Geography
Colorado: 139 healthcare breach filings.
Colorado entities have reported 139 breaches of 500 or more individuals to HHS since 2010, the 22nd most of the 52 states and territories on the register, covering 29,363,788 individuals (10th by people affected). 18 are still under investigation. Hacking/IT Incident is the breach type on 60% of them, and network server the most common location (45%).
Filings
139
22nd of 52 states and territories
Individuals affected
29,363,788
Median filing 3,845
Largest filing
14,782,887
Welltok, Inc., 2023
Hacking / IT share
60%
34 filings involve a business associate
Direct answer / Colorado on the HHS portal
The largest Colorado filing is Welltok, Inc. (14,782,887 individuals, submitted 6 November 2023). The busiest year was 2024 with 15 filings. Healthcare Providers account for 83% of the state's filings. 50 filings of 10,000 or more individuals have their own page; the remaining 89 are listed in the table at the foot of this page.
Section CO.1 / Largest filings
Ten largest Colorado breaches
| # | Covered entity | Type | Individuals | Submitted | Breach type | Location | BA |
|---|---|---|---|---|---|---|---|
| 1 | Welltok, Inc. | Business Associate | 14,782,887 | 6 Nov 2023 | |||
| 2 | Colorado Department of Health Care Policy & Financing | Health Plan | 4,091,794 | 11 Aug 2023 | |||
| 3 | DaVita Inc.Open | Healthcare Provider | 2,689,826 | 1 Aug 2025 | |||
| 4 | Professional Finance Company, Inc. | Business Associate | 1,918,941 | 1 Jul 2022 | |||
| 5 | Summit Pathology and Summit Pathology Laboratories, Inc.Open | Healthcare Provider | 1,813,538 | 18 Oct 2024 | |||
| 6 | Salud Family Health | Healthcare Provider | 427,546 | 5 Oct 2022 | |||
| 7 | Panorama Eyecare | Healthcare Provider | 377,911 | 5 Jun 2024 | |||
| 8 | Rocky Mountain Gastroenterology Associates PLLCOpen | Healthcare Provider | 366,491 | 13 Nov 2024 | |||
| 9 | SCL Health - Colorado | Healthcare Provider | 343,493 | 10 Sep 2020 | |||
| 10 | AspenPointe, Inc. | Healthcare Provider | 295,617 | 19 Nov 2020 |
Section CO.2 / By year
Colorado filings by submission year
Each year links to the national year page.
| Year | Filings | Individuals affected | Hacking / IT share | Filings with a page |
|---|---|---|---|---|
| 2010 | 3 | 108,619 | 0% | 1 |
| 2011 | 4 | 10,024 | 0% | 0 |
| 2012 | 2 | 9,462 | 50% | 0 |
| 2013 | 6 | 7,722 | 17% | 0 |
| 2014 | 8 | 52,823 | 25% | 3 |
| 2015 | 3 | 2,957 | 0% | 0 |
| 2016 | 7 | 18,871 | 29% | 0 |
| 2017 | 12 | 65,982 | 42% | 3 |
| 2018 | 6 | 11,673 | 33% | 0 |
| 2019 | 9 | 112,185 | 56% | 5 |
| 2020 | 14 | 774,525 | 64% | 3 |
| 2021 | 8 | 193,290 | 75% | 3 |
| 2022 | 14 | 2,904,071 | 100% | 10 |
| 2023 | 9 | 18,995,291 | 89% | 5 |
| 2024 | 15 | 2,950,277 | 87% | 8 |
| 2025 | 8 | 2,821,533 | 63% | 3 |
| 2026 | 11 | 324,483 | 91% | 6 |
Section CO.3 / Composition
Breach type, location and who filed
Multi-valued fields count once per value.
Type of breach
Location of breached information
Covered entity type
Section CO.4 / Notification law
What Colorado law required alongside HIPAA
State notification statute
Colorado: C.R.S. 6-1-716
- Notice to individuals
- Within 30 days of determining a breach occurred
- Attorney general threshold
- 500 or more Colorado residents (Within the same 30-day window)
- Private right of action
- No: Only the Colorado Attorney General may enforce
- Penalty
- Treated as a deceptive trade practice; up to $20,000 per violation with no aggregate cap
The HIPAA Breach Notification Rule runs alongside the state statute: notice to affected individuals and to HHS without unreasonable delay and no later than 60 days after discovery.
Section CO.5 / Filing pages
50 filings of 10,000 or more individuals
Each links to a page with the full filing, its rank in the state and year, OCR's closing summary where the case is archived, peers, and the modelled cost.
Section CO.6 / All other filings
89 filings below 10,000 individuals
Listed in full from the HHS export, largest first. These filings do not have their own page.
| Covered entity | Type | Individuals | Submitted | Breach type | Location | BA |
|---|---|---|---|---|---|---|
| City of Lafayette | Healthcare Provider | 9,149 | 25 Aug 2020 | |||
| Madison Street Provider Network | Business Associate | 9,129 | 12 Apr 2017 | |||
| Colorado Department of Human Services, Office of Behavioral Health | Healthcare Provider | 8,132 | 7 Apr 2020 | |||
| Centura Health | Healthcare Provider | 7,515 | 22 May 2019 | |||
| First Street Family Health | Healthcare Provider | 7,310 | 26 Aug 2022 | |||
| NAS Recovery SolutionsOpen | Healthcare Provider | 7,000 | 22 Jun 2026 | |||
| Allergy, Asthma & Immunology of the Rockies, PC | Healthcare Provider | 6,851 | 17 Jun 2016 | |||
| Rangely District Hospital | Healthcare Provider | 6,339 | 8 Jun 2020 | |||
| Memorial Health System | Healthcare Provider | 6,262 | 7 Nov 2012 | |||
| Colorado Department of Human Services | Healthcare Provider | 6,132 | 19 Jan 2022 | |||
| The Center at CorderaOpen | Healthcare Provider | 6,057 | 29 Jul 2025 | |||
| Colorado Ophthalmology Associates, PC | Healthcare Provider | 6,020 | 13 Jan 2024 | |||
| Valley View Hospital Association | Healthcare Provider | 5,415 | 14 Mar 2014 | |||
| Vail Summit OrthopaedicsOpen | Healthcare Provider | 5,044 | 31 Jul 2025 | |||
| Pediatric Gastroenterology Consultants | Healthcare Provider | 5,000 | 19 Dec 2014 | |||
| PET Imaging of Northern Colorado | Healthcare Provider | 4,824 | 27 Jun 2025 | |||
| Colorado Eye Center | Healthcare Provider | 4,478 | 15 Jul 2019 | |||
| Northern Colorado Long Term Acute Hospital | Healthcare Provider | 4,335 | 29 Mar 2024 | |||
| Central Colorado Dermatology, PC | Healthcare Provider | 4,065 | 3 Aug 2018 | |||
| SCL Health - Kansas | Healthcare Provider | 3,845 | 10 Sep 2020 | |||
| Colorado Department of Health Care Policy and Financing | Health Plan | 3,589 | 16 Aug 2011 | |||
| Department of Personnel and Administration | Business Associate | 3,589 | 29 Jun 2011 | |||
| Sarah Benjamin, DPM - Littleton Podiatry | Healthcare Provider | 3,512 | 28 Sep 2013 | |||
| Children's Hospital Colorado | Healthcare Provider | 3,370 | 8 Sep 2017 | |||
| Metro Community Provider Network | Healthcare Provider | 3,200 | 27 Jan 2012 | |||
| Peak Vista Community Health Centers | Healthcare Provider | 3,118 | 26 Apr 2021 | |||
| Vail Clinic, Inc. dba Vail Valley Medical Center, and dba Howard Head Sports Medicine | Healthcare Provider | 3,118 | 15 Apr 2016 | |||
| TTEC Healthcare Solutions | Business Associate | 2,953 | 30 Aug 2023 | |||
| Elk Ridge Dentistry | Healthcare Provider | 2,793 | 2 Mar 2020 | |||
| Mountain Dermatology Specialists, PC | Healthcare Provider | 2,705 | 22 Dec 2023 | |||
| Mental Health Center of Boulder County Inc. dba Mental Health Partners | Healthcare Provider | 2,650 | 9 Sep 2020 | |||
| Children's Hospital Colorado | Healthcare Provider | 2,553 | 27 Jul 2020 | |||
| Lakewood Medical Center, PC | Healthcare Provider | 2,500 | 21 Mar 2024 | |||
| Aspen Dental Care P.C. | Healthcare Provider | 2,500 | 26 Oct 2010 | |||
| Rocky Mountain Health Care Services | Healthcare Provider | 2,442 | 13 Jul 2018 | |||
| Memorial Health Systems | Healthcare Provider | 2,300 | 15 Jul 2011 | |||
| Cedar Springs Hospital | Healthcare Provider | 2,283 | 9 Dec 2020 | |||
| Vincent Vein Center | Healthcare Provider | 2,250 | 7 Jun 2016 | |||
| Mind Springs Health | Healthcare Provider | 2,147 | 27 Feb 2016 | |||
| VA Eastern Colorado Health Care System | Healthcare Provider | 2,130 | 8 Nov 2016 | |||
| Centura Health, Mercy Family Medicine | Healthcare Provider | 2,069 | 16 Aug 2017 | |||
| Colorado Allergy & Asthma Centers, P.C. | Healthcare Provider | 2,063 | 6 Mar 2026 | |||
| Accents on Health | Healthcare Provider | 2,000 | 16 Sep 2020 | |||
| Colorado Community Health Alliance (CCHA)/Physicians Health Partners | Business Associate | 1,918 | 2 Jan 2014 | |||
| Family & Cosmetic Dentistry of the Rockies | Healthcare Provider | 1,850 | 13 Nov 2017 | |||
| Personal Assistance Services of Colorado, LLC | Healthcare Provider | 1,839 | 20 Sep 2018 | |||
| Rocky Mountain Health Maintenance Organization, Inc. | Health Plan | 1,835 | 12 Sep 2019 | |||
| Lasair Aesthetic Health, P.C. | Healthcare Provider | 1,835 | 11 Jul 2016 | |||
| Colorado Department of Health Care Policy and Financing | Health Plan | 1,622 | 18 Aug 2015 | |||
| Janna Benkelman LPC LLC | Healthcare Provider | 1,500 | 3 Sep 2013 | |||
| Pitkin County | Healthcare Provider | 1,454 | 9 Feb 2021 | |||
| Southeast Colorado Hospital District | Healthcare Provider | 1,435 | 3 Feb 2023 | |||
| InSider Vision, LLC | Healthcare Provider | 1,426 | 13 May 2025 | |||
| Dino-Peds | Healthcare Provider | 1,357 | 30 May 2018 | |||
| Rocky Mountain Health Maintenance Organization, Inc. | Health Plan | 1,320 | 17 Mar 2017 | |||
| Jefferson Center for Mental Health | Healthcare Provider | 1,319 | 30 Jan 2020 | |||
| James Kagan, MD | Healthcare Provider | 1,310 | 22 Dec 2021 | |||
| Prowers County Hospital District | Healthcare Provider | 1,205 | 22 Aug 2022 | |||
| Vail Summit Orthopaedics, LLC ("VSON") | Healthcare Provider | 1,138 | 4 Mar 2024 | |||
| Rocky Mountain Regional VA Medical Center | Healthcare Provider | 1,115 | 10 Mar 2025 | |||
| DaVita Inc. | Healthcare Provider | 1,092 | 6 Sep 2022 | |||
| Front Range Dermatology Associates, P.C. | Healthcare Provider | 1,070 | 7 Mar 2018 | |||
| Rocky Mountain Health Care Services | Healthcare Provider | 971 | 11 Feb 2019 | |||
| Summit Community Care Clinic, Inc. | Healthcare Provider | 921 | 27 Aug 2013 | |||
| Rocky Mountain Health Care Services | Healthcare Provider | 909 | 16 Nov 2017 | |||
| Kaiser Foundation Health Plan of Colorado | Health Plan | 900 | 3 Aug 2018 | |||
| Northern Colorado Rehabilitation Hospital | Healthcare Provider | 885 | 29 Mar 2024 | |||
| Denver Regional Rehabilitation Hospital | Healthcare Provider | 848 | 29 Mar 2024 | |||
| University of Colorado Health | Healthcare Provider | 827 | 2 Dec 2015 | |||
| Enterprise Services LLC | Business Associate | 822 | 30 Jun 2017 | |||
| Colorado Allergy and Asthma Centers, PC | Healthcare Provider | 791 | 19 Nov 2021 | |||
| LCS Financial Services | Business Associate | 768 | 24 Oct 2023 | |||
| Colorado Neurodiagnostics, PLLC | Healthcare Provider | 750 | 23 Jun 2014 | |||
| Dignity Health Welfare Benefits Plan | Health Plan | 744 | 15 Feb 2024 | |||
| Centura Health | Healthcare Provider | 738 | 12 Jun 2021 | |||
| Vail Clinic, Inc. dba Vail Health Hospital | Healthcare Provider | 710 | 27 Feb 2020 | |||
| Vision Care Specialists, Inc. | Healthcare Provider | 703 | 20 Jul 2017 | |||
| Capitol Pain InstituteOpen | Healthcare Provider | 695 | 1 May 2026 | |||
| Colorado Health & Wellness, Inc. | Healthcare Provider | 651 | 2 Nov 2013 | |||
| VA Eastern Colorado Health Care System | Healthcare Provider | 649 | 5 May 2010 | |||
| Colorado Department of Human Services | Healthcare Provider | 639 | 27 Dec 2017 | |||
| Rose Medical Center | Healthcare Provider | 606 | 14 Oct 2013 | |||
| Virta HealthOpen | Business Associate | 602 | 30 Jun 2026 | |||
| Jefferson Center for Mental Health | Healthcare Provider | 546 | 7 Feb 2011 | |||
| Sisters of Charity of Leavenworth Health System Health Benefits Plan | Business Associate | 540 | 5 Apr 2016 | |||
| Rocky Mountain Spine Clinic | Healthcare Provider | 532 | 31 Jul 2013 | |||
| Madison Street Provider Network | Healthcare Provider | 523 | 26 Sep 2014 | |||
| VA Eastern Colorado Health Care System(ECHCS) | Healthcare Provider | 508 | 2 Apr 2015 | |||
| Kin Counseling Services PLLCOpen | Healthcare Provider | 500 | 2 Mar 2026 |
Index / Other states
Every state on the register
98
32
164
92
776
144
31
33
463
226
22
29
358
200
98
80
124
66
37
170
241
238
189
55
164
36
60
55
38
174
57
511
207
19
276
80
120
339
32
41
86
15
196
633
68
15
157
185
47
126
19
Index / Companion schedules
13 HHS breach register
→Hub: every filing, by state, year and entity.
04 Biggest breaches
→Mega-breaches with primary-source cost figures.
Industry / Healthcare
→IBM 2026: $6.64M average, 13 years at #1.
Regulation / HIPAA penalties
→OCR enforcement tiers and the 60-day rule.
11 50-state laws
→Deadline, AG threshold and penalties per state.
Cost / Per record
→Where the per-record model is reliable.
Provenance
Source: U.S. Department of Health and Human Services, Office for Civil Rights, Breach Portal (breaches affecting 500 or more individuals), retrieved 2026-08-28. Public domain. Individuals affected and dates as reported by the covered entity.
Portal: ocrportal.hhs.gov breach report. Statutory basis: HITECH Act section 13402(e)(4): the Secretary must post a list of breaches of unsecured protected health information affecting 500 or more individuals. Breaches affecting fewer than 500 individuals are reported to OCR annually and are not posted, so they are not on this register. Status wording follows the portal's two tabs ("Cases Currently Under Investigation" and "Archive") as of 28 August 2026; a filing moves to the archive when OCR closes the case. Modelled costs on this site are a method applied to the reported count, using IBM Cost of a Data Breach per-record figures, and are never a cost disclosed by the entity.
Corrections: if you represent a listed entity and the portal row has been amended, email [email protected] with the portal entry and we will re-pull the export.