State File MA / HHS OCR Breach Register241 filings, 2010 to 2026Retrieved 28 August 2026

Geography

Massachusetts: 241 healthcare breach filings.

Massachusetts entities have reported 241 breaches of 500 or more individuals to HHS since 2010, the 8th most of the 52 states and territories on the register, covering 28,039,959 individuals (12th by people affected). 24 are still under investigation. Hacking/IT Incident is the breach type on 63% of them, and network server the most common location (51%).

Filings

241

8th of 52 states and territories

Individuals affected

28,039,959

Median filing 3,900

Largest filing

15,000,000

DentaQuest, LLC, 2026

Hacking / IT share

63%

90 filings involve a business associate

Direct answer / Massachusetts on the HHS portal

The largest Massachusetts filing is DentaQuest, LLC (15,000,000 individuals, submitted 16 July 2026). The busiest year was 2023 with 39 filings. Healthcare Providers account for 68% of the state's filings. 82 filings of 10,000 or more individuals have their own page; the remaining 159 are listed in the table at the foot of this page.

Section MA.1 / Largest filings

Ten largest Massachusetts breaches

#	Covered entity	Type	Individuals	Submitted	Breach type	Location	BA
1	DentaQuest, LLCOpen	Health Plan	15,000,000	16 Jul 2026	Hacking/IT Incident	Network Server	No
2	Harvard Pilgrim Health Care	Health Plan	2,662,337	24 May 2023	Hacking/IT Incident	Network Server	No
3	Shields Health Care Group, Inc.	Business Associate	2,380,483	27 May 2022	Hacking/IT Incident	Network Server	Yes
4	Nuance Communications, Inc.	Business Associate	1,225,054	15 Sep 2023	Hacking/IT Incident	Network Server	Yes
5	ZOLL Services LLC	Healthcare Provider	997,097	10 Mar 2023	Hacking/IT Incident	Network Server	No
6	Transformative Healthcare, on behalf of Fallon Ambulance Services	Healthcare Provider	911,757	31 Dec 2023	Hacking/IT Incident	Electronic Medical Record, Network Server	No
7	Onsite Mammography	Business Associate	357,265	21 Apr 2025	Hacking/IT Incident	Email	Yes
8	Lifespan Physician Group of Massachusetts, Inc. d/b/a Brown Health Medical Group-MAOpen	Healthcare Provider	311,760	16 Jul 2026	Hacking/IT Incident	Network Server	No
9	Anna Jaques Hospital a member of Beth Israel Health Incorporated	Healthcare Provider	308,829	20 Feb 2024	Hacking/IT Incident	Network Server	No
10	ReproSource Fertility Diagnostics, Inc.	Healthcare Provider	253,774	8 Oct 2021	Hacking/IT Incident	Network Server	No

Section MA.2 / By year

Massachusetts filings by submission year

Each year links to the national year page.

Year	Filings	Individuals affected	Hacking / IT share	Filings with a page
2010	6	52,795	0%	3
2011	8	24,701	13%	1
2012	5	17,848	20%	0
2013	8	33,752	63%	0
2014	6	38,076	0%	2
2015	7	36,937	14%	2
2016	6	26,499	50%	1
2017	8	33,318	38%	1
2018	18	164,177	22%	5
2019	10	263,029	70%	3
2020	19	793,090	84%	10
2021	19	628,436	63%	5
2022	16	2,991,067	94%	11
2023	39	6,270,884	92%	16
2024	31	742,020	68%	11
2025	20	542,547	70%	7
2026	15	15,380,783	80%	4

Section MA.3 / Composition

Breach type, location and who filed

Multi-valued fields count once per value.

Type of breach

Hacking/IT Incident151 (63%)

Unauthorized Access/Disclosure52 (22%)

Theft21 (9%)

Loss14 (6%)

Improper Disposal4 (2%)

Location of breached information

Network Server123 (51%)

Email48 (20%)

Paper/Films25 (10%)

Other Portable Electronic Device17 (7%)

Electronic Medical Record14 (6%)

Other12 (5%)

Laptop10 (4%)

Desktop Computer6 (2%)

Covered entity type

Healthcare Provider165 (68%)

Business Associate58 (24%)

Health Plan17 (7%)

not given1 (0%)

Section MA.4 / Notification law

What Massachusetts law required alongside HIPAA

State notification statute

Massachusetts: Mass. Gen. Laws ch. 93H

paired with 201 CMR 17.00 data-security regulations

Notice to individuals: As soon as practicable and without unreasonable delay
Attorney general threshold: All breaches (AG and Office of Consumer Affairs and Business Regulation) (As soon as practicable and without unreasonable delay)
Private right of action: Yes: Chapter 93A claims, subject to a 30-day pre-suit demand letter requirement
Penalty: Up to $5,000 per violation; treble damages for willful violations, plus attorney fees

The HIPAA Breach Notification Rule runs alongside the state statute: notice to affected individuals and to HHS without unreasonable delay and no later than 60 days after discovery.

Massachusetts notification law in full HIPAA breach penalties

Section MA.5 / Filing pages

82 filings of 10,000 or more individuals

Each links to a page with the full filing, its rank in the state and year, OCR's closing summary where the case is archived, peers, and the modelled cost.

Covered entity	Type	Individuals	Submitted	Breach type	Location	BA
DentaQuest, LLCOpen	Health Plan	15,000,000	16 Jul 2026	Hacking/IT Incident	Network Server	No
Harvard Pilgrim Health Care	Health Plan	2,662,337	24 May 2023	Hacking/IT Incident	Network Server	No
Shields Health Care Group, Inc.	Business Associate	2,380,483	27 May 2022	Hacking/IT Incident	Network Server	Yes
Nuance Communications, Inc.	Business Associate	1,225,054	15 Sep 2023	Hacking/IT Incident	Network Server	Yes
ZOLL Services LLC	Healthcare Provider	997,097	10 Mar 2023	Hacking/IT Incident	Network Server	No
Transformative Healthcare, on behalf of Fallon Ambulance Services	Healthcare Provider	911,757	31 Dec 2023	Hacking/IT Incident	Electronic Medical Record, Network Server	No
Onsite Mammography	Business Associate	357,265	21 Apr 2025	Hacking/IT Incident	Email	Yes
Lifespan Physician Group of Massachusetts, Inc. d/b/a Brown Health Medical Group-MAOpen	Healthcare Provider	311,760	16 Jul 2026	Hacking/IT Incident	Network Server	No
Anna Jaques Hospital a member of Beth Israel Health Incorporated	Healthcare Provider	308,829	20 Feb 2024	Hacking/IT Incident	Network Server	No
ReproSource Fertility Diagnostics, Inc.	Healthcare Provider	253,774	8 Oct 2021	Hacking/IT Incident	Network Server	No
UMass Memorial Health Care, Inc.	Business Associate	209,048	15 Oct 2021	Hacking/IT Incident	Email	Yes
Doctors Management Services, Inc.	Business Associate	206,695	22 Apr 2019	Hacking/IT Incident	Network Server	Yes
Lawrence General Hospital	Healthcare Provider	176,587	5 Nov 2020	Hacking/IT Incident	Network Server	No
The University of Massachusetts Chan Medical School	Business Associate	135,394	21 Aug 2023	Hacking/IT Incident	Network Server	Yes
Medical Healthcare Solutions, Inc.	Business Associate	133,997	22 Jan 2022	Hacking/IT Incident	Network Server	Yes
Behavioral Health Network, Inc.	Healthcare Provider	129,571	27 Jul 2020	Hacking/IT Incident	Network Server	No
Brockton Neighborhood Health Center	Healthcare Provider	97,488	13 Dec 2024	Hacking/IT Incident	Network Server	No
UMass Memorial Medical Center	Healthcare Provider	87,404	14 Sep 2020	Hacking/IT Incident	Network Server	Yes
Mystic Valley Elder Services, CE	Business Associate	85,133	28 Oct 2024	Hacking/IT Incident	Network Server	No
NCP Healthcare Management Company	Business Associate	78,070	17 Jul 2020	Hacking/IT Incident	Email	Yes
Lawrence General Hospital	Healthcare Provider	76,571	23 Feb 2023	Hacking/IT Incident	Network Server	Yes
South Shore Hospital	Healthcare Provider	74,328	23 Sep 2020	Hacking/IT Incident	Network Server	Yes
Brockton Hospital, Inc. d/b/a Signature Healthcare Brockton Hospital	Healthcare Provider	73,022	3 Jan 2022	Hacking/IT Incident	Email	No
Lifeline Systems Company	Healthcare Provider	72,848	16 Oct 2022	Hacking/IT Incident	Network Server	No
Joslin Diabetes Center	Healthcare Provider	71,160	14 Sep 2020	Hacking/IT Incident	Network Server	Yes
Tufts Associated Health Maintenance Organization, Inc.	Health Plan	70,320	16 Feb 2018	Unauthorized Access/Disclosure	Paper/Films	Yes
Advocates, Inc.	Healthcare Provider	70,031	21 Jan 2022	Hacking/IT Incident	Network Server	No
Comstar, LLC	Business Associate	68,957	26 May 2022	Hacking/IT Incident	Network Server	Yes
North Atlantic States Carpenters Health Benefits FundOpen	Health Plan	68,111	17 Oct 2025	Hacking/IT Incident	Network Server	No
Pediatrics West, P.C.	Healthcare Provider	62,924	9 Dec 2022	Hacking/IT Incident	Network Server	No
Tufts Health Plan	Health Plan	60,545	25 Nov 2020	Hacking/IT Incident	Email	Yes
New England Dermatology and Laser Center, P.C.	Healthcare Provider	58,106	11 May 2021	Improper Disposal	Paper/Films	No
Sturdy Memorial Hospital	Healthcare Provider	57,379	28 May 2021	Hacking/IT Incident	Network Server	No
Stanley Street Treatment and Resources, Inc.	Healthcare Provider	45,785	11 Nov 2022	Hacking/IT Incident	Network Server	No
Community Counseling of Bristol County, Inc.Open	Healthcare Provider	44,991	19 Jul 2024	Hacking/IT Incident	Network Server	No
Medical Billing Specialists, Inc.	Business Associate	43,673	24 Apr 2024	Hacking/IT Incident	Network Server	Yes
Center for Sight, Inc.	Healthcare Provider	41,041	20 Jun 2022	Hacking/IT Incident	Electronic Medical Record	Yes
Tidewater Diagnostic Imaging, Ltd.	Healthcare Provider	40,195	26 Jun 2023	Hacking/IT Incident	Network Server	No
Shields Health Solutions	Business Associate	39,762	7 Feb 2020	Hacking/IT Incident	Email	Yes
Pioneer Valley Ophthalmic Consultants, PC	Healthcare Provider	36,275	26 May 2023	Hacking/IT Incident	Network Server	Yes
Elgon Information Systems	Business Associate	31,248	2 Jun 2023	Hacking/IT Incident	Network Server	Yes
Insulet Corporation	Healthcare Provider	29,000	5 Jan 2023	Unauthorized Access/Disclosure	Network Server	No
Hebrew SeniorLife, Inc.	Healthcare Provider	27,244	11 Sep 2020	Hacking/IT Incident	Network Server	Yes
High Point Treatment Center, Inc.Open	Healthcare Provider	25,832	30 Jan 2026	Hacking/IT Incident	Electronic Medical Record, Network Server	No
Pioneer Valley Pathology	Business Associate	24,750	25 Aug 2010	Theft	Paper/Films	Yes
Justice Resource Institute	Healthcare Provider	23,118	26 Apr 2024	Hacking/IT Incident	Network Server	No
Wellfleet Group, LLC	Business Associate	23,082	8 Oct 2024	Unauthorized Access/Disclosure	Network Server	Yes
Brockton Area Multi Services, Inc.	Healthcare Provider	21,537	16 May 2024	Hacking/IT Incident	Network Server	No
Reliable Respiratory	Healthcare Provider	21,311	1 Sep 2018	Hacking/IT Incident	Email	No
Bay Cove Human Services, Inc.	Healthcare Provider	21,295	3 Mar 2025	Hacking/IT Incident	Network Server	No
Orthopaedic Specialists of Massachusetts, PCOpen	Healthcare Provider	20,659	26 Feb 2026	Hacking/IT Incident	Network Server	No
Gandara Mental Health CenterOpen	Healthcare Provider	20,024	24 Oct 2024	Hacking/IT Incident	Network Server	No
D'Youville Life and Wellness Community, Inc.	Healthcare Provider	19,691	14 Dec 2023	Hacking/IT Incident	Network Server	No
Teamsters Union 25 Health Services & Insurance PlanOpen	Health Plan	19,231	3 Sep 2025	Hacking/IT Incident	Network Server	No
Sovos Compliance LLC	Business Associate	18,261	8 Aug 2023	Hacking/IT Incident	Network Server	Yes
Aspire Health Alliance	Healthcare Provider	17,490	26 Apr 2024	Hacking/IT Incident	Network Server	No
Harbor Health Services, Inc.	Healthcare Provider	17,380	9 Aug 2019	Hacking/IT Incident	Email	No
Steward Medical Group	Healthcare Provider	16,276	28 Nov 2018	Hacking/IT Incident	Network Server	Yes
New England Dermatology, P.C.	Healthcare Provider	16,154	13 Jul 2018	Improper Disposal	Paper/Films	No
Center for Human Development	Healthcare Provider	15,665	25 May 2021	Hacking/IT Incident	Network Server	No
Sensata Technologies, Inc. Health and Welfare Benefit Plan	Health Plan	15,630	5 Jun 2025	Hacking/IT Incident	Network Server	No
2020 On-Site Optometry	Business Associate	15,400	13 Feb 2017	Hacking/IT Incident	Network Server	Yes
Boston Medical Center	not given	15,265	29 Apr 2014	Unauthorized Access/Disclosure	Network Server	Yes
Spectrum Health Ssytems, Inc.	Healthcare Provider	14,750	20 Oct 2011	Theft	Desktop Computer	No
Ethos, also known as Southwest Boston Senior Services	Business Associate	14,503	22 Mar 2024	Hacking/IT Incident	Network Server	Yes
UMass Memorial Medical Group, Inc.	Healthcare Provider	14,100	30 Jan 2015	Unauthorized Access/Disclosure	Paper/Films	No
Baystate Health, Inc.	Healthcare Provider	13,112	21 Oct 2016	Hacking/IT Incident	Email	No
The McLean Hospital Corporation	Healthcare Provider	12,673	28 Jul 2015	Loss	Other Portable Electronic Device	No
Mental Health Association Inc.Open	Healthcare Provider	12,633	31 Jan 2025	Unauthorized Access/Disclosure	Network Server	No
North Shore Pain Management	Healthcare Provider	12,472	18 Jun 2020	Hacking/IT Incident	Network Server	No
New Horizons Medical, Inc	Healthcare Provider	12,317	16 Jun 2023	Hacking/IT Incident	Network Server	No
MedMinder Systems, Inc.	Healthcare Provider	12,146	1 Sep 2023	Hacking/IT Incident	Network Server	No
Next Step Healthcare LLCOpen	Healthcare Provider	12,090	30 May 2025	Hacking/IT Incident	Network Server	No
Baystate Health	Healthcare Provider	11,658	5 Apr 2019	Hacking/IT Incident	Email	No
Minuteman Senior Services	Healthcare Provider	11,330	29 Jul 2022	Hacking/IT Incident	Email	No
Joseph A. Gagnon d/b/a Goldthwait Associates	Business Associate	11,000	1 Oct 2010	Improper Disposal	Paper/Films	Yes
Behavioral Health Partners of Metrowest, LLC.	Business Associate	10,920	12 May 2022	Hacking/IT Incident	Network Server	Yes
DentaQuest	Business Associate	10,515	9 Jun 2010	Theft	Laptop	Yes
Codman Square Health Center	Healthcare Provider	10,161	1 Mar 2023	Hacking/IT Incident	Network Server	No
DotHouse Health Incorporated	Healthcare Provider	10,000	27 Jan 2023	Hacking/IT Incident	Network Server	No
Longwood Orthopedic Associates, Inc.	Healthcare Provider	10,000	27 Jul 2018	Unauthorized Access/Disclosure	Email	No
Iron Mountain Incorporated	Business Associate	10,000	15 Aug 2014	Loss, Theft	Paper/Films	Yes

Section MA.6 / All other filings

159 filings below 10,000 individuals

Listed in full from the HHS export, largest first. These filings do not have their own page.

Covered entity	Type	Individuals	Submitted	Breach type	Location	BA
Massachusetts General Hospital	Healthcare Provider	9,900	22 Aug 2019	Hacking/IT Incident	Network Server	No
Charles River Medical Associates, pc	Healthcare Provider	9,387	8 Jan 2018	Loss	Other Portable Electronic Device	No
Insulet Corporation	Healthcare Provider	9,050	19 Mar 2021	Hacking/IT Incident	Network Server	Yes
ZOLL Medical Corporation	Health Plan	8,898	18 Dec 2023	Hacking/IT Incident	Email	No
Picis Clinical Solutions, Inc. d/b/a MedstreamingOpen	Business Associate	8,840	11 Jul 2025	Hacking/IT Incident	Network Server	Yes
Tufts Associated Health Maintenance Organization, Inc. and Tufts Insurance Company	Health Plan	8,830	24 Apr 2014	Theft	Other	No
Sports Medicine & Rehabilitation Therapy, Inc.	Healthcare Provider	8,800	14 Nov 2017	Hacking/IT Incident	Network Server	No
HealthCare for Women, Inc.	Healthcare Provider	8,727	20 Mar 2013	Hacking/IT Incident	Network Server	No
The North Cottage Program	Healthcare Provider	8,190	15 Jul 2024	Hacking/IT Incident	Network Server	No
Harvard Pilgrim Health Care, Inc.	Business Associate	8,027	20 Nov 2020	Unauthorized Access/Disclosure	Paper/Films	Yes
Covenant HealthOpen	Business Associate	7,864	11 Jul 2025	Hacking/IT Incident	Network Server	Yes
New England Baptist Health	Healthcare Provider	7,582	8 Jun 2018	Unauthorized Access/Disclosure	Email	No
Clearpoint Design, Inc.	Business Associate	7,250	10 Jan 2013	Hacking/IT Incident	Network Server	Yes
Riverside Community Care, Inc.	Healthcare Provider	6,978	23 Dec 2020	Hacking/IT Incident	Network Server	No
St. Elizabeth's Medical Center	Healthcare Provider	6,831	6 Apr 2012	Loss	Paper/Films	No
Community Nurse	Healthcare Provider	6,746	12 Mar 2026	Hacking/IT Incident	Network Server	Yes
Beacon Health Options, Inc.	Business Associate	6,723	10 Apr 2020	Loss	Other Portable Electronic Device	Yes
Goold Health System (Goold)	Business Associate	6,332	6 Mar 2013	Loss	Other Portable Electronic Device	Yes
Emerson Hospital	Healthcare Provider	6,314	8 Mar 2019	Unauthorized Access/Disclosure	Other	Yes
The Brien Center for Mental Health and Substance Abuse Services	Healthcare Provider	5,427	18 Jul 2025	Hacking/IT Incident	Network Server	No
The Home for the Little Wanderers	Healthcare Provider	5,396	26 Feb 2021	Unauthorized Access/Disclosure	Email	No
Mountain View Family Practice, PC	Healthcare Provider	5,139	31 Aug 2023	Hacking/IT Incident	Electronic Medical Record, Network Server	No
Sherrill House, Inc.	Healthcare Provider	5,006	3 Jan 2022	Hacking/IT Incident	Email	No
Nuance Communications, Inc.	Business Associate	4,830	18 Nov 2022	Unauthorized Access/Disclosure	Electronic Medical Record	Yes
Greater Boston Urology	Healthcare Provider	4,717	28 Feb 2026	Hacking/IT Incident	Email	Yes
Community Healthlink	Healthcare Provider	4,598	17 Jun 2019	Hacking/IT Incident	Email	No
Alvaria, Inc.	Business Associate	4,456	26 May 2023	Hacking/IT Incident	Network Server	Yes
Harrington Physician Services	Healthcare Provider	4,393	8 Apr 2021	Unauthorized Access/Disclosure	Network Server	No
Clearpoint Design, Inc.	Business Associate	4,343	28 Dec 2012	Hacking/IT Incident	Network Server	Yes
Massachusetts General Hospital	Healthcare Provider	4,293	29 Jun 2016	Hacking/IT Incident	Network Server	Yes
Zelis Healthcare LLCOpen	Business Associate	4,289	12 Aug 2025	Unauthorized Access/Disclosure	Paper/Films	Yes
Lynn Community Health Center	Healthcare Provider	4,271	13 Sep 2020	Hacking/IT Incident	Email	No
UMass Memorial Health Care	Business Associate	4,270	28 Feb 2022	Hacking/IT Incident	Email	Yes
Clearpoint Design, Inc.	Business Associate	4,125	7 Jan 2013	Hacking/IT Incident	Network Server	Yes
Clearpoint Design, Inc.	Business Associate	4,100	10 Jan 2013	Hacking/IT Incident	Network Server	Yes
L. Knife & Son, Inc. Employee Benefits Plan	Health Plan	4,082	30 Dec 2022	Hacking/IT Incident	Network Server	No
Mattapan Community Health Center	Healthcare Provider	4,073	31 Dec 2020	Hacking/IT Incident	Email	No
BHI Energy Health and Welfare Benefits Plan	Health Plan	4,049	18 Oct 2023	Hacking/IT Incident	Network Server	No
Beth Israel Deaconess Medical Center	Healthcare Provider	3,900	20 Jul 2012	Theft	Laptop	No
Codman Square Health Center	Healthcare Provider	3,840	12 Sep 2016	Unauthorized Access/Disclosure	Desktop Computer	No
Massachusetts Department of Developmental Services	Healthcare Provider	3,800	8 Nov 2024	Hacking/IT Incident	Email	No
Nova Biomedical Corporation	Health Plan	3,774	17 Aug 2021	Hacking/IT Incident	Network Server	No
Mass General Brigham Health Plan	Health Plan	3,659	28 Jun 2024	Unauthorized Access/Disclosure	Other	No
Massachusetts Eye and Ear Infirmary	Healthcare Provider	3,594	20 Apr 2010	Theft	Laptop	No
Minuteman Senior Services	Healthcare Provider	3,381	27 Jan 2023	Hacking/IT Incident	Email	No
Partners HealthCare System, Inc.	Healthcare Provider	3,321	1 May 2015	Hacking/IT Incident	Network Server	No
DentaQuest	Business Associate	3,086	22 May 2026	Unauthorized Access/Disclosure	Network Server	Yes
Foundation Medicine, Inc.	Healthcare Provider	2,999	13 Mar 2020	Hacking/IT Incident	Email	No
Sleep HealthCenters LLC	Healthcare Provider	2,988	28 Dec 2011	Theft	Laptop	No
Looking Glass Counseling	Healthcare Provider	2,739	10 Jun 2024	Unauthorized Access/Disclosure	Network Server	No
Judge Baker Children's Center dba The Baker Center for Children and Families	Healthcare Provider	2,715	27 Dec 2024	Hacking/IT Incident	Network Server	No
Standard Modern Company, Inc.	Business Associate	2,707	20 Jul 2021	Unauthorized Access/Disclosure	Paper/Films	Yes
TELUS Health (US) LTD.Open	Healthcare Provider	2,641	14 Jul 2026	Unauthorized Access/Disclosure	Network Server	No
Worcester Eye Consultants	Healthcare Provider	2,634	7 Jun 2019	Loss	Other	Yes
May Institute	Healthcare Provider	2,612	12 Feb 2024	Hacking/IT Incident	Network Server	No
Judge Rotenberg Educational Center	Healthcare Provider	2,579	3 Oct 2024	Hacking/IT Incident	Network Server	No
Newton Centre Dental	Healthcare Provider	2,547	12 Mar 2024	Hacking/IT Incident	Email	No
Northgate Medical PC	Business Associate	2,500	24 Mar 2016	Unauthorized Access/Disclosure	Email	Yes
Life Care Center of Attleboro	Healthcare Provider	2,473	20 Mar 2015	Loss	Paper/Films	Yes
Partners HealthCare System, Inc.	Healthcare Provider	2,450	5 Feb 2018	Hacking/IT Incident	Desktop Computer, Network Server	No
Mystic Valley Elder Services - Business AssociateOpen	Business Associate	2,402	22 Oct 2024	Hacking/IT Incident	Network Server	Yes
UMass Memorial Medical Center	Healthcare Provider	2,387	5 May 2014	Unauthorized Access/Disclosure	Electronic Medical Record, Paper/Films	No
Square Medical Group, LLC	Healthcare Provider	2,363	15 Jan 2025	Unauthorized Access/Disclosure	Email	Yes
Stavros Center for Independent Living Inc.	Healthcare Provider	2,347	18 Mar 2021	Unauthorized Access/Disclosure	Other	No
Cambridge Health Alliance	Healthcare Provider	2,280	28 Mar 2018	Hacking/IT Incident	Other	No
McLean Hospital	Healthcare Provider	2,231	21 May 2024	Unauthorized Access/Disclosure	Email	No
Adult & Pediatric Dermatology, PC	Healthcare Provider	2,200	7 Oct 2011	Theft	Other, Other Portable Electronic Device	No
Children's Hospital Boston	Healthcare Provider	2,159	22 May 2012	Theft	Laptop	No
Alere Toxicology	Healthcare Provider	2,146	28 Nov 2017	Unauthorized Access/Disclosure	Paper/Films	No
RSC Insurance Brokerage, Inc.	Business Associate	2,088	1 Mar 2019	Theft	Laptop	Yes
Lawrence General Hospital	Healthcare Provider	2,071	5 Aug 2015	Loss	Other Portable Electronic Device	No
Beth Israel Deaconess Medical Center	Healthcare Provider	2,021	19 Jul 2011	Hacking/IT Incident	Network Server	No
athenahealth, Inc.	Business Associate	1,974	15 Nov 2024	Unauthorized Access/Disclosure	Network Server	Yes
CareMeridian, LLC	Healthcare Provider	1,922	21 Mar 2018	Loss	Other Portable Electronic Device	Yes
Daniel J. Sigman MD PC	Business Associate	1,860	7 Jan 2010	Theft	Electronic Medical Record, Other, Other Portable Electronic Device	Yes
Blue Cross Blue Shield of Massachusetts	Health Plan	1,843	26 Dec 2017	Unauthorized Access/Disclosure	Email	No
Lynn Community Health, Incorporated	Healthcare Provider	1,800	22 Jan 2021	Hacking/IT Incident	Email	No
Berkshire Medical Center	Healthcare Provider	1,745	23 Nov 2016	Unauthorized Access/Disclosure	Email, Other Portable Electronic Device	Yes
John Hancock Life Insurance Company (U.S.A.)	Health Plan	1,715	6 Oct 2017	Hacking/IT Incident	Network Server	No
UMASSAmherst	Healthcare Provider	1,670	5 Jun 2013	Hacking/IT Incident	Desktop Computer	No
Prima CARE, PC	Healthcare Provider	1,651	29 Jul 2015	Unauthorized Access/Disclosure	Paper/Films	No
Andover Eye AssociatesOpen	Healthcare Provider	1,638	31 Dec 2025	Hacking/IT Incident	Email	No
Vitra Health, Inc.	Healthcare Provider	1,618	6 Feb 2023	Hacking/IT Incident	Email	No
Anderson & Kreiger LLP	Business Associate	1,607	8 Aug 2025	Hacking/IT Incident	Network Server	Yes
Trinity Home Care, Inc.	Healthcare Provider	1,541	14 Mar 2022	Hacking/IT Incident	Network Server	No
Access Information Management Shared Services, LLCOpen	Business Associate	1,522	28 Feb 2026	Hacking/IT Incident	Other	Yes
Alvaria, Inc.	Business Associate	1,518	26 May 2023	Hacking/IT Incident	Network Server	Yes
Insulet Corporation	Healthcare Provider	1,469	17 Oct 2017	Unauthorized Access/Disclosure	Network Server	Yes
Mount Carmel Care Center	Healthcare Provider	1,430	14 Dec 2023	Hacking/IT Incident	Network Server	No
Pristine Dental	Healthcare Provider	1,428	5 Nov 2020	Hacking/IT Incident	Network Server	No
Berkshire Health Systems, Inc.	Healthcare Provider	1,421	30 Jul 2025	Unauthorized Access/Disclosure	Electronic Medical Record	No
Alvaria, Inc.	Business Associate	1,389	26 May 2023	Hacking/IT Incident	Network Server	Yes
Blue Cross Blue Shield of Massachusetts	Health Plan	1,262	15 Feb 2019	Hacking/IT Incident	Email	Yes
Alvaria, Inc.	Business Associate	1,191	26 May 2023	Hacking/IT Incident	Network Server	Yes
Center for Comprehensive Services, Inc.	Healthcare Provider	1,176	21 Mar 2018	Loss	Other Portable Electronic Device	Yes
Massachusetts Department of Public Health - Tewksbury Hospital	Healthcare Provider	1,176	21 Jul 2017	Unauthorized Access/Disclosure	Electronic Medical Record	No
Alvaria, Inc.	Business Associate	1,147	26 May 2023	Hacking/IT Incident	Network Server	Yes
Alvaria, Inc.	Business Associate	1,097	26 May 2023	Hacking/IT Incident	Network Server	Yes
North Hill Needham, Inc., North Hill Home Health Care, Inc. and North Hill Employee Dental Plan	Healthcare Provider	1,096	14 Feb 2024	Hacking/IT Incident	Network Server	No
Massachusetts Eye and Ear Infirmary	Healthcare Provider	1,076	8 Jan 2010	Theft	Other	No
National Mentor Healthcare, LLC.	Healthcare Provider	1,015	21 Mar 2018	Loss	Other Portable Electronic Device	Yes
Brigham and Women's Hospital	Healthcare Provider	1,009	11 Jan 2016	Hacking/IT Incident	Email	No
Sturdy Health, Inc.Open	Healthcare Provider	1,006	5 Jun 2026	Hacking/IT Incident	Email	No
Brigham and Women's Hospital	Healthcare Provider	999	17 Nov 2014	Theft	Laptop, Other Portable Electronic Device	No
Mentor ABI, LLC	Healthcare Provider	994	21 Mar 2018	Loss	Other Portable Electronic Device	Yes
Brigham and Women's Hospital	Healthcare Provider	987	4 Aug 2023	Unauthorized Access/Disclosure	Network Server	No
Alvaria, Inc.	Business Associate	983	26 May 2023	Hacking/IT Incident	Network Server	Yes
Massachusetts Department of Mental Health	Healthcare Provider	959	16 Dec 2024	Loss	Other Portable Electronic Device	No
University Health Services, University of Massachusetts, Amherst	Healthcare Provider	942	7 Mar 2011	Unauthorized Access/Disclosure	Desktop Computer	No
Angels Neurological Centers, P.C.	Healthcare Provider	934	5 Jun 2024	Hacking/IT Incident	Electronic Medical Record	No
Alvaria, Inc.	Business Associate	916	26 May 2023	Hacking/IT Incident	Network Server	Yes
Harbor Health Services, Inc.	Healthcare Provider	901	9 Apr 2021	Hacking/IT Incident	Network Server	Yes
Brigham and Women's Hospital	Healthcare Provider	882	8 Dec 2020	Unauthorized Access/Disclosure	Email	No
New Bedford Jewish Convalescent Home, Inc.	Healthcare Provider	873	2 Mar 2021	Hacking/IT Incident	Email	No
Boston Health Care for the Homeless Program	Healthcare Provider	861	7 Sep 2018	Unauthorized Access/Disclosure	Paper/Films	No
Home for Little Wanderers	Healthcare Provider	861	3 Jul 2018	Unauthorized Access/Disclosure	Paper/Films	No
Walker, Inc. d/b/a Walker Therapeutic & Educational Programs	Healthcare Provider	846	18 Jan 2024	Hacking/IT Incident	Email	No
Insulet CorporationOpen	Healthcare Provider	841	16 May 2025	Unauthorized Access/Disclosure	Network Server	No
Jeff Spiegel	Healthcare Provider	832	23 Dec 2013	Unauthorized Access/Disclosure	Email	No
Alvaria, Inc.	Business Associate	803	26 May 2023	Hacking/IT Incident	Network Server	Yes
Alvaria, Inc.	Business Associate	796	26 May 2023	Hacking/IT Incident	Network Server	Yes
The Lowell General Hospital	Healthcare Provider	769	10 Nov 2017	Unauthorized Access/Disclosure	Electronic Medical Record	No
AllCare Plus Pharmacy, Inc.	Healthcare Provider	757	15 Mar 2023	Hacking/IT Incident	Email	No
Boston Medical Center	Healthcare Provider	723	24 Nov 2021	Unauthorized Access/Disclosure	Email	No
Kindred Transitional Care and Rehabilitation - Marl	Healthcare Provider	716	14 Feb 2013	Theft	Other Portable Electronic Device	No
Greater New Bedford Community Health Center	Healthcare Provider	696	12 Jan 2021	Hacking/IT Incident	Email	Yes
Vitra Home Care, LLC	Business Associate	658	22 Jun 2023	Hacking/IT Incident	Email	Yes
Serenity Care PACE	Healthcare Provider	658	16 Mar 2021	Unauthorized Access/Disclosure	Network Server, Other	Yes
Mass General Brigham Incorporated	Healthcare Provider	655	28 Jun 2024	Unauthorized Access/Disclosure	Electronic Medical Record, Other	No
Massachusetts General Hospital	Healthcare Provider	648	8 Jul 2015	Unauthorized Access/Disclosure	Email	No
Steward Medical Group	Healthcare Provider	640	4 Jun 2021	Hacking/IT Incident	Email	No
Brigham and Women's Hospital and Faulkner Hospital	Healthcare Provider	638	3 Aug 2011	Theft	Other Portable Electronic Device	No
Commonwealth Care Alliance	Health Plan	634	25 Feb 2026	Unauthorized Access/Disclosure	Paper/Films	No
Brigham and Women's Hospital	Healthcare Provider	615	26 Nov 2012	Theft	Desktop Computer	No
Guardian Home Health Care, LLC	Healthcare Provider	613	11 Mar 2026	Hacking/IT Incident	Electronic Medical Record, Network Server	Yes
Boston IVF, LLC	Healthcare Provider	604	30 May 2024	Unauthorized Access/Disclosure	Paper/Films	No
Fenway Community Health Center, Inc.	Healthcare Provider	599	29 Nov 2023	Unauthorized Access/Disclosure	Paper/Films	Yes
Lahey Clinic	Healthcare Provider	599	11 Oct 2011	Theft	Laptop	No
St. Elizabeth's Medical Center	Healthcare Provider	595	26 Aug 2014	Theft	Laptop, Other Portable Electronic Device	No
Massachusetts General Hospital	Healthcare Provider	588	14 Dec 2018	Unauthorized Access/Disclosure	Paper/Films	No
Village Pharmacy Group	Healthcare Provider	584	18 Nov 2024	Hacking/IT Incident	Email	No
Walpole Area Visiting Nurse Association, Inc.	Healthcare Provider	566	16 Mar 2026	Hacking/IT Incident	Network Server	Yes
Family Health Center of Worcester	Healthcare Provider	566	4 Dec 2020	Hacking/IT Incident	Network Server	No
Drs Edalji and Komer	Healthcare Provider	563	6 May 2011	Theft	Laptop	No
Alvaria, Inc.	Business Associate	537	26 May 2023	Hacking/IT Incident	Network Server	Yes
NeighborHealth	Healthcare Provider	526	26 Jul 2024	Unauthorized Access/Disclosure	Paper/Films	No
Alvaria, Inc.	Business Associate	524	26 May 2023	Hacking/IT Incident	Network Server	Yes
Alvaria, Inc.	Business Associate	507	26 May 2023	Hacking/IT Incident	Network Server	Yes
Boston Children's Hospital	Healthcare Provider	506	29 Apr 2021	Hacking/IT Incident	Email	No
Middlesex Sheriff's OfficeOpen	Healthcare Provider	501	20 Jan 2026	Hacking/IT Incident	Network Server	No
Baltimore Medical System, Inc.Open	Healthcare Provider	501	12 Dec 2025	Hacking/IT Incident	Network Server	No
Dermatology Associates of ConcordOpen	Healthcare Provider	501	18 Nov 2025	Hacking/IT Incident	Network Server	No
Signature Healthcare CorporationOpen	Healthcare Provider	500	5 Jun 2026	Hacking/IT Incident	Network Server	No
Heywood Healthcare Inc. including Henry Heywood Memorial Hospital, Athol Memorial Hospital, and Heywood Medical Group, Inc. ("Heywood")Open	Healthcare Provider	500	12 Dec 2025	Hacking/IT Incident	Network Server	No
West Suburban Eye Surgery Center LLC	Business Associate	500	11 Nov 2025	Unauthorized Access/Disclosure	Electronic Medical Record	Yes
Massachusetts Department of Developmental Services	Healthcare Provider	500	11 Mar 2024	Improper Disposal	Paper/Films	No
Rogerson House, Inc.	Healthcare Provider	500	12 Jul 2019	Hacking/IT Incident	Network Server	Yes
Leominster Dermatology LLP	Healthcare Provider	500	13 Sep 2018	Unauthorized Access/Disclosure	Paper/Films	No
Baystate Family Dental, Inc.	Healthcare Provider	500	4 May 2018	Theft	Paper/Films	No

Index / Companion schedules

13 HHS breach register

→

Hub: every filing, by state, year and entity.

04 Biggest breaches

→

Mega-breaches with primary-source cost figures.

Industry / Healthcare

→

IBM 2026: $6.64M average, 13 years at #1.

Regulation / HIPAA penalties

→

OCR enforcement tiers and the 60-day rule.

11 50-state laws

→

Deadline, AG threshold and penalties per state.

Cost / Per record

→

Where the per-record model is reliable.

Provenance

Source: U.S. Department of Health and Human Services, Office for Civil Rights, Breach Portal (breaches affecting 500 or more individuals), retrieved 2026-08-28. Public domain. Individuals affected and dates as reported by the covered entity.

Portal: ocrportal.hhs.gov breach report. Statutory basis: HITECH Act section 13402(e)(4): the Secretary must post a list of breaches of unsecured protected health information affecting 500 or more individuals. Breaches affecting fewer than 500 individuals are reported to OCR annually and are not posted, so they are not on this register. Status wording follows the portal's two tabs ("Cases Currently Under Investigation" and "Archive") as of 28 August 2026; a filing moves to the archive when OCR closes the case. Modelled costs on this site are a method applied to the reported count, using IBM Cost of a Data Breach per-record figures, and are never a cost disclosed by the entity.

Corrections: if you represent a listed entity and the portal row has been amended, email [email protected] with the portal entry and we will re-pull the export.