Public record
Every HIPAA breach of 500 or more, since 2009.
The HHS Office for Civil Rights must post every breach of unsecured protected health information that affects 500 or more individuals. This register rebuilds that list as browsable pages: 50 states plus DC and Puerto Rico, 18 years, 2,713 filing pages for breaches of 10,000 or more individuals, and a modelled cost on each, with the method shown.
Filings on the portal
7,884
707 under investigation, 7,177 archived
Individuals affected
1.07B
1,074,454,139, the sum of every filing as reported
Largest single filing
192,700,000
Change Healthcare, Inc., 2024
Hacking / IT incidents
60%
4,726 filings carry the type
Direct answer / What the HHS breach portal shows
As of 28 August 2026 the portal lists 7,884 breaches affecting 500 or more individuals, submitted between 2009 and 2026. The largest is Change Healthcare, Inc. (192,700,000 individuals, 2024); California has filed the most (776); 2,367 filings (30%) involve a business associate; and 798 filings were submitted in 2025 alone. Counts and dates are as reported by the covered entity; nothing here is estimated except the clearly labelled modelled cost.
Section 13.1 / Latest filings
The twenty most recent submissions
Newest first, by breach submission date. Filings marked Open sit on the portal's "Cases Currently Under Investigation" tab; filings of 10,000 or more individuals link to their own page.
| Covered entity | State | Type | Individuals | Submitted | Breach type | Location | BA |
|---|---|---|---|---|---|---|---|
| Monongalia County General Hospital CompanyOpen | WV | Healthcare Provider | 2,173 | 31 Jul 2026 | |||
| Asheville Victoria NC Opco LLC d/b/a Elevate Health & RehabilitationOpen | NC | Healthcare Provider | 1,551 | 31 Jul 2026 | |||
| Asheville Beaverdam NC Opco LLC d/b/a Bear Mountain Health and RehabilitationOpen | NC | Healthcare Provider | 1,397 | 31 Jul 2026 | |||
| Asheville US Seventy NC Opco LLC d/b/a Swannanoa Valley Health and RehabilitationOpen | NC | Healthcare Provider | 1,045 | 31 Jul 2026 | |||
| Pennsylvanie Dermatology PartnersOpen | MD | Healthcare Provider | 500 | 30 Jul 2026 | |||
| Associated EndocrinologistsOpen | MI | Healthcare Provider | 4,979 | 29 Jul 2026 | |||
| Quantum HealthOpen | OH | Business Associate | 2,104 | 29 Jul 2026 | |||
| TennCareOpen | TN | Health Plan | 2,300 | 27 Jul 2026 | |||
| CareCloud, Inc.Open | NJ | Business Associate | 3,756,469 | 24 Jul 2026 | |||
| Brookhaven ENT Allergy and Facial SurgeryOpen | MS | Healthcare Provider | 30,403 | 24 Jul 2026 | |||
| Vanderbilt University Medical CenterOpen | TN | Healthcare Provider | 3,298 | 24 Jul 2026 | |||
| Risk Program Administrators LLCOpen | CA | Business Associate | 8,309 | 23 Jul 2026 | |||
| SunCloud HealthOpen | IL | Healthcare Provider | 2,594 | 23 Jul 2026 | |||
| Unlimited Technology Systems, LLCOpen | OH | Business Associate | 3,803,750 | 21 Jul 2026 | |||
| Blue Cross Blue Shield of Minnesota | MN | Health Plan | 3,640 | 21 Jul 2026 | |||
| Beltrami County Health and Human ServicesOpen | MN | Healthcare Provider | 1,491 | 20 Jul 2026 | |||
| Minnesota Health Insurance NetworkOpen | MN | Business Associate | 3,656 | 19 Jul 2026 | |||
| Open Door Health Center of IllinoisOpen | WA | Healthcare Provider | 501 | 18 Jul 2026 | |||
| One Medical Group, Inc.Open | CA | Healthcare Provider | 153,174 | 17 Jul 2026 | |||
| ZenPatient, Inc.Open | CA | Healthcare Provider | 15,749 | 17 Jul 2026 |
Section 13.2 / Largest filings
Fifteen largest breaches on the portal
Ranked by individuals affected as reported at submission. 149 filings involve one million or more people; 801 involve 100,000 or more.
Two of these have full editorial case files with disclosed costs: Anthem 2015 and Change Healthcare 2024. The rest of the mega-breach register is cross-sector and not HIPAA-specific.
Section 13.3 / By state
52 state and territory pages
Each state page carries every filing from that state as a table, counts by year and breach type, the state's own notification statute, and links to the filing pages. State is the covered entity's registered state, not where the affected people live.
98 filings, 4,550,217 affected
32 filings, 925,719 affected
164 filings, 16,196,141 affected
92 filings, 2,530,728 affected
776 filings, 79,739,461 affected
139 filings, 29,363,788 affected
144 filings, 11,295,626 affected
31 filings, 5,339,813 affected
33 filings, 685,611 affected
463 filings, 53,905,333 affected
226 filings, 38,854,537 affected
22 filings, 560,122 affected
29 filings, 1,433,204 affected
358 filings, 22,465,344 affected
200 filings, 93,061,324 affected
98 filings, 6,612,086 affected
80 filings, 2,053,342 affected
124 filings, 11,757,126 affected
66 filings, 4,437,665 affected
37 filings, 3,276,262 affected
170 filings, 19,168,200 affected
241 filings, 28,039,959 affected
238 filings, 16,122,909 affected
189 filings, 211,719,522 affected
55 filings, 2,459,630 affected
164 filings, 17,507,373 affected
36 filings, 1,865,004 affected
60 filings, 5,403,241 affected
55 filings, 12,507,230 affected
38 filings, 1,111,404 affected
174 filings, 79,982,965 affected
57 filings, 4,378,605 affected
511 filings, 42,249,838 affected
207 filings, 28,689,174 affected
19 filings, 792,366 affected
276 filings, 18,905,810 affected
80 filings, 6,100,676 affected
120 filings, 5,405,904 affected
339 filings, 17,081,385 affected
32 filings, 1,712,827 affected
41 filings, 547,868 affected
86 filings, 2,630,987 affected
15 filings, 178,652 affected
196 filings, 39,363,541 affected
633 filings, 46,762,122 affected
68 filings, 7,085,448 affected
15 filings, 200,270 affected
157 filings, 25,301,951 affected
185 filings, 23,286,354 affected
47 filings, 1,849,107 affected
126 filings, 12,726,197 affected
19 filings, 287,419 affected
23 filings carry no state in the HHS export (Puerto Rico, Guam and US Virgin Islands entities); they appear on the year pages under "State not given".
Section 13.4 / By year
2009 to 2026, year by year
Filings per submission year with the sum of individuals affected and the share recorded as Hacking/IT Incident. 2026 is a partial year to 31 July 2026.
| Year | Filings | Individuals affected | Hacking / IT share | Filings with a page |
|---|---|---|---|---|
| 2009 | 18 | 134,773 | 0% | 2 |
| 2010 | 199 | 5,932,276 | 4% | 41 |
| 2011 | 200 | 13,162,158 | 9% | 42 |
| 2012 | 218 | 2,854,525 | 8% | 38 |
| 2013 | 277 | 7,018,839 | 10% | 43 |
| 2014 | 314 | 19,073,551 | 12% | 78 |
| 2015 | 270 | 112,466,720 | 21% | 50 |
| 2016 | 328 | 16,711,004 | 35% | 83 |
| 2017 | 358 | 5,314,987 | 42% | 84 |
| 2018 | 369 | 15,256,235 | 45% | 103 |
| 2019 | 511 | 44,969,724 | 61% | 159 |
| 2020 | 663 | 35,321,223 | 69% | 251 |
| 2021 | 715 | 61,206,238 | 76% | 283 |
| 2022 | 718 | 64,053,662 | 79% | 331 |
| 2023 | 746 | 183,266,304 | 82% | 338 |
| 2024 | 741 | 290,054,222 | 83% | 338 |
| 2025 | 798 | 140,406,490 | 81% | 310 |
| 2026 | 441 | 57,251,208 | 86% | 139 |
Section 13.5 / Composition
Who files, how the data was breached, where it sat
Multi-valued fields (a filing can list two breach types or several locations) count once per value, so shares can sum above 100%.
Covered entity type
Type of breach
Location of breached information
Section 13.6 / The modelled cost
A method on every filing page, never a disclosed figure
HHS publishes the number of individuals affected and nothing about cost. Each filing page therefore multiplies that number by IBM's customer-PII cost per record, $160 in the Cost of a Data Breach Report 2025 (the figure this site's calculator uses) and $192 in the 2026 edition, and labels the result a modelled estimate with the method shown. A 10,000-person filing models at $1.60M and $1.92M; IBM's 2026 average cost of a healthcare breach is $6.64M.
The model is only shown as an estimate inside the range where IBM's per-record figure behaves: above roughly 100,000 records the page stamps it an upper bound, because fixed costs are spread across far more records at that scale and IBM itself cautions against multiplying per-record figures across breaches involving millions of records. Change Healthcare's disclosed $2.45B against 192.7 million individuals is the standing example of why.
Section 13.7 / How a breach reaches the portal
500 individuals, 60 days, one public list
Threshold
A breach of unsecured protected health information affecting 500 or more individuals must be reported to HHS; smaller breaches are logged and reported annually and never appear here.
Clock
Notice to affected individuals and to HHS without unreasonable delay and no later than 60 days after discovery. The submission date on each filing is when that notice reached OCR, not when the breach happened.
Two tabs
New filings sit under Cases Currently Under Investigation; when OCR closes the case the row moves to the archive and usually gains a short closing summary of what was exposed and what the entity did. 7,007 archived filings carry one.
Index / Companion schedules
04 Biggest breaches
→Cross-sector mega-breaches with primary-source cost figures: Equifax, Yahoo, Change Healthcare, MOVEit.
Industry / Healthcare
→IBM 2026: $6.64M average, the costliest sector for the thirteenth consecutive year.
Regulation / HIPAA penalties
→OCR enforcement tiers, settlements and the notification rule behind this register.
11 50-state laws
→State statute, deadline, AG threshold and penalties for every state on the register.
Cost / Per record
→The $160 and $192 figures behind the modelled cost, and where they stop being reliable.
02 Statistics
→IBM headline figures that contextualise the register.
Provenance
Source: U.S. Department of Health and Human Services, Office for Civil Rights, Breach Portal (breaches affecting 500 or more individuals), retrieved 2026-08-28. Public domain. Individuals affected and dates as reported by the covered entity.
Portal: ocrportal.hhs.gov breach report. Statutory basis: HITECH Act section 13402(e)(4): the Secretary must post a list of breaches of unsecured protected health information affecting 500 or more individuals. Breaches affecting fewer than 500 individuals are reported to OCR annually and are not posted, so they are not on this register. Status wording follows the portal's two tabs ("Cases Currently Under Investigation" and "Archive") as of 28 August 2026; a filing moves to the archive when OCR closes the case. Modelled costs on this site are a method applied to the reported count, using IBM Cost of a Data Breach per-record figures, and are never a cost disclosed by the entity. Export files: hhs-breach-under-investigation__2026-08-28.csv (707 rows); hhs-breach-archive__2026-08-28.csv (7,177 rows).
Corrections: if you represent a listed entity and the portal row has been amended, email [email protected] with the portal entry and we will re-pull the export.
Schedule F / Reference Q&A