever been treated, referred, tested or billed, accumulated across decades and across every organisation the system has absorbed.

Consolidation in US healthcare means a "regional" system is frequently a merged entity holding the historical records of a dozen predecessors. The retention argument this desk filed at McGraw Hill in 26-0414 applies here with clinical data attached.

Elsewhere in this database the recommendation is usually retention discipline: delete what you no longer need. Healthcare is the sector where that advice runs hardest into legitimate counter-pressure.

Medical records have clinical value decades later, are subject to statutory retention periods that vary by state and record type, and may be needed for litigation. A hospital deleting a twenty-year-old record to reduce breach exposure could be making a clinical and legal error.

That is a genuine bind rather than negligence, and it means the defensive burden falls almost entirely on access control and segmentation rather than on holding less.