Conduent, a HIPAA Business Associate for Anthem, suffered a data breach exposing personal and potentially health-related data of approximately 18,500 Anthem plan members; the initial access vector has not been publicly confirmed. The incident triggers HIPAA BAA breach notification obligations for Anthem and highlights third-party vendor risk as a direct liability. Organizations using Conduent as a vendor or subprocessor should contact Conduent immediately to assess scope, audit BAA-covered data flows, and review service account access logs for the 90-day window preceding the disclosure.