Geography
Mississippi: 55 healthcare breach filings.
Mississippi entities have reported 55 breaches of 500 or more individuals to HHS since 2010, the 36th most of the 52 states and territories on the register, covering 2,459,630 individuals (38th by people affected). 6 are still under investigation. Hacking/IT Incident is the breach type on 71% of them, and network server the most common location (55%).
Filings
55
36th of 52 states and territories
Individuals affected
2,459,630
Median filing 5,220
Largest filing
895,204
Singing River Health System and its wholly owned subsidiary, Singing River Gulfport, 2023
Hacking / IT share
71%
18 filings involve a business associate
Direct answer / Mississippi on the HHS portal
The largest Mississippi filing is Singing River Health System and its wholly owned subsidiary, Singing River Gulfport (895,204 individuals, submitted 18 October 2023). The busiest year was 2023 with 10 filings. Healthcare Providers account for 82% of the state's filings. 21 filings of 10,000 or more individuals have their own page; the remaining 34 are listed in the table at the foot of this page.
Section MS.1 / Largest filings
Ten largest Mississippi breaches
| # | Covered entity | Type | Individuals | Submitted | Breach type | Location | BA |
|---|---|---|---|---|---|---|---|
| 1 | Singing River Health System and its wholly owned subsidiary, Singing River Gulfport | Healthcare Provider | 895,204 | 18 Oct 2023 | |||
| 2 | Western Washington Medical Group | Healthcare Provider | 350,863 | 26 Oct 2023 | |||
| 3 | Bienville Orthopaedic Specialists LLC | Healthcare Provider | 242,986 | 5 Sep 2023 | |||
| 4 | Delta Health System | Healthcare Provider | 216,532 | 29 Mar 2024 | |||
| 5 | HORNE, LLP | Business Associate | 170,052 | 13 Jan 2024 | |||
| 6 | Coastal Family Health Center, Inc | Healthcare Provider | 65,890 | 2 Jul 2021 | |||
| 7 | Urgent Care Clinic of Oxford | Healthcare Provider | 64,000 | 30 Sep 2016 | |||
| 8 | Singing River Health SystemOpen | Healthcare Provider | 53,888 | 19 May 2026 | |||
| 9 | OCH Regional Medical Center, MS | Healthcare Provider | 51,266 | 11 Mar 2025 | |||
| 10 | Mississippi State Department of Health | Healthcare Provider | 30,799 | 26 Mar 2018 |
Section MS.2 / By year
Mississippi filings by submission year
Each year links to the national year page.
| Year | Filings | Individuals affected | Hacking / IT share | Filings with a page |
|---|---|---|---|---|
| 2010 | 1 | 1,104 | 0% | 0 |
| 2011 | 1 | 1,797 | 0% | 0 |
| 2013 | 1 | 500 | 0% | 0 |
| 2014 | 3 | 6,728 | 67% | 0 |
| 2015 | 2 | 19,846 | 0% | 1 |
| 2016 | 3 | 76,401 | 67% | 2 |
| 2017 | 2 | 12,712 | 50% | 0 |
| 2018 | 3 | 33,981 | 33% | 1 |
| 2019 | 3 | 52,642 | 33% | 2 |
| 2020 | 1 | 759 | 0% | 0 |
| 2021 | 8 | 100,574 | 100% | 2 |
| 2022 | 3 | 23,118 | 67% | 1 |
| 2023 | 10 | 1,547,012 | 90% | 6 |
| 2024 | 5 | 424,550 | 100% | 3 |
| 2025 | 6 | 67,370 | 83% | 1 |
| 2026 | 3 | 90,536 | 100% | 2 |
Section MS.3 / Composition
Breach type, location and who filed
Multi-valued fields count once per value.
Type of breach
Location of breached information
Covered entity type
Section MS.4 / Notification law
What Mississippi law required alongside HIPAA
State notification statute
Mississippi: Miss. Code Ann. 75-24-29
- Notice to individuals
- Without unreasonable delay
- Attorney general threshold
- No AG notification requirement at any threshold
- Private right of action
- No: Statute expressly creates no private right of action
- Penalty
- Unfair trade practice; up to $10,000 per willful violation under the Consumer Protection Act
The HIPAA Breach Notification Rule runs alongside the state statute: notice to affected individuals and to HHS without unreasonable delay and no later than 60 days after discovery.
Section MS.5 / Filing pages
21 filings of 10,000 or more individuals
Each links to a page with the full filing, its rank in the state and year, OCR's closing summary where the case is archived, peers, and the modelled cost.
Section MS.6 / All other filings
34 filings below 10,000 individuals
Listed in full from the HHS export, largest first. These filings do not have their own page.
| Covered entity | Type | Individuals | Submitted | Breach type | Location | BA |
|---|---|---|---|---|---|---|
| Mississippi Center for Advanced Medicine, PC | Healthcare Provider | 8,908 | 23 Jun 2021 | |||
| TRACT Radiology | Business Associate | 7,810 | 14 Aug 2023 | |||
| University of Mississippi Medical Center | Healthcare Provider | 7,492 | 7 Jul 2017 | |||
| Southern Bone & Joint Specialists, PA ("Southern Bone")Open | Healthcare Provider | 7,162 | 17 Sep 2024 | |||
| Joseph J Chappell, Jr., MD, PA dba Tupelo Eye ClinicOpen | Healthcare Provider | 6,245 | 10 Apr 2026 | |||
| Madison County, MSOpen | Health Plan | 6,082 | 5 Mar 2025 | |||
| Mississippi Division of Medicaid | Health Plan | 5,220 | 26 May 2017 | |||
| Greater Meridian Health Clinic, Inc.Open | Healthcare Provider | 4,651 | 24 Nov 2025 | |||
| Greenwood Leflore Hospital | Healthcare Provider | 3,750 | 16 Apr 2014 | |||
| Singing River Health System | Healthcare Provider | 3,543 | 17 Jun 2021 | |||
| Harborview Oral & Facial Surgery Center | Healthcare Provider | 3,472 | 8 Aug 2024 | |||
| The Cancer Center of Greenwood Leflore Hospital | Healthcare Provider | 2,714 | 19 Jul 2021 | |||
| Olive Branch Emergency Physicians, LLC | Healthcare Provider | 2,514 | 16 Sep 2025 | |||
| Gary Smith and assoc inc DBA gary smith agency | Health Plan | 2,000 | 4 Oct 2019 | |||
| Briar Hill Management | Business Associate | 2,000 | 9 Nov 2016 | |||
| VA Gulf Coast Veterans Health Care System | Healthcare Provider | 1,797 | 20 Sep 2011 | |||
| Forrest General Hospital | Healthcare Provider | 1,670 | 1 Feb 2018 | |||
| Strategic Management LLC | Business Associate | 1,640 | 3 Dec 2023 | |||
| Laurel Cancer Care, LLC | Healthcare Provider | 1,541 | 12 Aug 2025 | |||
| Memorial Hospital at Gulfport | Healthcare Provider | 1,512 | 28 Feb 2018 | |||
| Tri Lakes Medical Center | Healthcare Provider | 1,489 | 15 Jan 2014 | |||
| Tri Lakes Medical Center | Healthcare Provider | 1,489 | 10 Jan 2014 | |||
| Mid South Rehab Services Inc. | Healthcare Provider | 1,316 | 15 Jul 2025 | |||
| Sta-home Health & Hospice | Healthcare Provider | 1,104 | 8 Nov 2010 | |||
| Laird Hospital, Inc. | Healthcare Provider | 1,092 | 24 May 2021 | |||
| Specialized Treatment Facility | Healthcare Provider | 1,059 | 12 Aug 2022 | |||
| Scott Regional Hospital | Healthcare Provider | 1,056 | 20 May 2021 | |||
| North Mississippi Medical Center, Inc. | Healthcare Provider | 950 | 1 Sep 2023 | |||
| Merit Health Northwest Mississippi | Healthcare Provider | 846 | 26 Aug 2015 | |||
| Pause Pain & Wellness | Healthcare Provider | 777 | 27 Oct 2023 | |||
| Magnolia Health Plan | Health Plan | 759 | 28 Dec 2020 | |||
| The Vicksburg Clinic, LLC | Healthcare Provider | 744 | 15 Jun 2022 | |||
| HC Watkins Memorial Hospital | Healthcare Provider | 634 | 21 May 2021 | |||
| University of Mississippi Medical Center | Healthcare Provider | 500 | 21 Mar 2013 |
Index / Other states
Every state on the register
98
32
164
92
776
139
144
31
33
463
226
22
29
358
200
98
80
124
66
37
170
241
238
189
164
36
60
55
38
174
57
511
207
19
276
80
120
339
32
41
86
15
196
633
68
15
157
185
47
126
19
Index / Companion schedules
13 HHS breach register
→Hub: every filing, by state, year and entity.
04 Biggest breaches
→Mega-breaches with primary-source cost figures.
Industry / Healthcare
→IBM 2026: $6.64M average, 13 years at #1.
Regulation / HIPAA penalties
→OCR enforcement tiers and the 60-day rule.
11 50-state laws
→Deadline, AG threshold and penalties per state.
Cost / Per record
→Where the per-record model is reliable.
Provenance
Source: U.S. Department of Health and Human Services, Office for Civil Rights, Breach Portal (breaches affecting 500 or more individuals), retrieved 2026-08-28. Public domain. Individuals affected and dates as reported by the covered entity.
Portal: ocrportal.hhs.gov breach report. Statutory basis: HITECH Act section 13402(e)(4): the Secretary must post a list of breaches of unsecured protected health information affecting 500 or more individuals. Breaches affecting fewer than 500 individuals are reported to OCR annually and are not posted, so they are not on this register. Status wording follows the portal's two tabs ("Cases Currently Under Investigation" and "Archive") as of 28 August 2026; a filing moves to the archive when OCR closes the case. Modelled costs on this site are a method applied to the reported count, using IBM Cost of a Data Breach per-record figures, and are never a cost disclosed by the entity.
Corrections: if you represent a listed entity and the portal row has been amended, email [email protected] with the portal entry and we will re-pull the export.