State File DC / HHS OCR Breach Register34 filings, 2009 to 2026Retrieved 8 October 2026

Geography

District of Columbia: 34 healthcare breach filings.

District of Columbia entities have reported 34 breaches of 500 or more individuals to HHS since 2009, the 43rd most of the 52 states and territories on the register, covering 741,808 individuals (47th by people affected). 3 are still under investigation. Unauthorized Access/Disclosure is the breach type on 44% of them, and network server the most common location (38%).

Filings

43rd of 52 states and territories

Individuals affected

741,808

Median filing 3,400

Largest filing

200,665

Trusted Health Plans, Inc., 2021

Hacking / IT share

38%

9 filings involve a business associate

Direct answer / District of Columbia on the HHS portal

The largest District of Columbia filing is Trusted Health Plans, Inc. (200,665 individuals, submitted 26 March 2021). The busiest year was 2024 with 6 filings. Healthcare Providers account for 71% of the state's filings. 13 filings of 10,000 or more individuals have their own page; the remaining 21 are listed in the table at the foot of this page.

Section DC.1 / Largest filings

Ten largest District of Columbia breaches

#	Covered entity	Type	Individuals	Submitted	Breach type	Location	BA
1	Trusted Health Plans, Inc.	Health Plan	200,665	26 Mar 2021	Hacking/IT Incident	Network Server	No
2	Planned Parenthood of Metro Washington	Healthcare Provider	142,982	20 Nov 2020	Hacking/IT Incident	Network Server	No
3	Howard University College of Dentistry	Healthcare Provider	80,915	23 Nov 2021	Hacking/IT Incident	Electronic Medical Record	No
4	Casper Orthopedic Associates, PCOpen	Healthcare Provider	56,197	23 Jul 2026	Hacking/IT Incident	Network Server	No
5	Veterans Health Administration	Healthcare Provider	46,677	30 Jan 2024	Unauthorized Access/Disclosure	Paper/Films	No
6	Veterans Health Administration	Healthcare Provider	44,308	14 Sep 2020	Hacking/IT Incident	Network Server	No
7	Foxhall Ob Gyn Associates	Healthcare Provider	27,000	24 Jun 2022	Unauthorized Access/Disclosure	Electronic Medical Record, Email, Paper/Films	No
8	Veterans Health Administration	Healthcare Provider	19,254	6 Nov 2018	Unauthorized Access/Disclosure	Paper/Films	Yes
9	Community ConnectionsOpen	Healthcare Provider	18,949	11 Dec 2024	Hacking/IT Incident	Network Server	No
10	Community ConnectionsOpen	Healthcare Provider	18,943	18 May 2026	Hacking/IT Incident	Network Server	No

Section DC.2 / By year

District of Columbia filings by submission year

Each year links to the national year page.

Year	Filings	Individuals affected	Hacking / IT share	Filings with a page
2009	1	3,800	0%	0
2010	3	6,356	0%	0
2012	1	1,549	0%	0
2014	1	2,200	0%	0
2015	2	19,445	50%	1
2016	2	5,169	0%	0
2017	1	1,200	0%	0
2018	2	19,976	0%	1
2019	1	11,536	0%	1
2020	2	187,290	100%	2
2021	4	283,349	50%	2
2022	2	27,580	50%	1
2023	1	8,801	100%	0
2024	6	84,032	50%	3
2025	1	1,847	0%	0
2026	4	77,678	75%	2

Section DC.3 / Composition

Breach type, location and who filed

Multi-valued fields count once per value.

Type of breach

Unauthorized Access/Disclosure15 (44%)

Hacking/IT Incident13 (38%)

Theft5 (15%)

Loss1 (3%)

Other1 (3%)

Location of breached information

Network Server13 (38%)

Paper/Films11 (32%)

Email7 (21%)

Laptop3 (9%)

Electronic Medical Record2 (6%)

Other Portable Electronic Device1 (3%)

Covered entity type

Healthcare Provider24 (71%)

Health Plan5 (15%)

Business Associate5 (15%)

Section DC.4 / Notification law

What District of Columbia law required alongside HIPAA

State notification statute

District of Columbia: D.C. Code 28-3851 et seq.

Notice to individuals: In the most expedient time possible and without unreasonable delay
Attorney general threshold: 50 or more District residents (No later than when residents are notified)
Private right of action: Yes: Treble damages or $1,500 per violation (whichever is greater), plus attorney fees
Penalty: Unfair or deceptive trade practice enforceable by the DC Attorney General; injunctive relief and restitution

The HIPAA Breach Notification Rule runs alongside the state statute: notice to affected individuals and to HHS without unreasonable delay and no later than 60 days after discovery.

District of Columbia notification law in full HIPAA breach penalties

Section DC.5 / Filing pages

13 filings of 10,000 or more individuals

Each links to a page with the full filing, its rank in the state and year, OCR's closing summary where the case is archived, peers, and the modelled cost.

Covered entity	Type	Individuals	Submitted	Breach type	Location	BA
Trusted Health Plans, Inc.	Health Plan	200,665	26 Mar 2021	Hacking/IT Incident	Network Server	No
Planned Parenthood of Metro Washington	Healthcare Provider	142,982	20 Nov 2020	Hacking/IT Incident	Network Server	No
Howard University College of Dentistry	Healthcare Provider	80,915	23 Nov 2021	Hacking/IT Incident	Electronic Medical Record	No
Casper Orthopedic Associates, PCOpen	Healthcare Provider	56,197	23 Jul 2026	Hacking/IT Incident	Network Server	No
Veterans Health Administration	Healthcare Provider	46,677	30 Jan 2024	Unauthorized Access/Disclosure	Paper/Films	No
Veterans Health Administration	Healthcare Provider	44,308	14 Sep 2020	Hacking/IT Incident	Network Server	No
Foxhall Ob Gyn Associates	Healthcare Provider	27,000	24 Jun 2022	Unauthorized Access/Disclosure	Electronic Medical Record, Email, Paper/Films	No
Veterans Health Administration	Healthcare Provider	19,254	6 Nov 2018	Unauthorized Access/Disclosure	Paper/Films	Yes
Community ConnectionsOpen	Healthcare Provider	18,949	11 Dec 2024	Hacking/IT Incident	Network Server	No
Community ConnectionsOpen	Healthcare Provider	18,943	18 May 2026	Hacking/IT Incident	Network Server	No
Children's National Medical Center	Healthcare Provider	18,000	24 Feb 2015	Hacking/IT Incident	Email	No
Service Benefit Plan Administrative Services Corporation	Business Associate	11,536	12 Dec 2019	Unauthorized Access/Disclosure	Network Server	Yes
Fincantieri Marine Group, LLC	Health Plan	11,535	5 Jan 2024	Hacking/IT Incident	Network Server	No

Section DC.6 / All other filings

21 filings below 10,000 individuals

Listed in full from the HHS export, largest first. These filings do not have their own page.

Covered entity	Type	Individuals	Submitted	Breach type	Location	BA
United Bankshares, Inc.	Business Associate	8,801	11 Aug 2023	Hacking/IT Incident	Network Server	Yes
Children's National Medical Center	Healthcare Provider	4,107	25 Apr 2016	Unauthorized Access/Disclosure	Network Server	Yes
Health Services for Children with Special Needs, Inc.	Health Plan	3,800	17 Nov 2009	Loss	Laptop	No
Service Benefits Plan Administrative Services Corp	Business Associate	3,400	8 Jan 2010	Theft	Paper/Films	Yes
Georgetown University Hospital	Healthcare Provider	2,416	13 May 2010	Other, Theft	Email, Other Portable Electronic Device	No
Veterans Health Administration	Healthcare Provider	2,380	5 Jan 2024	Unauthorized Access/Disclosure	Paper/Films	No
Veterans Health Administration	Healthcare Provider	2,302	3 Dec 2024	Hacking/IT Incident	Network Server	Yes
Inclusion Research Institute	Business Associate	2,200	24 Apr 2014	Unauthorized Access/Disclosure	Paper/Films	Yes
CareFirst BlueCross BlueShield Community Health Plan - District of Columbia	Business Associate	2,189	16 Feb 2024	Unauthorized Access/Disclosure	Network Server	Yes
Veterans Health Administration	Healthcare Provider	1,847	13 Jan 2025	Unauthorized Access/Disclosure	Paper/Films	No
Georgetown University Hospital	Healthcare Provider	1,549	15 Feb 2012	Unauthorized Access/Disclosure	Paper/Films	No
Washington VA Medical Center	Healthcare Provider	1,467	16 Apr 2026	Unauthorized Access/Disclosure	Paper/Films	No
Howard University	Healthcare Provider	1,445	10 Jul 2015	Unauthorized Access/Disclosure	Paper/Films	No
Braun Dermatology & Skin Cancer Center	Healthcare Provider	1,200	28 Jul 2017	Unauthorized Access/Disclosure	Email	No
Washington DC VA Medical Center	Healthcare Provider	1,193	1 Nov 2021	Unauthorized Access/Disclosure	Email	No
World Trade Center Health Program	Health Plan	1,071	7 May 2026	Hacking/IT Incident	Network Server	Yes
Washington DC VA Medical Center	Healthcare Provider	1,062	31 May 2016	Theft	Paper/Films	No
Children's National Medical Center	Healthcare Provider	722	30 Mar 2018	Theft	Laptop	No
Community of Hope D.C.	Healthcare Provider	580	30 Jun 2022	Hacking/IT Incident	Email	No
The George Washington University Medical Faculty Associates	Healthcare Provider	576	13 Jul 2021	Unauthorized Access/Disclosure	Email	No
DC Chartered Health Plan, Inc	Health Plan	540	23 Jul 2010	Theft	Laptop	No

Index / Companion schedules

13 HHS breach register

→

Hub: every filing, by state, year and entity.

04 Biggest breaches

→

Mega-breaches with primary-source cost figures.

Industry / Healthcare

→

IBM 2026: $6.64M average, 13 years at #1.

Regulation / HIPAA penalties

→

OCR enforcement tiers and the 60-day rule.

11 50-state laws

→

Deadline, AG threshold and penalties per state.

Cost / Per record

→

Where the per-record model is reliable.

Provenance

Source: U.S. Department of Health and Human Services, Office for Civil Rights, Breach Portal (breaches affecting 500 or more individuals), retrieved 2026-10-08. Public domain. Individuals affected and dates as reported by the covered entity.

Portal: ocrportal.hhs.gov breach report. Statutory basis: HITECH Act section 13402(e)(4): the Secretary must post a list of breaches of unsecured protected health information affecting 500 or more individuals. Breaches affecting fewer than 500 individuals are reported to OCR annually and are not posted, so they are not on this register. Status wording follows the portal's two tabs ("Cases Currently Under Investigation" and "Archive") as of 8 October 2026; a filing moves to the archive when OCR closes the case. Modelled costs on this site are a method applied to the reported count, using IBM Cost of a Data Breach per-record figures, and are never a cost disclosed by the entity.

Corrections: if you represent a listed entity and the portal row has been amended, email [email protected] with the portal entry and we will re-pull the export.