Geography
Iowa: 98 healthcare breach filings.
Iowa entities have reported 98 breaches of 500 or more individuals to HHS since 2010, the 27th most of the 52 states and territories on the register, covering 6,612,086 individuals (27th by people affected). 6 are still under investigation. Hacking/IT Incident is the breach type on 67% of them, and network server the most common location (50%).
Filings
98
27th of 52 states and territories
Individuals affected
6,612,086
Median filing 4,336
Largest filing
1,421,107
Iowa Health System d/b/a UnityPoint Health, 2018
Hacking / IT share
67%
33 filings involve a business associate
Direct answer / Iowa on the HHS portal
The largest Iowa filing is Iowa Health System d/b/a UnityPoint Health (1,421,107 individuals, submitted 30 July 2018). The busiest year was 2020 with 26 filings. Healthcare Providers account for 74% of the state's filings. 39 filings of 10,000 or more individuals have their own page; the remaining 59 are listed in the table at the foot of this page.
Section IA.1 / Largest filings
Ten largest Iowa breaches
| # | Covered entity | Type | Individuals | Submitted | Breach type | Location | BA |
|---|---|---|---|---|---|---|---|
| 1 | Iowa Health System d/b/a UnityPoint Health | Business Associate | 1,421,107 | 30 Jul 2018 | |||
| 2 | PurFoods, LLC | Healthcare Provider | 1,289,643 | 25 Aug 2023 | |||
| 3 | OpenLoop Health, Inc.Open | Business Associate | 716,000 | 17 Mar 2026 | |||
| 4 | Wolfe Clinic, P.C. | Healthcare Provider | 530,299 | 9 Sep 2022 | |||
| 5 | Wolfe Clinic, P.C. | Healthcare Provider | 499,779 | 9 Apr 2021 | |||
| 6 | Des Moines Orthopaedic Surgeons, P.C. | Healthcare Provider | 307,864 | 22 Jan 2024 | |||
| 7 | Iowa Department of Health and Human Services - Iowa Medicaid | Health Plan | 233,834 | 30 May 2023 | |||
| 8 | CR Pharmacy Services, Inc. d/b/a CarePro | Healthcare Provider | 151,499 | 15 Jan 2024 | |||
| 9 | St. Anthony Regional Hospital | Healthcare Provider | 139,214 | 25 Oct 2024 | |||
| 10 | Timberline Billing Service, LLC | Business Associate | 117,088 | 30 Oct 2020 |
Section IA.2 / By year
Iowa filings by submission year
Each year links to the national year page.
| Year | Filings | Individuals affected | Hacking / IT share | Filings with a page |
|---|---|---|---|---|
| 2010 | 1 | 19,222 | 0% | 1 |
| 2012 | 2 | 4,298 | 0% | 0 |
| 2013 | 2 | 9,160 | 0% | 0 |
| 2014 | 3 | 4,304 | 0% | 0 |
| 2016 | 4 | 22,051 | 25% | 1 |
| 2017 | 4 | 9,629 | 25% | 0 |
| 2018 | 10 | 1,519,026 | 50% | 5 |
| 2019 | 5 | 22,707 | 60% | 1 |
| 2020 | 26 | 297,908 | 81% | 5 |
| 2021 | 5 | 605,446 | 100% | 4 |
| 2022 | 2 | 531,906 | 100% | 1 |
| 2023 | 13 | 1,846,963 | 92% | 10 |
| 2024 | 8 | 733,177 | 75% | 6 |
| 2025 | 7 | 218,559 | 86% | 2 |
| 2026 | 6 | 767,730 | 67% | 3 |
Section IA.3 / Composition
Breach type, location and who filed
Multi-valued fields count once per value.
Type of breach
Location of breached information
Covered entity type
Section IA.4 / Notification law
What Iowa law required alongside HIPAA
State notification statute
Iowa: Iowa Code Ch. 715C
Personal Information Security Breach Protection Act
- Notice to individuals
- In the most expedient time possible and without unreasonable delay
- Attorney general threshold
- 500 or more Iowa residents (Within five business days after notifying consumers)
- Private right of action
- No: No private right of action; AG enforcement only
- Penalty
- Unlawful practice under the consumer fraud statute; injunctive relief, civil penalties, and damages
The HIPAA Breach Notification Rule runs alongside the state statute: notice to affected individuals and to HHS without unreasonable delay and no later than 60 days after discovery.
Section IA.5 / Filing pages
39 filings of 10,000 or more individuals
Each links to a page with the full filing, its rank in the state and year, OCR's closing summary where the case is archived, peers, and the modelled cost.
Section IA.6 / All other filings
59 filings below 10,000 individuals
Listed in full from the HHS export, largest first. These filings do not have their own page.
| Covered entity | Type | Individuals | Submitted | Breach type | Location | BA |
|---|---|---|---|---|---|---|
| Monroe County Hospital & Clinics | Healthcare Provider | 8,487 | 17 Feb 2020 | |||
| Iowa Department of Human Services | Healthcare Provider | 7,335 | 26 Jun 2013 | |||
| Iowa Department of Health and Human Services | Health Plan | 6,717 | 16 Apr 2026 | |||
| Wellmark Health Insurance | Health Plan | 6,666 | 26 May 2026 | |||
| University of Iowa Hospitals & Clinics | Healthcare Provider | 5,292 | 22 Jun 2017 | |||
| Northern Iowa Therapy PC | Business Associate | 5,112 | 29 Oct 2023 | |||
| Virginia Gay Hospital | Healthcare Provider | 5,030 | 16 Aug 2019 | |||
| Crossroads Behavioral Health | Healthcare Provider | 5,000 | 28 Aug 2018 | |||
| Iowa Department of Human Services | Health Plan | 4,501 | 27 Jan 2020 | |||
| Scott County, Iowa | Healthcare Provider | 4,336 | 28 Feb 2025 | |||
| Iowa Health and Human ServicesOpen | Health Plan | 3,340 | 6 Jan 2026 | |||
| Iowa Department of Human Services | Health Plan | 3,000 | 11 May 2012 | |||
| Iowa Veterans Home | Healthcare Provider | 2,969 | 21 Apr 2017 | |||
| Planned Parenthood of the Heartland | Healthcare Provider | 2,506 | 1 Jul 2016 | |||
| Grx Holdings, LLC dba Medicap Pharmacy | Healthcare Provider | 2,300 | 2 Feb 2016 | |||
| Iowa Dept. of Human Services | Health Plan | 2,042 | 10 Mar 2014 | |||
| Muscatine Community School District | Healthcare Provider | 2,039 | 29 Oct 2020 | |||
| Wayne County Hospital | Healthcare Provider | 2,016 | 1 Jul 2021 | |||
| Mercy Medical Center- North Iowa | Healthcare Provider | 1,971 | 26 Nov 2018 | |||
| Burlington Community School District | Healthcare Provider | 1,884 | 29 Oct 2020 | |||
| UnityPoint Health Affiliated | Healthcare Provider | 1,825 | 2 Oct 2013 | |||
| Johnston Community School District | Healthcare Provider | 1,656 | 30 Oct 2020 | |||
| Molina Healthcare of Iowa, Inc. | Business Associate | 1,647 | 22 Nov 2023 | |||
| Clinton Community School District | Healthcare Provider | 1,643 | 30 Oct 2020 | |||
| UnityPoint Health Affiliated Covered Entity | Healthcare Provider | 1,620 | 11 May 2016 | |||
| Scott County, Iowa | Business Associate | 1,607 | 25 Jul 2022 | |||
| Cedar Falls Community School District | Healthcare Provider | 1,445 | 30 Oct 2020 | |||
| VGM Homelink | Business Associate | 1,400 | 18 Apr 2014 | |||
| City of Dubuque Fire Department | Healthcare Provider | 1,381 | 14 Feb 2024 | |||
| Visiting Nurse Services of Iowa | Healthcare Provider | 1,298 | 16 Jul 2012 | |||
| Balance Autism | Healthcare Provider | 1,281 | 16 May 2025 | |||
| Amerigroup Iowa, Inc. | Business Associate | 1,191 | 29 Mar 2019 | |||
| Indianola Community School District | Healthcare Provider | 1,141 | 29 Oct 2020 | |||
| Cedar County Iowa | Healthcare Provider | 1,138 | 8 Oct 2020 | |||
| Polk County Health Services, Inc | Health Plan | 1,071 | 12 Apr 2018 | |||
| University of Iowa Hospitals & Clinics | Healthcare Provider | 950 | 25 Jun 2019 | |||
| June E. Nylen Cancer Center | Healthcare Provider | 927 | 11 Sep 2019 | |||
| The Iowa Clinic, P.C. | Healthcare Provider | 914 | 11 Aug 2020 | |||
| Lewis Central Community School District | Healthcare Provider | 905 | 30 Oct 2020 | |||
| Iowa Medicaid Enterprise | Health Plan | 862 | 25 Apr 2014 | |||
| Iowa Department of Health and Human Services | Health Plan | 833 | 26 May 2023 | |||
| Iowa Department of Human Services | Health Plan | 811 | 20 Oct 2017 | |||
| Primary Health Care, Inc. | Healthcare Provider | 787 | 6 May 2025 | |||
| Clear Creek Amana Community School District | Healthcare Provider | 771 | 29 Oct 2020 | |||
| United Community Health Center | Healthcare Provider | 750 | 28 Feb 2025 | |||
| Maquoketa Community School District | Healthcare Provider | 743 | 29 Oct 2020 | |||
| Mending Minds LLC dba Walnut Creek Psychiatry | Healthcare Provider | 733 | 1 Jun 2024 | |||
| Prelude Behavioral Services | Healthcare Provider | 699 | 14 Sep 2020 | |||
| Urbandale Community School District | Healthcare Provider | 647 | 30 Oct 2020 | |||
| Bondurant-Farrar Community School District | Healthcare Provider | 603 | 30 Oct 2020 | |||
| Thielen Student Health Center | Healthcare Provider | 599 | 30 Nov 2018 | |||
| Saydel Community School District | Healthcare Provider | 590 | 30 Oct 2020 | |||
| Charles City Community School District | Healthcare Provider | 580 | 29 Oct 2020 | |||
| Carlisle Community School District | Healthcare Provider | 562 | 30 Oct 2020 | |||
| Central Iowa Hospital Corporation d/b/a Blank Children's Hospital | Healthcare Provider | 557 | 8 Dec 2017 | |||
| Iowa Total Care, Inc. | Health Plan | 536 | 18 Dec 2020 | |||
| Planned Parenthood of the Heartland | Healthcare Provider | 515 | 29 Jun 2018 | |||
| PDCM InsuranceOpen | Business Associate | 501 | 27 Jun 2025 | |||
| June E. Nylen Cancer Center | Healthcare Provider | 500 | 14 Sep 2020 |
Index / Other states
Every state on the register
98
32
164
92
776
139
144
31
33
463
226
22
29
358
200
80
124
66
37
170
241
238
189
55
164
36
60
55
38
174
57
511
207
19
276
80
120
339
32
41
86
15
196
633
68
15
157
185
47
126
19
Index / Companion schedules
13 HHS breach register
→Hub: every filing, by state, year and entity.
04 Biggest breaches
→Mega-breaches with primary-source cost figures.
Industry / Healthcare
→IBM 2026: $6.64M average, 13 years at #1.
Regulation / HIPAA penalties
→OCR enforcement tiers and the 60-day rule.
11 50-state laws
→Deadline, AG threshold and penalties per state.
Cost / Per record
→Where the per-record model is reliable.
Provenance
Source: U.S. Department of Health and Human Services, Office for Civil Rights, Breach Portal (breaches affecting 500 or more individuals), retrieved 2026-08-28. Public domain. Individuals affected and dates as reported by the covered entity.
Portal: ocrportal.hhs.gov breach report. Statutory basis: HITECH Act section 13402(e)(4): the Secretary must post a list of breaches of unsecured protected health information affecting 500 or more individuals. Breaches affecting fewer than 500 individuals are reported to OCR annually and are not posted, so they are not on this register. Status wording follows the portal's two tabs ("Cases Currently Under Investigation" and "Archive") as of 28 August 2026; a filing moves to the archive when OCR closes the case. Modelled costs on this site are a method applied to the reported count, using IBM Cost of a Data Breach per-record figures, and are never a cost disclosed by the entity.
Corrections: if you represent a listed entity and the portal row has been amended, email [email protected] with the portal entry and we will re-pull the export.