Conduent Business Services LLC recently discovered it was the subject of a cybersecurity incident involving unauthorized access to its systems that potentially affects more than 25 million individuals. This incident is a reminder that health plans may have HIPAA and contractual obligations even when a breach occurs at a third party.