State File KY / HHS OCR Breach Register124 filings, 2010 to 2026Retrieved 28 August 2026

Geography

Kentucky: 124 healthcare breach filings.

Kentucky entities have reported 124 breaches of 500 or more individuals to HHS since 2010, the 24th most of the 52 states and territories on the register, covering 11,757,126 individuals (24th by people affected). 7 are still under investigation. Hacking/IT Incident is the breach type on 47% of them, and network server the most common location (38%).

Filings

124

24th of 52 states and territories

Individuals affected

11,757,126

Median filing 3,663

Largest filing

5,815,591

PharMerica Corporation, 2023

Hacking / IT share

47%

35 filings involve a business associate

Direct answer / Kentucky on the HHS portal

The largest Kentucky filing is PharMerica Corporation (5,815,591 individuals, submitted 12 May 2023). The busiest year was 2020 with 12 filings. Healthcare Providers account for 65% of the state's filings. 32 filings of 10,000 or more individuals have their own page; the remaining 92 are listed in the table at the foot of this page.

Section KY.1 / Largest filings

Ten largest Kentucky breaches

#	Covered entity	Type	Individuals	Submitted	Breach type	Location	BA
1	PharMerica Corporation	Healthcare Provider	5,815,591	12 May 2023	Hacking/IT Incident	Network Server	No
2	Norton Healthcare Inc.	Healthcare Provider	2,500,000	7 Jul 2023	Hacking/IT Incident	Network Server	No
3	Commonwealth Health Corporation	Healthcare Provider	697,800	1 Mar 2017	Unauthorized Access/Disclosure	Other Portable Electronic Device	No
4	CorrectCare Integrated Health, Inc.	Business Associate	502,089	31 Oct 2022	Unauthorized Access/Disclosure	Network Server	Yes
5	Cornerstone Healthcare Group Management Services LLC	Business Associate	484,957	14 Mar 2024	Hacking/IT Incident	Network Server	Yes
6	Taylor Regional Hospital	Healthcare Provider	190,209	21 Mar 2022	Hacking/IT Incident	Network Server	No
7	Central Kentucky RadiologyOpen	Healthcare Provider	166,953	13 Jun 2025	Hacking/IT Incident	Network Server	No
8	University of Kentucky HealthCare	Healthcare Provider	163,774	8 Sep 2020	Hacking/IT Incident	Network Server	Yes
9	Imperium Health LLC	Business Associate	139,114	17 Aug 2020	Hacking/IT Incident	Email	Yes
10	Seven Counties Services, Inc.	Healthcare Provider	132,609	4 Oct 2024	Hacking/IT Incident	Email	No

Section KY.2 / By year

Kentucky filings by submission year

Each year links to the national year page.

Year	Filings	Individuals affected	Hacking / IT share	Filings with a page
2010	6	36,772	17%	1
2011	6	35,616	17%	1
2012	6	12,462	0%	0
2013	1	535	0%	0
2014	8	21,032	0%	0
2015	5	97,869	40%	1
2016	5	8,501	20%	0
2017	10	768,648	50%	3
2018	4	66,205	25%	2
2019	9	44,919	44%	1
2020	12	350,922	75%	4
2021	10	226,084	60%	3
2022	3	696,678	33%	2
2023	10	8,366,313	80%	3
2024	11	701,371	45%	6
2025	9	233,836	78%	2
2026	9	89,363	78%	3

Section KY.3 / Composition

Breach type, location and who filed

Multi-valued fields count once per value.

Type of breach

Hacking/IT Incident58 (47%)

Unauthorized Access/Disclosure41 (33%)

Theft20 (16%)

Loss4 (3%)

Other3 (2%)

Improper Disposal1 (1%)

Location of breached information

Network Server47 (38%)

Email28 (23%)

Paper/Films19 (15%)

Other Portable Electronic Device13 (10%)

Laptop13 (10%)

Other12 (10%)

Electronic Medical Record4 (3%)

Desktop Computer2 (2%)

Covered entity type

Healthcare Provider81 (65%)

Health Plan33 (27%)

Business Associate10 (8%)

Section KY.4 / Notification law

What Kentucky law required alongside HIPAA

State notification statute

Kentucky: KRS 365.732

Notice to individuals: Without unreasonable delay, consistent with determining the scope of the breach
Attorney general threshold: No general AG requirement (reporting agencies at more than 1,000 residents)
Private right of action: No: No express PROA; KRS 446.070 may allow recovery for statutory violations
Penalty: Limited private-sector enforcement; AG action under consumer protection statutes

The HIPAA Breach Notification Rule runs alongside the state statute: notice to affected individuals and to HHS without unreasonable delay and no later than 60 days after discovery.

Kentucky notification law in full HIPAA breach penalties

Section KY.5 / Filing pages

32 filings of 10,000 or more individuals

Each links to a page with the full filing, its rank in the state and year, OCR's closing summary where the case is archived, peers, and the modelled cost.

Covered entity	Type	Individuals	Submitted	Breach type	Location	BA
PharMerica Corporation	Healthcare Provider	5,815,591	12 May 2023	Hacking/IT Incident	Network Server	No
Norton Healthcare Inc.	Healthcare Provider	2,500,000	7 Jul 2023	Hacking/IT Incident	Network Server	No
Commonwealth Health Corporation	Healthcare Provider	697,800	1 Mar 2017	Unauthorized Access/Disclosure	Other Portable Electronic Device	No
CorrectCare Integrated Health, Inc.	Business Associate	502,089	31 Oct 2022	Unauthorized Access/Disclosure	Network Server	Yes
Cornerstone Healthcare Group Management Services LLC	Business Associate	484,957	14 Mar 2024	Hacking/IT Incident	Network Server	Yes
Taylor Regional Hospital	Healthcare Provider	190,209	21 Mar 2022	Hacking/IT Incident	Network Server	No
Central Kentucky RadiologyOpen	Healthcare Provider	166,953	13 Jun 2025	Hacking/IT Incident	Network Server	No
University of Kentucky HealthCare	Healthcare Provider	163,774	8 Sep 2020	Hacking/IT Incident	Network Server	Yes
Imperium Health LLC	Business Associate	139,114	17 Aug 2020	Hacking/IT Incident	Email	Yes
Seven Counties Services, Inc.	Healthcare Provider	132,609	4 Oct 2024	Hacking/IT Incident	Email	No
Southern Orthopaedic Associates d/b/a Orthopaedic Institute of Western Kentucky	Healthcare Provider	106,910	20 Dec 2021	Hacking/IT Incident	Email	No
OH Muhlenberg, LLC	Healthcare Provider	84,681	13 Nov 2015	Hacking/IT Incident	Desktop Computer, Email, Laptop, Network Server, Other Portable Electronic Device	No
Humana Inc	Health Plan	64,654	22 Feb 2021	Unauthorized Access/Disclosure	Network Server	Yes
Onco360 and CareMed Specialty Pharmacy	Healthcare Provider	53,173	12 Jan 2018	Hacking/IT Incident	Email	No
UofL Health, Inc.	Healthcare Provider	42,465	7 Jun 2021	Unauthorized Access/Disclosure	Email	No
Cumberland County Hospital Association	Healthcare Provider	36,659	2 Jun 2025	Hacking/IT Incident	Network Server	No
Pulmonary Specialists of Louisville, PSC	Healthcare Provider	32,000	27 Nov 2017	Hacking/IT Incident	Electronic Medical Record	No
Kentucky Mountain Health AllianceOpen	Healthcare Provider	30,830	19 Jun 2026	Hacking/IT Incident	Network Server	No
Lexington Diagnostic Center	Healthcare Provider	29,819	24 Dec 2024	Hacking/IT Incident	Network Server	No
Our Lady of Peace Hospital	Healthcare Provider	24,600	29 Dec 2010	Loss, Theft	Other, Other Portable Electronic Device	No
Pennyroyal Healthcare ServicesOpen	Healthcare Provider	24,122	23 Mar 2026	Hacking/IT Incident	Network Server	No
Personal Touch Home Care of KY, Inc.	Healthcare Provider	24,013	28 Jan 2020	Hacking/IT Incident	Network Server, Other	Yes
Ashland Women's Health	Healthcare Provider	19,727	4 Apr 2017	Hacking/IT Incident	Network Server	No
Integranetics	Business Associate	18,871	7 Feb 2011	Hacking/IT Incident	Network Server	Yes
Kentucky Counseling Center, LLC	Healthcare Provider	16,440	11 Feb 2019	Unauthorized Access/Disclosure	Electronic Medical Record	No
Insurance ACE/Humana Inc.	Health Plan	15,003	5 Jun 2024	Unauthorized Access/Disclosure	Paper/Films	No
Seven Counties Services, Inc.	Healthcare Provider	13,375	25 Sep 2020	Hacking/IT Incident	Email	No
Humana Inc.	Health Plan	12,539	22 Jan 2024	Unauthorized Access/Disclosure	Paper/Films	No
Humana Inc.	Health Plan	12,339	8 Feb 2024	Unauthorized Access/Disclosure	Network Server	No
Associates in Dermatology	Healthcare Provider	12,060	17 Mar 2023	Hacking/IT Incident	Network Server	Yes
Orthopaedic Institute of Western Kentucky	Healthcare Provider	11,474	27 Feb 2026	Hacking/IT Incident	Network Server	Yes
CarePlus Health Plan [case #HU1800066]	Health Plan	11,248	5 Feb 2018	Unauthorized Access/Disclosure	Paper/Films	No

Section KY.6 / All other filings

92 filings below 10,000 individuals

Listed in full from the HHS export, largest first. These filings do not have their own page.

Covered entity	Type	Individuals	Submitted	Breach type	Location	BA
Physicians to Children & AdolescentsOpen	Healthcare Provider	9,536	24 Oct 2025	Hacking/IT Incident	Network Server	No
Humana Inc.	Health Plan	9,372	15 Jun 2023	Unauthorized Access/Disclosure	Paper/Films	No
Associates in Dermatology, PLLC	Healthcare Provider	9,020	16 Jul 2019	Hacking/IT Incident	Email	No
Omnicare, Inc	Healthcare Provider	8,845	10 Mar 2011	Theft	Laptop	No
Insurance ACE/Humana Inc.	Health Plan	8,553	6 Feb 2025	Unauthorized Access/Disclosure	Paper/Films	Yes
Family Physicians of Winter Park, Inc.	Healthcare Provider	8,429	8 Jan 2019	Hacking/IT Incident	Email	No
UofL Health	Healthcare Provider	8,175	18 Aug 2023	Hacking/IT Incident	Network Server	No
HealthPoint Family Care	Healthcare Provider	7,990	5 Jan 2026	Unauthorized Access/Disclosure	Email	No
CenterWell ACE/Home Solutions	Healthcare Provider	7,972	27 Feb 2026	Hacking/IT Incident	Network Server	Yes
Hospice of the Bluegrass, Inc. dba Bluegrass Care Navigators	Healthcare Provider	7,664	26 Sep 2023	Hacking/IT Incident	Email	No
Humana Inc.	Health Plan	6,440	6 Feb 2024	Unauthorized Access/Disclosure	Paper/Films	No
Humana Inc	Health Plan	5,764	21 Nov 2017	Unauthorized Access/Disclosure	Network Server	Yes
Humana Inc	Health Plan	5,569	27 Feb 2019	Hacking/IT Incident	Network Server	Yes
International Union of Operating Engineers Local Unions 181, 320 & TVA Health and Welfare Trust Fund	Health Plan	5,440	9 Apr 2015	Hacking/IT Incident	Network Server	Yes
Estill County Chiropractic, PLLC	Healthcare Provider	5,335	16 Mar 2017	Hacking/IT Incident	Network Server	No
Medical Center At Bowling Green	Healthcare Provider	5,148	26 Apr 2010	Theft	Other, Other Portable Electronic Device	No
Jordan Drug, Inc.	Healthcare Provider	4,947	26 Jun 2025	Hacking/IT Incident	Network Server	No
ReachOut Home Care [Case #16687]	Healthcare Provider	4,500	9 Dec 2014	Theft	Laptop	No
Banis Plastic Surgery	Healthcare Provider	4,498	4 Apr 2023	Unauthorized Access/Disclosure	Email	No
University of Kentucky HealthCare	Healthcare Provider	4,490	19 Jun 2012	Theft	Laptop	No
Humana Inc	Health Plan	4,424	12 Oct 2021	Hacking/IT Incident	Network Server	Yes
CorrectCare Integrated Health, Inc.	Business Associate	4,380	31 Oct 2022	Unauthorized Access/Disclosure	Network Server	Yes
Owensboro Medical Practice, PLLC	Healthcare Provider	4,077	25 Sep 2014	Unauthorized Access/Disclosure	Other Portable Electronic Device	No
Research Integrity, LLC	Business Associate	4,077	22 Sep 2014	Unauthorized Access/Disclosure	Other Portable Electronic Device	Yes
Ethan Health, LLC	Healthcare Provider	4,047	14 Apr 2023	Hacking/IT Incident	Email	No
Humana Inc [case # HU17001CC]	Health Plan	3,831	18 Apr 2017	Hacking/IT Incident	Network Server	No
Inlet Health dba CommunicareOpen	Healthcare Provider	3,771	22 Jan 2025	Hacking/IT Incident	Network Server	No
Stewart Home & SchoolOpen	Healthcare Provider	3,677	23 Apr 2026	Hacking/IT Incident	Email, Network Server	No
Humana Inc. [case #HU16004F3]	Health Plan	3,674	19 Dec 2016	Unauthorized Access/Disclosure	Paper/Films	No
Kentuckiana Regional Planning and Development Agency	Healthcare Provider	3,663	5 Jun 2020	Hacking/IT Incident	Desktop Computer, Email	No
University of Kentucky - UK HealthCare	Healthcare Provider	3,604	28 Jul 2011	Theft	Laptop	No
Insurance ACE/Humana Inc.	Health Plan	3,480	14 Feb 2024	Unauthorized Access/Disclosure	Paper/Films	Yes
Jewish Hospital	Healthcare Provider	2,992	28 Mar 2014	Other	Email	No
Humana Inc [case #15381]	Health Plan	2,962	23 May 2014	Theft	Other Portable Electronic Device	No
CarePlus Health Plans [case 18772]	Health Plan	2,873	6 Oct 2015	Unauthorized Access/Disclosure	Paper/Films	No
Humana Inc.	Health Plan	2,844	21 Dec 2023	Hacking/IT Incident	Network Server	Yes
Humana Inc [Case 18652]	Health Plan	2,815	30 Sep 2015	Theft	Laptop, Paper/Films	No
Cabinet for Health and Family Services, Department for Community Based Services	Healthcare Provider	2,500	19 Sep 2012	Unauthorized Access/Disclosure	Email	No
Alexander J. Tikhtman, M.D.	Healthcare Provider	2,376	12 Oct 2012	Theft	Other Portable Electronic Device	No
Bluegrass Care Navigators	Healthcare Provider	2,343	14 Sep 2020	Hacking/IT Incident	Network Server	Yes
Hospice of the Bluegrass, Inc. dba Bluegrass Care Navigators	Healthcare Provider	2,282	17 Apr 2024	Hacking/IT Incident	Email	No
Cumberland Gastroenterology, P.S.C.	Healthcare Provider	2,200	5 Oct 2010	Theft	Paper/Films	No
Jewish Hospital	Healthcare Provider	2,089	5 Aug 2010	Theft	Laptop	No
KY Cabinet for Health and Family Services (CHFS)	Healthcare Provider	2,062	3 Dec 2023	Hacking/IT Incident	Network Server	Yes
T.J. Samson Community Hospital	Healthcare Provider	2,060	7 Aug 2015	Unauthorized Access/Disclosure	Email	No
Hospice Care Plus, Inc.	Healthcare Provider	2,033	6 May 2019	Unauthorized Access/Disclosure	Laptop	No
University of Kentucky	Healthcare Provider	2,027	18 Jun 2010	Theft	Laptop	No
Saint Joseph - Berea	Healthcare Provider	1,986	2 Jun 2011	Loss, Theft	Other, Other Portable Electronic Device	No
Humana Inc	Health Plan	1,965	4 Nov 2021	Hacking/IT Incident	Network Server	Yes
Topy America Inc.	Health Plan	1,827	14 Mar 2025	Hacking/IT Incident	Network Server	No
Humana Inc	Health Plan	1,823	9 Nov 2021	Hacking/IT Incident	Network Server	Yes
Women's Care of Somerset	Healthcare Provider	1,806	31 Mar 2017	Unauthorized Access/Disclosure	Email	No
Insurance ACE/Humana Inc.Open	Health Plan	1,761	15 May 2026	Unauthorized Access/Disclosure	Network Server	No
Saints Mary and Elizabeth Hospital	Healthcare Provider	1,682	10 Jun 2016	Unauthorized Access/Disclosure	Email	No
Hosparus, Inc. dba Care Guide Partners Inc.	Healthcare Provider	1,545	21 Jun 2021	Hacking/IT Incident	Network Server	Yes
Jennie Stuart Medical Center	Healthcare Provider	1,500	23 Sep 2016	Hacking/IT Incident	Network Server	No
Lexington VAMC	Healthcare Provider	1,432	25 Aug 2011	Theft	Laptop, Other Portable Electronic Device, Paper/Films	No
Humana Inc	Health Plan	1,211	9 Jan 2019	Unauthorized Access/Disclosure	Other	Yes
Robley Rex VA Medical Center	Healthcare Provider	1,182	6 Mar 2012	Other	Paper/Films	No
MorshedEye, PLLC	Healthcare Provider	1,100	13 Apr 2018	Unauthorized Access/Disclosure	Email	No
HP Enterprise Services	Business Associate	1,090	28 Dec 2012	Theft	Laptop	Yes
AffirmedRx PBC	Business Associate	1,089	5 Jun 2025	Unauthorized Access/Disclosure	Paper/Films	Yes
Hardin County Emergency Medical Services	Healthcare Provider	1,046	27 Nov 2024	Hacking/IT Incident	Email	No
Waystar Health	Business Associate	1,021	25 Aug 2020	Hacking/IT Incident	Network Server	Yes
Insurance ACE/Humana Inc.	Health Plan	1,000	28 Feb 2026	Hacking/IT Incident	Network Server	Yes
Berea College	Healthcare Provider	1,000	20 Mar 2014	Other	Electronic Medical Record	No
HealthFirst Bluegrass	Healthcare Provider	971	21 Aug 2020	Hacking/IT Incident	Email	No
Associates In EyeCare, P.S.C.	Healthcare Provider	971	16 May 2016	Theft	Laptop, Other Portable Electronic Device	No
Humana Inc	Health Plan	948	28 Sep 2021	Unauthorized Access/Disclosure	Paper/Films	Yes
Baptist Health Louisville	Healthcare Provider	880	21 Nov 2017	Hacking/IT Incident	Email	No
University of Kentucky UK HealthCare	Healthcare Provider	878	23 Nov 2011	Loss	Other Portable Electronic Device	No
Humana Inc	Health Plan	863	3 Jun 2019	Unauthorized Access/Disclosure	Network Server	No
Bardstown Primary Care dba: Physicians to Children & Adolescents	Healthcare Provider	859	24 Nov 2020	Unauthorized Access/Disclosure	Other	Yes
Kentucky Cabinet for Health and Family Services	Health Plan	857	5 Feb 2024	Unauthorized Access/Disclosure	Paper/Films	Yes
Wolf & Yun	Healthcare Provider	824	22 Jun 2012	Theft	Laptop	No
American Urgent Care Center, PSC	Healthcare Provider	822	5 Jan 2017	Theft	Other	No
Humana Inc	Health Plan	756	2 Oct 2019	Unauthorized Access/Disclosure	Email	No
Seven Counties Services, Inc.	Healthcare Provider	727	22 Oct 2014	Improper Disposal, Unauthorized Access/Disclosure	Paper/Films	No
University of Louisville Research Foundation, Inc., DBA The Kidney Disease Program	Healthcare Provider	708	1 Jun 2010	Hacking/IT Incident	Network Server	No
Bon Secours Kentucky	Healthcare Provider	697	9 Sep 2014	Unauthorized Access/Disclosure	Other	No
Meade Physicians, Inc. dba Brandenburg Family Medicine	Healthcare Provider	696	7 Dec 2020	Unauthorized Access/Disclosure	Paper/Films	Yes
Citizens Financial Corporation	Business Associate	688	15 Nov 2021	Unauthorized Access/Disclosure	Other	Yes
Humana Inc	Health Plan	684	31 Dec 2018	Theft	Paper/Films	No
TJ Samson Community Hospital	Healthcare Provider	683	24 Oct 2017	Unauthorized Access/Disclosure	Electronic Medical Record	No
Summit Medical Group, Inc. dba St. Elizabeth Physicians	Healthcare Provider	674	23 Aug 2016	Unauthorized Access/Disclosure	Email	No
Electrical Workers Local 369	Health Plan	662	23 Jul 2021	Hacking/IT Incident	Email	No
Humana Inc.	Health Plan	598	15 Jan 2019	Hacking/IT Incident	Other	No
Humana Inc	Health Plan	564	19 Aug 2020	Hacking/IT Incident	Other	No
Kentucky MSO, LLC	Healthcare Provider	537	13 Jun 2026	Hacking/IT Incident	Network Server	Yes
Health Help, Inc.	Healthcare Provider	535	10 Dec 2013	Theft	Other Portable Electronic Device	No
Hi-Tech Artificial Limbs, Inc.	Healthcare Provider	529	20 Nov 2020	Loss	Other	No
Dermatology Associates	Healthcare Provider	501	3 Oct 2025	Hacking/IT Incident	Network Server	No

Index / Companion schedules

13 HHS breach register

→

Hub: every filing, by state, year and entity.

04 Biggest breaches

→

Mega-breaches with primary-source cost figures.

Industry / Healthcare

→

IBM 2026: $6.64M average, 13 years at #1.

Regulation / HIPAA penalties

→

OCR enforcement tiers and the 60-day rule.

11 50-state laws

→

Deadline, AG threshold and penalties per state.

Cost / Per record

→

Where the per-record model is reliable.

Provenance

Source: U.S. Department of Health and Human Services, Office for Civil Rights, Breach Portal (breaches affecting 500 or more individuals), retrieved 2026-08-28. Public domain. Individuals affected and dates as reported by the covered entity.

Portal: ocrportal.hhs.gov breach report. Statutory basis: HITECH Act section 13402(e)(4): the Secretary must post a list of breaches of unsecured protected health information affecting 500 or more individuals. Breaches affecting fewer than 500 individuals are reported to OCR annually and are not posted, so they are not on this register. Status wording follows the portal's two tabs ("Cases Currently Under Investigation" and "Archive") as of 28 August 2026; a filing moves to the archive when OCR closes the case. Modelled costs on this site are a method applied to the reported count, using IBM Cost of a Data Breach per-record figures, and are never a cost disclosed by the entity.

Corrections: if you represent a listed entity and the portal row has been amended, email [email protected] with the portal entry and we will re-pull the export.