Geography
Maryland: 170 healthcare breach filings.
Maryland entities have reported 170 breaches of 500 or more individuals to HHS since 2010, the 17th most of the 52 states and territories on the register, covering 19,168,200 individuals (16th by people affected). 16 are still under investigation. Hacking/IT Incident is the breach type on 69% of them, and network server the most common location (45%).
Filings
170
17th of 52 states and territories
Individuals affected
19,168,200
Median filing 4,792
Largest filing
3,112,815
Centers for Medicare & Medicaid Services, 2024
Hacking / IT share
69%
65 filings involve a business associate
Direct answer / Maryland on the HHS portal
The largest Maryland filing is Centers for Medicare & Medicaid Services (3,112,815 individuals, submitted 6 September 2024). The busiest year was 2025 with 19 filings. Healthcare Providers account for 64% of the state's filings. 66 filings of 10,000 or more individuals have their own page; the remaining 104 are listed in the table at the foot of this page.
Section MD.1 / Largest filings
Ten largest Maryland breaches
| # | Covered entity | Type | Individuals | Submitted | Breach type | Location | BA |
|---|---|---|---|---|---|---|---|
| 1 | Centers for Medicare & Medicaid Services | Health Plan | 3,112,815 | 6 Sep 2024 | |||
| 2 | Centers for Medicare & Medicaid Services | Health Plan | 2,342,357 | 28 Jul 2023 | |||
| 3 | Insightin Health, Inc.Open | Business Associate | 1,949,534 | 16 Jan 2026 | |||
| 4 | Anne Arundel DermatologyOpen | Healthcare Provider | 1,905,000 | 11 Jul 2025 | |||
| 5 | CareFirst Blue Cross Blue Shield | Health Plan | 1,300,000 | 20 May 2015 | |||
| 6 | Frederick HealthOpen | Healthcare Provider | 934,326 | 28 Mar 2025 | |||
| 7 | US Fertility LLC | Business Associate | 878,550 | 25 Nov 2020 | |||
| 8 | Luminis Health Anne Arundel Medical Center | Healthcare Provider | 824,450 | 2 Nov 2021 | |||
| 9 | Bon Secours Health System Incorporated | Healthcare Provider | 651,971 | 12 Aug 2016 | |||
| 10 | Kelly & Associates Insurance Group, Inc.Open | Business Associate | 553,332 | 9 Apr 2025 |
Section MD.2 / By year
Maryland filings by submission year
Each year links to the national year page.
| Year | Filings | Individuals affected | Hacking / IT share | Filings with a page |
|---|---|---|---|---|
| 2010 | 4 | 17,492 | 25% | 1 |
| 2011 | 2 | 5,765 | 0% | 0 |
| 2012 | 3 | 12,556 | 0% | 1 |
| 2013 | 4 | 23,058 | 25% | 0 |
| 2014 | 6 | 273,719 | 17% | 3 |
| 2015 | 8 | 1,331,380 | 38% | 2 |
| 2016 | 6 | 669,919 | 67% | 2 |
| 2017 | 8 | 55,961 | 50% | 2 |
| 2018 | 9 | 589,054 | 56% | 3 |
| 2019 | 15 | 187,626 | 73% | 4 |
| 2020 | 16 | 1,190,495 | 81% | 9 |
| 2021 | 15 | 1,180,040 | 87% | 7 |
| 2022 | 16 | 217,660 | 75% | 6 |
| 2023 | 16 | 3,676,102 | 81% | 9 |
| 2024 | 13 | 3,802,477 | 77% | 5 |
| 2025 | 19 | 3,966,198 | 84% | 11 |
| 2026 | 10 | 1,968,698 | 100% | 1 |
Section MD.3 / Composition
Breach type, location and who filed
Multi-valued fields count once per value.
Type of breach
Location of breached information
Covered entity type
Section MD.4 / Notification law
What Maryland law required alongside HIPAA
State notification statute
Maryland: Md. Code, Com. Law 14-3504
- Notice to individuals
- Within 45 days after discovery or notification of the breach
- Attorney general threshold
- All breaches (AG notified before individual notices are sent) (Before individual notifications are sent)
- Private right of action
- No: No PROA under the breach statute; AG enforcement only
- Penalty
- Unfair or deceptive trade practice; up to $10,000 per violation, $25,000 per repeat violation
The HIPAA Breach Notification Rule runs alongside the state statute: notice to affected individuals and to HHS without unreasonable delay and no later than 60 days after discovery.
Section MD.5 / Filing pages
66 filings of 10,000 or more individuals
Each links to a page with the full filing, its rank in the state and year, OCR's closing summary where the case is archived, peers, and the modelled cost.
Section MD.6 / All other filings
104 filings below 10,000 individuals
Listed in full from the HHS export, largest first. These filings do not have their own page.
| Covered entity | Type | Individuals | Submitted | Breach type | Location | BA |
|---|---|---|---|---|---|---|
| Hope Health Systems Inc. | Healthcare Provider | 9,972 | 21 Nov 2022 | |||
| Original Medicare | Health Plan | 9,965 | 31 Jan 2020 | |||
| Cheasapeake Regional Information System for our Patients, Inc. (CRISP) | Business Associate | 8,008 | 11 Oct 2024 | |||
| Hospice of the Chesapeake | Healthcare Provider | 7,606 | 12 Nov 2013 | |||
| ASC Ortho Management Company, LLC d/b/a Aligned Orthopedic PartnersOpen | Healthcare Provider | 7,213 | 17 Apr 2026 | |||
| Montgomery Hospice, Inc. | Healthcare Provider | 6,741 | 15 Jan 2021 | |||
| Family Medicine Shady Grove LLC | Healthcare Provider | 6,482 | 3 Oct 2022 | |||
| Catoctin Dental/Richard B. Love, D.D.S., P.A. | Healthcare Provider | 6,400 | 20 Feb 2013 | |||
| CareFirst Blue Cross Blue Shield | Health Plan | 6,200 | 26 Apr 2018 | |||
| New Schryver, LLC d/b/a/ TridentCare | Healthcare Provider | 6,190 | 16 Jun 2022 | |||
| Center for Pain Management, LLC | Healthcare Provider | 5,822 | 12 Feb 2013 | |||
| Hebrew Home of Greater Washington | Healthcare Provider | 5,693 | 17 Apr 2020 | |||
| Westminster Ingleside King Farm Presbyterian Retirement Communities, Inc. | Healthcare Provider | 5,228 | 19 Jan 2018 | |||
| Serene Sedation, LLC | Healthcare Provider | 5,207 | 14 Mar 2018 | |||
| IHS | Health Plan | 5,000 | 15 Apr 2014 | |||
| St. Joseph Medical Center | Healthcare Provider | 5,000 | 3 Nov 2011 | |||
| Forest Hill Pediatrics, LLC | Healthcare Provider | 4,850 | 25 Oct 2022 | |||
| Neurology Physicians LLC | Healthcare Provider | 4,831 | 20 Jul 2016 | |||
| Primary Health & Wellness Center, LLC | Healthcare Provider | 4,792 | 17 Dec 2023 | |||
| TidalHealth Peninsula Regional | Healthcare Provider | 4,070 | 26 May 2021 | |||
| Monocacy Valley Dental | Healthcare Provider | 4,000 | 15 Aug 2023 | |||
| Capital Nephrology | Healthcare Provider | 4,000 | 2 May 2017 | |||
| Forward Healthcare, LLC | Healthcare Provider | 3,999 | 8 Feb 2024 | |||
| Magellan Complete Care of Virginia, LLC | Health Plan | 3,568 | 15 Jun 2020 | |||
| Axis Healthcare Group P.C. | Healthcare Provider | 3,537 | 28 Jan 2026 | |||
| Riderwood Village | Healthcare Provider | 3,230 | 17 Jan 2013 | |||
| Jewish Social Services Agency | Healthcare Provider | 3,145 | 12 Dec 2019 | |||
| Infosys Public Services, Inc. ("Infosys") | Business Associate | 2,985 | 31 Jan 2025 | |||
| Howard County General Hospital | Healthcare Provider | 2,975 | 31 Jul 2023 | |||
| Potomac Medical Aesthetics, LLC | Healthcare Provider | 2,876 | 1 Nov 2024 | |||
| St. Agnes Healthcare Inc. | Healthcare Provider | 2,821 | 7 May 2021 | |||
| Kaiser Foundation Health Plan of the Mid-Atlantic States | Health Plan | 2,756 | 22 May 2020 | |||
| Rockville Eye Surgery Center LLC dba Palisades Eye Surgery Center | Healthcare Provider | 2,696 | 17 Jul 2019 | |||
| Griffith Energy Services Inc. Welfare Benefit Plan | Health Plan | 2,693 | 24 Sep 2021 | |||
| Baltimore City Health Department | Healthcare Provider | 2,597 | 28 Jan 2026 | |||
| Johns Hopkins Health System Corporation | Business Associate | 2,584 | 31 Jul 2023 | |||
| Three Lower Counties Community Services, Inc. d/b/a Chesapeake Health Care | Healthcare Provider | 2,505 | 31 Mar 2021 | |||
| Anne Arundel Health System | Healthcare Provider | 2,208 | 8 Oct 2015 | |||
| Family Medical Center | Healthcare Provider | 2,100 | 29 Oct 2024 | |||
| Healthcare Assistance Plan for Employees of Seventh-day Adventist Organization of the North American Division | Health Plan | 2,008 | 13 May 2022 | |||
| CAPITOL CARDIOLOGY ASSOCIATES | Healthcare Provider | 1,980 | 7 Jun 2019 | |||
| Bloom Health Centers | Healthcare Provider | 1,954 | 1 Feb 2024 | |||
| Precision Orthopedics and Sports Medicine | Healthcare Provider | 1,903 | 13 Feb 2025 | |||
| JEV Plastic Surgery & Medical Aesthetics | Healthcare Provider | 1,620 | 3 Nov 2021 | |||
| Skin Care Specialty Physicians | Healthcare Provider | 1,553 | 21 Dec 2021 | |||
| Bloom Health Centers | Healthcare Provider | 1,545 | 1 Sep 2023 | |||
| Medi-Rents & Sales, Inc.Open | Healthcare Provider | 1,524 | 25 Mar 2026 | |||
| Keswick Multi-Care Center | Healthcare Provider | 1,508 | 20 Jul 2022 | |||
| Bay Medical LLCOpen | Healthcare Provider | 1,483 | 9 Oct 2025 | |||
| Special Agents Mutual Benefit Association | Health Plan | 1,475 | 20 Jul 2015 | |||
| PrevMED | Business Associate | 1,444 | 4 Jun 2012 | |||
| SOUTHERN MARYLAND MEDICAL GROUP LLC | Healthcare Provider | 1,400 | 7 Jun 2019 | |||
| Heart Center of Southern Maryland, L.L.P. | Healthcare Provider | 1,350 | 7 Jul 2016 | |||
| University of Maryland Orthopaedic Associates, P.A. | Healthcare Provider | 1,320 | 13 Jan 2017 | |||
| Anne Arundel Dermatology, P.A. | Healthcare Provider | 1,310 | 9 Aug 2018 | |||
| Adventist HealthCare | Healthcare Provider | 1,300 | 13 Nov 2025 | |||
| True RCM, a Rapid Care Transcription, Inc., CompanyOpen | Business Associate | 1,247 | 20 Jan 2026 | |||
| 180 Health Partners, Inc. | Business Associate | 1,167 | 30 Jan 2026 | |||
| Associated Catholic Charities Incorporated | Healthcare Provider | 1,145 | 20 Jan 2017 | |||
| West Cecil Health Center | Healthcare Provider | 1,136 | 17 Feb 2023 | |||
| Blakehurst | Healthcare Provider | 1,047 | 6 Dec 2022 | |||
| Skin Care Specialty PhysiciansOpen | Healthcare Provider | 1,038 | 19 Jun 2025 | |||
| Meritus Medical Center, Inc. | Healthcare Provider | 1,029 | 26 Jun 2015 | |||
| Affiliates of Nexion Health, Inc. | Healthcare Provider | 1,027 | 12 Dec 2025 | |||
| Gary C. Spinks, DMD, PC | Healthcare Provider | 1,000 | 13 Dec 2010 | |||
| Calibre CPA Group | Business Associate | 912 | 27 Sep 2019 | |||
| Cardiology Associates | Healthcare Provider | 907 | 10 Aug 2016 | |||
| JM Pension Advisory Inc. | Business Associate | 897 | 22 Apr 2022 | |||
| Man Alive, Inc. and Lane Treatment Center, LLC | Healthcare Provider | 860 | 8 Sep 2016 | |||
| Euphemia R. Brumskine, MD, LLC | Healthcare Provider | 850 | 4 Oct 2019 | |||
| Zenith Administrators, Inc. | Business Associate | 800 | 29 Dec 2010 | |||
| Coventry Health Care, Inc. | Business Associate | 765 | 18 Mar 2011 | |||
| Frederick Memorial Hospital | Healthcare Provider | 760 | 18 Mar 2019 | |||
| Sheppard Pratt | Healthcare Provider | 753 | 9 Jan 2026 | |||
| National Imaging Associates, Inc. | Business Associate | 744 | 2 May 2022 | |||
| CHI Health Care, Inc. | Healthcare Provider | 722 | 30 Nov 2018 | |||
| Turning Point Clinic | Healthcare Provider | 700 | 3 Jun 2021 | |||
| Johns Hopkins University Applied Physics Laboratory (JHU/APL) Medical and Dental Insurance Plan | Health Plan | 692 | 6 Oct 2010 | |||
| T. Rowe Price Group, Inc. | Health Plan | 684 | 2 Jun 2023 | |||
| The Affiliated Sante Group | Healthcare Provider | 679 | 24 Oct 2019 | |||
| StatCare Group LLC | Healthcare Provider | 679 | 20 Jul 2018 | |||
| MedStar Health, Inc. | Healthcare Provider | 668 | 25 Sep 2020 | |||
| The Union Labor Life Insurance Company | Business Associate | 664 | 19 Oct 2017 | |||
| Catalyst Health Solutions, Inc. | Business Associate | 632 | 28 Feb 2012 | |||
| Kaiser Foundation Health Plan of the Mid-Atlantic States, Inc. | Health Plan | 630 | 29 Jan 2015 | |||
| Mindoula Health, Inc. | Business Associate | 626 | 2 Feb 2026 | |||
| Indian Health Service -Rosebud | Healthcare Provider | 620 | 15 Jul 2014 | |||
| IHS | Health Plan | 620 | 19 Jun 2014 | |||
| National Imaging Associates, Inc. | Business Associate | 616 | 22 Apr 2022 | |||
| Complete Wellness | Healthcare Provider | 600 | 6 Jan 2017 | |||
| Advarra, Inc. | Business Associate | 596 | 19 Apr 2024 | |||
| National Imaging Associates | Business Associate | 589 | 17 Sep 2019 | |||
| Easter Seals DC | MD | VA, Inc. | Healthcare Provider | 584 | 4 Oct 2024 | |||
| The Johns Hopkins Hospital | Healthcare Provider | 571 | 9 Oct 2015 | |||
| Moveable Feast, Inc. | Healthcare Provider | 568 | 16 Apr 2024 | |||
| The Affiliated Sante Group | Healthcare Provider | 550 | 31 Jan 2017 | |||
| Maryland Health Enterprises DBA Lorien Health Services | Healthcare Provider | 537 | 17 Jul 2020 | |||
| Penn-Mar Human Services | Healthcare Provider | 536 | 25 Nov 2019 | |||
| The Tree House Child Advocacy Center of Montgomery County | Business Associate | 514 | 23 Nov 2020 | |||
| Healthcare InteractiveOpen | Business Associate | 501 | 22 Sep 2025 | |||
| Pennsylvanie Dermatology PartnersOpen | Healthcare Provider | 500 | 30 Jul 2026 | |||
| Anne Arundel County Department of HealthOpen | Healthcare Provider | 500 | 15 May 2025 | |||
| Arthritis and Rheumatism Associates, P.C. | Healthcare Provider | 500 | 1 Mar 2019 | |||
| Keystone Pharmacy, Inc. | Healthcare Provider | 500 | 9 Jun 2015 |
Index / Other states
Every state on the register
98
32
164
92
776
139
144
31
33
463
226
22
29
358
200
98
80
124
66
37
241
238
189
55
164
36
60
55
38
174
57
511
207
19
276
80
120
339
32
41
86
15
196
633
68
15
157
185
47
126
19
Index / Companion schedules
13 HHS breach register
→Hub: every filing, by state, year and entity.
04 Biggest breaches
→Mega-breaches with primary-source cost figures.
Industry / Healthcare
→IBM 2026: $6.64M average, 13 years at #1.
Regulation / HIPAA penalties
→OCR enforcement tiers and the 60-day rule.
11 50-state laws
→Deadline, AG threshold and penalties per state.
Cost / Per record
→Where the per-record model is reliable.
Provenance
Source: U.S. Department of Health and Human Services, Office for Civil Rights, Breach Portal (breaches affecting 500 or more individuals), retrieved 2026-08-28. Public domain. Individuals affected and dates as reported by the covered entity.
Portal: ocrportal.hhs.gov breach report. Statutory basis: HITECH Act section 13402(e)(4): the Secretary must post a list of breaches of unsecured protected health information affecting 500 or more individuals. Breaches affecting fewer than 500 individuals are reported to OCR annually and are not posted, so they are not on this register. Status wording follows the portal's two tabs ("Cases Currently Under Investigation" and "Archive") as of 28 August 2026; a filing moves to the archive when OCR closes the case. Modelled costs on this site are a method applied to the reported count, using IBM Cost of a Data Breach per-record figures, and are never a cost disclosed by the entity.
Corrections: if you represent a listed entity and the portal row has been amended, email [email protected] with the portal entry and we will re-pull the export.