Public record
Every HIPAA breach of 500 or more, since 2009.
The HHS Office for Civil Rights must post every breach of unsecured protected health information that affects 500 or more individuals. This register rebuilds that list as browsable pages: 50 states plus DC and Puerto Rico, 18 years, 2,760 filing pages for breaches of 10,000 or more individuals, and a modelled cost on each, with the method shown.
Filings on the portal
8,012
762 under investigation, 7,250 archived
Individuals affected
1.09B
1,094,561,095, the sum of every filing as reported
Largest single filing
192,700,000
Change Healthcare, Inc., 2024
Hacking / IT incidents
60%
4,830 filings carry the type
Direct answer / What the HHS breach portal shows
As of 8 October 2026 the portal lists 8,012 breaches affecting 500 or more individuals, submitted between 2009 and 2026. The largest is Change Healthcare, Inc. (192,700,000 individuals, 2024); California has filed the most (786); 2,398 filings (30%) involve a business associate; and 804 filings were submitted in 2025 alone. Counts and dates are as reported by the covered entity; nothing here is estimated except the clearly labelled modelled cost.
Lookup / Search the register
Find an organisation on the HHS portal
Type any part of a covered entity or business associate name. The search runs in your browser over all 8,012 filings on the register as of 8 October 2026, 2009 to 2026, and returns what HHS published: state, submission date, individuals affected as reported, breach type and entity type.
52 states and territories
2009 to 2026
Source: HHS OCR breach portal export retrieved 8 October 2026. 8,012 filings, 2,760 of them at or above 10,000 individuals with a page of their own. Counts are as reported by the entity; no cost figure is shown here.
Section 13.1 / Latest filings
The twenty most recent submissions
Newest first, by breach submission date. Filings marked Open sit on the portal's "Cases Currently Under Investigation" tab; filings of 10,000 or more individuals link to their own page.
| Covered entity | State | Type | Individuals | Submitted | Breach type | Location | BA |
|---|---|---|---|---|---|---|---|
| Imagine the PossibilitiesOpen | IA | Health Plan | 1,693 | 21 Sep 2026 | |||
| Applied Healthcare Nursing Division, Inc. d/b/a Doctor's Choice Home CareOpen | TX | Healthcare Provider | 14,333 | 19 Sep 2026 | |||
| OU Medicine, Inc.Open | OK | Healthcare Provider | 854 | 18 Sep 2026 | |||
| Three Oaks Hospice, IncorporatedOpen | TX | Business Associate | 36,622 | 17 Sep 2026 | |||
| Project Belle, LLCOpen | NH | Healthcare Provider | 840 | 17 Sep 2026 | |||
| AngMar Management ServicesOpen | TX | Business Associate | 126,196 | 16 Sep 2026 | |||
| WindRose Health NetworkOpen | IN | Healthcare Provider | 33,158 | 16 Sep 2026 | |||
| At Home Medical, Inc.Open | NJ | Healthcare Provider | 1,091 | 16 Sep 2026 | |||
| Leggett & Platt, Incorporated Employee Benefit PlanOpen | MO | Health Plan | 61,702 | 15 Sep 2026 | |||
| Bacon County Health Services, Inc.Open | GA | Healthcare Provider | 501 | 15 Sep 2026 | |||
| Camden-on-Gauley Medical CenterOpen | WV | Healthcare Provider | 501 | 15 Sep 2026 | |||
| Clover HealthOpen | MN | Health Plan | 138,677 | 14 Sep 2026 | |||
| Lakes Region Visiting Nursing AssociationOpen | NH | Healthcare Provider | 1,274 | 14 Sep 2026 | |||
| Comprehensive Orthopedics & Musculoskeletal Care, LLCOpen | CT | Healthcare Provider | 21,897 | 10 Sep 2026 | |||
| Vernon & Waldrep OB-Gyn AssociatesOpen | TX | Healthcare Provider | 17,435 | 10 Sep 2026 | |||
| Persona DentalOpen | MN | Healthcare Provider | 3,386 | 10 Sep 2026 | |||
| Alma Family ServicesOpen | CA | Healthcare Provider | 2,753 | 10 Sep 2026 | |||
| Interim HealthCare Inc.Open | FL | Healthcare Provider | 1,283 | 10 Sep 2026 | |||
| Azle Cube Smiles PLLCOpen | TX | Healthcare Provider | 3,280 | 9 Sep 2026 | |||
| Novocure Inc.Open | PA | Healthcare Provider | 1,464 | 9 Sep 2026 |
Section 13.2 / Largest filings
Fifteen largest breaches on the portal
Ranked by individuals affected as reported at submission. 152 filings involve one million or more people; 813 involve 100,000 or more.
Two of these have full editorial case files with disclosed costs: Anthem 2015 and Change Healthcare 2024. The rest of the mega-breach register is cross-sector and not HIPAA-specific.
Section 13.3 / By state
52 state and territory pages
Each state page carries every filing from that state as a table, counts by year and breach type, the state's own notification statute, and links to the filing pages. State is the covered entity's registered state, not where the affected people live.
100 filings, 14,148,981 affected
32 filings, 925,719 affected
167 filings, 16,201,503 affected
94 filings, 2,597,059 affected
786 filings, 79,958,213 affected
140 filings, 29,369,166 affected
146 filings, 11,380,761 affected
32 filings, 5,341,160 affected
34 filings, 741,808 affected
471 filings, 54,072,220 affected
229 filings, 38,859,277 affected
24 filings, 614,294 affected
32 filings, 1,543,757 affected
364 filings, 22,594,404 affected
202 filings, 93,114,333 affected
100 filings, 6,614,525 affected
83 filings, 2,096,082 affected
124 filings, 11,757,126 affected
67 filings, 4,438,165 affected
39 filings, 3,296,092 affected
172 filings, 19,570,764 affected
245 filings, 28,784,150 affected
240 filings, 16,130,988 affected
194 filings, 212,076,397 affected
55 filings, 2,459,630 affected
166 filings, 17,570,605 affected
36 filings, 1,865,004 affected
60 filings, 5,403,241 affected
55 filings, 12,507,230 affected
41 filings, 1,163,058 affected
177 filings, 79,985,058 affected
57 filings, 4,378,605 affected
516 filings, 42,564,803 affected
208 filings, 28,691,719 affected
21 filings, 823,546 affected
278 filings, 18,927,883 affected
83 filings, 6,107,720 affected
120 filings, 5,405,904 affected
345 filings, 21,205,627 affected
32 filings, 1,712,827 affected
41 filings, 544,697 affected
87 filings, 2,631,488 affected
15 filings, 178,652 affected
200 filings, 39,597,433 affected
656 filings, 49,863,944 affected
68 filings, 7,085,448 affected
16 filings, 201,678 affected
158 filings, 25,324,969 affected
187 filings, 23,291,258 affected
49 filings, 1,850,823 affected
126 filings, 12,717,130 affected
19 filings, 287,419 affected
23 filings carry no state in the HHS export (Puerto Rico, Guam and US Virgin Islands entities); they appear on the year pages under "State not given".
Section 13.4 / By year
2009 to 2026, year by year
Filings per submission year with the sum of individuals affected and the share recorded as Hacking/IT Incident. 2026 is a partial year to 21 September 2026.
| Year | Filings | Individuals affected | Hacking / IT share | Filings with a page |
|---|---|---|---|---|
| 2009 | 18 | 134,773 | 0% | 2 |
| 2010 | 199 | 5,932,276 | 4% | 41 |
| 2011 | 200 | 13,162,158 | 9% | 42 |
| 2012 | 218 | 2,854,525 | 8% | 38 |
| 2013 | 277 | 7,018,839 | 10% | 43 |
| 2014 | 314 | 19,073,551 | 12% | 78 |
| 2015 | 270 | 112,466,720 | 21% | 50 |
| 2016 | 328 | 16,711,004 | 35% | 83 |
| 2017 | 358 | 5,314,987 | 42% | 84 |
| 2018 | 369 | 15,256,235 | 45% | 103 |
| 2019 | 511 | 44,969,724 | 61% | 159 |
| 2020 | 663 | 35,321,223 | 69% | 251 |
| 2021 | 715 | 61,206,238 | 76% | 283 |
| 2022 | 718 | 64,570,326 | 79% | 331 |
| 2023 | 745 | 183,256,225 | 81% | 337 |
| 2024 | 741 | 290,054,222 | 83% | 338 |
| 2025 | 804 | 140,575,793 | 81% | 314 |
| 2026 | 564 | 76,682,276 | 85% | 183 |
Section 13.5 / Composition
Who files, how the data was breached, where it sat
Multi-valued fields (a filing can list two breach types or several locations) count once per value, so shares can sum above 100%.
Covered entity type
Type of breach
Location of breached information
Section 13.6 / The modelled cost
A method on every filing page, never a disclosed figure
HHS publishes the number of individuals affected and nothing about cost. Each filing page therefore multiplies that number by IBM's customer-PII cost per record, $160 in the Cost of a Data Breach Report 2025 (the figure this site's calculator uses) and $192 in the 2026 edition, and labels the result a modelled estimate with the method shown. A 10,000-person filing models at $1.60M and $1.92M; IBM's 2026 average cost of a healthcare breach is $6.64M.
The model is only shown as an estimate inside the range where IBM's per-record figure behaves: above roughly 100,000 records the page stamps it an upper bound, because fixed costs are spread across far more records at that scale and IBM itself cautions against multiplying per-record figures across breaches involving millions of records. Change Healthcare's disclosed $2.45B against 192.7 million individuals is the standing example of why.
Section 13.7 / How a breach reaches the portal
500 individuals, 60 days, one public list
Threshold
A breach of unsecured protected health information affecting 500 or more individuals must be reported to HHS; smaller breaches are logged and reported annually and never appear here.
Clock
Notice to affected individuals and to HHS without unreasonable delay and no later than 60 days after discovery. The submission date on each filing is when that notice reached OCR, not when the breach happened.
Two tabs
New filings sit under Cases Currently Under Investigation; when OCR closes the case the row moves to the archive and usually gains a short closing summary of what was exposed and what the entity did. 7,068 archived filings carry one.
Index / Companion schedules
04 Biggest breaches
→Cross-sector mega-breaches with primary-source cost figures: Equifax, Yahoo, Change Healthcare, MOVEit.
Industry / Healthcare
→IBM 2026: $6.64M average, the costliest sector for the thirteenth consecutive year.
Regulation / HIPAA penalties
→OCR enforcement tiers, settlements and the notification rule behind this register.
11 50-state laws
→State statute, deadline, AG threshold and penalties for every state on the register.
Cost / Per record
→The $160 and $192 figures behind the modelled cost, and where they stop being reliable.
02 Statistics
→IBM headline figures that contextualise the register.
Provenance
Source: U.S. Department of Health and Human Services, Office for Civil Rights, Breach Portal (breaches affecting 500 or more individuals), retrieved 2026-10-08. Public domain. Individuals affected and dates as reported by the covered entity.
Portal: ocrportal.hhs.gov breach report. Statutory basis: HITECH Act section 13402(e)(4): the Secretary must post a list of breaches of unsecured protected health information affecting 500 or more individuals. Breaches affecting fewer than 500 individuals are reported to OCR annually and are not posted, so they are not on this register. Status wording follows the portal's two tabs ("Cases Currently Under Investigation" and "Archive") as of 8 October 2026; a filing moves to the archive when OCR closes the case. Modelled costs on this site are a method applied to the reported count, using IBM Cost of a Data Breach per-record figures, and are never a cost disclosed by the entity. Export files: hhs-breach-under-investigation__2026-10-08.csv (762 rows); hhs-breach-archive__2026-10-08.csv (7,250 rows).
Corrections: if you represent a listed entity and the portal row has been amended, email [email protected] with the portal entry and we will re-pull the export.
Schedule F / Reference Q&A