Public Record · Breach Portal Analysis
HIPAA Breach
Statistics & Analytics
Unsecured protected health information, reported. Every breach of 500 or more records disclosed to the HHS Office for Civil Rights, as published on the federal breach portal. Filter, cross-tabulate, and export the full register below.
HIPAA Breach Statistics at a Glance
The U.S. Department of Health & Human Services, Office for Civil Rights (OCR) publishes every breach of unsecured protected health information (PHI) affecting 500 or more individuals. This page tracks 7,962 reported breaches submitted between 2009 and 2026, together affecting 1,093,245,284 individuals across 52 states and territories.
Of those, 905 remain under active investigation by OCR and 7,057 have been archived following resolution. The largest single incident on record affected 192,700,000 individuals (Change Healthcare, Inc.), while the median breach affected 4,000 individuals.
Use the tools below to filter the register by state, covered-entity type, breach type, location of the breached information, business-associate involvement, and submission date. Charts cover breach trends over time, geographic distribution, investigation duration from submission to resolution, and breach magnitude. The full filtered register can be exported as CSV or JSON. The most recent breach in this dataset was submitted on .
Key metrics
Total Breaches
8K
7,962 total
Under Investigation
905
11% of filtered
Archived
7K
89% of filtered
Individuals Affected
1,093.2M
1,093,245,284 total
Breach Size
192.7M
Max — Change Healthcare, Inc.
Median — 4K
States Impacted
52
52 states
Refine the record
Breach Trends
Click a bar or segment to filter the table
Chart type
No data matches the current filters.
Geography
Click a state to filter
Time to Resolution
Archived cases — submission to resolution
No archived cases with resolution dates in this filter.
Breach Magnitude
Individuals affected per breach
No breaches with individual counts in this filter.
Breach Type × Entity Type
Count per cell — click to filter both dimensions
Repeat Offenders
Entities with more than one breach — click a name to filter
Breach Records
Sort any column · expand a row for the full narrative
| Expand row | Entity name | State | Type | Individuals | Date | Breach type | Location | BA | Status |
|---|---|---|---|---|---|---|---|---|---|
Kostelic and Associates 3PLLC |
NC | Healthcare Provider |
535 | Hacking/IT Incident |
Email |
No | Under Inv. | ||
Breach Type Hacking/IT Incident Location of Info Email Business Associate No Status Under Investigation Individuals Affected 535 |
|||||||||
Vascular Associates of South Alabama |
AL | Healthcare Provider |
623 | Unauthorized Access/Disclosure |
Email |
No | Under Inv. | ||
Breach Type Unauthorized Access/Disclosure Location of Info Email Business Associate No Status Under Investigation Individuals Affected 623 |
|||||||||
Imagine the Possibilities |
IA | Health Plan |
2K | Hacking/IT Incident |
Network Server |
Yes | Under Inv. | ||
Breach Type Hacking/IT Incident Location of Info Network Server Business Associate Yes Status Under Investigation Individuals Affected 1,693 |
|||||||||
Woodlawn Hospital |
IN | Healthcare Provider |
742 | Hacking/IT Incident |
Email |
No | Under Inv. | ||
Breach Type Hacking/IT Incident Location of Info Email Business Associate No Status Under Investigation Individuals Affected 742 |
|||||||||
Applied Healthcare Nursing Division, Inc. d/b/a Doctor's Choice Home Care |
TX | Healthcare Provider |
14K | Hacking/IT Incident |
Electronic Medical Record, Network Server |
Yes | Under Inv. | ||
Breach Type Hacking/IT Incident Location of Info Electronic Medical Record, Network Server Business Associate Yes Status Under Investigation Individuals Affected 14,333 |
|||||||||
OU Medicine, Inc. |
OK | Healthcare Provider |
854 | Unauthorized Access/Disclosure |
Electronic Medical Record, Network Server |
No | Under Inv. | ||
Breach Type Unauthorized Access/Disclosure Location of Info Electronic Medical Record, Network Server Business Associate No Status Under Investigation Individuals Affected 854 |
|||||||||
Project Belle, LLC |
NH | Healthcare Provider |
840 | Unauthorized Access/Disclosure |
Email |
No | Under Inv. | ||
Breach Type Unauthorized Access/Disclosure Location of Info Email Business Associate No Status Under Investigation Individuals Affected 840 |
|||||||||
Three Oaks Hospice, Incorporated |
TX | Business Associate |
37K | Hacking/IT Incident |
Email |
Yes | Under Inv. | ||
Breach Type Hacking/IT Incident Location of Info Email Business Associate Yes Status Under Investigation Individuals Affected 36,622 |
|||||||||
Advanced Radiology Services, P.C. |
MI | Healthcare Provider |
826 | Hacking/IT Incident |
Network Server, Other |
Yes | Under Inv. | ||
Breach Type Hacking/IT Incident Location of Info Network Server, Other Business Associate Yes Status Under Investigation Individuals Affected 826 |
|||||||||
AngMar Management Services |
TX | Business Associate |
126K | Hacking/IT Incident |
Network Server |
Yes | Under Inv. | ||
Breach Type Hacking/IT Incident Location of Info Network Server Business Associate Yes Status Under Investigation Individuals Affected 126,196 |
|||||||||
At Home Medical, Inc. |
NJ | Healthcare Provider |
1K | Unauthorized Access/Disclosure |
Email |
No | Under Inv. | ||
Breach Type Unauthorized Access/Disclosure Location of Info Email Business Associate No Status Under Investigation Individuals Affected 1,091 |
|||||||||
WindRose Health Network |
IN | Healthcare Provider |
33K | Hacking/IT Incident |
Network Server |
No | Under Inv. | ||
Breach Type Hacking/IT Incident Location of Info Network Server Business Associate No Status Under Investigation Individuals Affected 33,158 |
|||||||||
Bacon County Health Services, Inc. |
GA | Healthcare Provider |
501 | Hacking/IT Incident |
Network Server |
No | Under Inv. | ||
Breach Type Hacking/IT Incident Location of Info Network Server Business Associate No Status Under Investigation Individuals Affected 501 |
|||||||||
Camden-on-Gauley Medical Center |
WV | Healthcare Provider |
501 | Hacking/IT Incident |
Network Server |
No | Under Inv. | ||
Breach Type Hacking/IT Incident Location of Info Network Server Business Associate No Status Under Investigation Individuals Affected 501 |
|||||||||
Leggett & Platt, Incorporated Employee Benefit Plan |
MO | Health Plan |
62K | Hacking/IT Incident |
Network Server |
Yes | Under Inv. | ||
Breach Type Hacking/IT Incident Location of Info Network Server Business Associate Yes Status Under Investigation Individuals Affected 61,702 |
|||||||||
Clover Health |
MN | Health Plan |
139K | Hacking/IT Incident |
Network Server, Other |
No | Under Inv. | ||
Breach Type Hacking/IT Incident Location of Info Network Server, Other Business Associate No Status Under Investigation Individuals Affected 138,677 |
|||||||||
Lakes Region Visiting Nursing Association |
NH | Healthcare Provider |
1K | Hacking/IT Incident |
Email |
No | Under Inv. | ||
Breach Type Hacking/IT Incident Location of Info Email Business Associate No Status Under Investigation Individuals Affected 1,274 |
|||||||||
Alma Family Services |
CA | Healthcare Provider |
3K | Hacking/IT Incident |
Network Server |
No | Under Inv. | ||
Breach Type Hacking/IT Incident Location of Info Network Server Business Associate No Status Under Investigation Individuals Affected 2,753 |
|||||||||
Comprehensive Orthopedics & Musculoskeletal Care, LLC |
CT | Healthcare Provider |
22K | Hacking/IT Incident |
Network Server |
No | Under Inv. | ||
Breach Type Hacking/IT Incident Location of Info Network Server Business Associate No Status Under Investigation Individuals Affected 21,897 |
|||||||||
Interim HealthCare Inc. |
FL | Healthcare Provider |
1K | Hacking/IT Incident |
Network Server |
No | Under Inv. | ||
Breach Type Hacking/IT Incident Location of Info Network Server Business Associate No Status Under Investigation Individuals Affected 1,283 |
|||||||||
Persona Dental |
MN | Healthcare Provider |
3K | Hacking/IT Incident |
Network Server |
No | Under Inv. | ||
Breach Type Hacking/IT Incident Location of Info Network Server Business Associate No Status Under Investigation Individuals Affected 3,386 |
|||||||||
Vernon & Waldrep OB-Gyn Associates |
TX | Healthcare Provider |
17K | Hacking/IT Incident |
Network Server |
No | Under Inv. | ||
Breach Type Hacking/IT Incident Location of Info Network Server Business Associate No Status Under Investigation Individuals Affected 17,435 |
|||||||||
Azle Cube Smiles PLLC |
TX | Healthcare Provider |
3K | Hacking/IT Incident |
Network Server |
No | Under Inv. | ||
Breach Type Hacking/IT Incident Location of Info Network Server Business Associate No Status Under Investigation Individuals Affected 3,280 |
|||||||||
Next Level Medical, LLC |
TX | Healthcare Provider |
501 | Hacking/IT Incident |
Network Server |
No | Under Inv. | ||
Breach Type Hacking/IT Incident Location of Info Network Server Business Associate No Status Under Investigation Individuals Affected 501 |
|||||||||
Novocure Inc. |
PA | Healthcare Provider |
1K | Hacking/IT Incident |
Network Server |
No | Under Inv. | ||
Breach Type Hacking/IT Incident Location of Info Network Server Business Associate No Status Under Investigation Individuals Affected 1,464 |
|||||||||