State File OR / HHS OCR Breach Register120 filings, 2010 to 2026Retrieved 28 August 2026

Geography

Oregon: 120 healthcare breach filings.

Oregon entities have reported 120 breaches of 500 or more individuals to HHS since 2010, the 25th most of the 52 states and territories on the register, covering 5,405,904 individuals (29th by people affected). 8 are still under investigation. Hacking/IT Incident is the breach type on 53% of them, and network server the most common location (33%).

Filings

120

25th of 52 states and territories

Individuals affected

5,405,904

Median filing 2,400

Largest filing

1,752,076

Performance Health Technology, 2023

Hacking / IT share

53%

28 filings involve a business associate

Direct answer / Oregon on the HHS portal

The largest Oregon filing is Performance Health Technology (1,752,076 individuals, submitted 15 August 2023). The busiest year was 2023 with 13 filings. Healthcare Providers account for 73% of the state's filings. 28 filings of 10,000 or more individuals have their own page; the remaining 92 are listed in the table at the foot of this page.

Section OR.1 / Largest filings

Ten largest Oregon breaches

#	Covered entity	Type	Individuals	Submitted	Breach type	Location	BA
1	Performance Health Technology	Business Associate	1,752,076	15 Aug 2023	Hacking/IT Incident	Network Server	Yes
2	Oregon Anesthesiology Group, P.C.	Healthcare Provider	750,500	6 Dec 2021	Hacking/IT Incident	Network Server	No
3	Health Share of Oregon	Health Plan	654,362	5 Feb 2020	Theft	Laptop	Yes
4	Oregon Department of Human Services	Business Associate	625,000	22 Mar 2019	Hacking/IT Incident	Email	Yes
5	Avamere Health Services, LLC	Business Associate	229,460	13 Jul 2022	Hacking/IT Incident	Network Server	Yes
6	Premere Infinity Rehab, LLC	Business Associate	196,077	13 Jul 2022	Hacking/IT Incident	Network Server	Yes
7	Advantage Consolidated LLC	Healthcare Provider	151,626	18 Mar 2015	Hacking/IT Incident	Other	No
8	TRG, LLC	Healthcare Provider	142,004	18 Jun 2025	Hacking/IT Incident	Network Server	Yes
9	Kannact, Inc.	Business Associate	109,210	20 Jun 2023	Hacking/IT Incident	Network Server	Yes
10	Trillium Community Health Plan	Health Plan	87,761	3 Mar 2021	Hacking/IT Incident	Network Server	Yes

Section OR.2 / By year

Oregon filings by submission year

Each year links to the national year page.

Year	Filings	Individuals affected	Hacking / IT share	Filings with a page
2010	1	4,328	0%	0
2011	2	18,200	0%	1
2012	5	19,042	20%	1
2013	6	8,426	0%	0
2014	4	61,974	0%	2
2015	5	174,660	20%	2
2016	5	12,408	40%	0
2017	6	9,441	33%	0
2018	9	116,286	67%	2
2019	10	665,898	70%	3
2020	6	740,889	67%	3
2021	11	978,173	82%	5
2022	7	455,553	43%	3
2023	13	1,922,048	69%	4
2024	11	33,056	45%	1
2025	13	175,244	62%	1
2026	6	10,278	100%	0

Section OR.3 / Composition

Breach type, location and who filed

Multi-valued fields count once per value.

Type of breach

Hacking/IT Incident63 (53%)

Unauthorized Access/Disclosure37 (31%)

Theft21 (18%)

Other1 (1%)

Loss1 (1%)

Location of breached information

Network Server40 (33%)

Email32 (27%)

Paper/Films15 (13%)

Laptop11 (9%)

Desktop Computer11 (9%)

Other9 (8%)

Electronic Medical Record9 (8%)

Other Portable Electronic Device3 (3%)

Covered entity type

Healthcare Provider87 (73%)

Health Plan20 (17%)

Business Associate13 (11%)

Section OR.4 / Notification law

What Oregon law required alongside HIPAA

State notification statute

Oregon: ORS 646A.600 et seq.

Oregon Consumer Information Protection Act

Notice to individuals: As soon as practicable but no later than 45 days after discovery
Attorney general threshold: 250 or more Oregon residents (Within the 45-day notification window)
Private right of action: No: No express PROA; remedies may run through the Unlawful Trade Practices Act
Penalty: Up to $1,000 per violation; continuing violations up to $500,000

The HIPAA Breach Notification Rule runs alongside the state statute: notice to affected individuals and to HHS without unreasonable delay and no later than 60 days after discovery.

Oregon notification law in full HIPAA breach penalties

Section OR.5 / Filing pages

28 filings of 10,000 or more individuals

Each links to a page with the full filing, its rank in the state and year, OCR's closing summary where the case is archived, peers, and the modelled cost.

Covered entity	Type	Individuals	Submitted	Breach type	Location	BA
Performance Health Technology	Business Associate	1,752,076	15 Aug 2023	Hacking/IT Incident	Network Server	Yes
Oregon Anesthesiology Group, P.C.	Healthcare Provider	750,500	6 Dec 2021	Hacking/IT Incident	Network Server	No
Health Share of Oregon	Health Plan	654,362	5 Feb 2020	Theft	Laptop	Yes
Oregon Department of Human Services	Business Associate	625,000	22 Mar 2019	Hacking/IT Incident	Email	Yes
Avamere Health Services, LLC	Business Associate	229,460	13 Jul 2022	Hacking/IT Incident	Network Server	Yes
Premere Infinity Rehab, LLC	Business Associate	196,077	13 Jul 2022	Hacking/IT Incident	Network Server	Yes
Advantage Consolidated LLC	Healthcare Provider	151,626	18 Mar 2015	Hacking/IT Incident	Other	No
TRG, LLC	Healthcare Provider	142,004	18 Jun 2025	Hacking/IT Incident	Network Server	Yes
Kannact, Inc.	Business Associate	109,210	20 Jun 2023	Hacking/IT Incident	Network Server	Yes
Trillium Community Health Plan	Health Plan	87,761	3 Mar 2021	Hacking/IT Incident	Network Server	Yes
The Oregon Clinic, P.C. ("The Oregon Clinic")	Healthcare Provider	64,487	8 May 2018	Hacking/IT Incident	Email	No
Providence Health Plan	Health Plan	49,511	16 Jun 2020	Unauthorized Access/Disclosure	Network Server	Yes
Oregon Eye Specialists	Healthcare Provider	42,612	13 Dec 2021	Hacking/IT Incident	Email	No
The Corvallis Clinic, P.C.	Healthcare Provider	41,000	19 Dec 2014	Theft	Laptop	No
One Community Health	Healthcare Provider	39,865	22 Nov 2021	Hacking/IT Incident	Network Server	No
Metro Presort, Inc.	Business Associate	38,387	1 Mar 2021	Hacking/IT Incident	Network Server	Yes
Legacy Health	Healthcare Provider	38,000	20 Aug 2018	Hacking/IT Incident	Email	No
Native American Rehabilitation Association of the Northwest, Inc.	Healthcare Provider	25,187	3 Jan 2020	Hacking/IT Incident	Email	No
Coos Health & Wellness	Healthcare Provider	22,115	7 Sep 2023	Hacking/IT Incident	Network Server	No
Neuromusculoskeletal Center of the Cascades, PC	Healthcare Provider	19,373	1 Dec 2023	Hacking/IT Incident	Email	No
Central City Concern	Healthcare Provider	17,914	19 May 2014	Unauthorized Access/Disclosure	Other	No
Lower Umpqua Hospital	Business Associate	17,000	8 Jun 2011	Theft	Other, Other Portable Electronic Device	Yes
Hematology Oncology Associates, PC	Healthcare Provider	16,073	21 May 2019	Hacking/IT Incident	Email	No
Oregon's Health CO-OP	Health Plan	14,000	1 Jun 2015	Theft	Laptop	No
Robert Witham, MD, FACP	Healthcare Provider	11,136	6 Jun 2012	Theft	Desktop Computer	No
Mid-Valley Behavioral Care Network	Business Associate	10,710	9 Aug 2019	Hacking/IT Incident	Email	Yes
CareOregon Advantage	Health Plan	10,467	23 Feb 2022	Unauthorized Access/Disclosure	Email	No
Ardon Health	Healthcare Provider	10,098	22 Nov 2024	Hacking/IT Incident	Email	No

Section OR.6 / All other filings

92 filings below 10,000 individuals

Listed in full from the HHS export, largest first. These filings do not have their own page.

Covered entity	Type	Individuals	Submitted	Breach type	Location	BA
Asante Ashland Community Hospital	Healthcare Provider	8,834	24 Feb 2023	Unauthorized Access/Disclosure	Electronic Medical Record	No
Legacy Health	Healthcare Provider	8,065	23 Nov 2022	Unauthorized Access/Disclosure	Other Portable Electronic Device	No
CareOregon	Health Plan	8,022	5 Oct 2022	Unauthorized Access/Disclosure	Paper/Films	No
CareOregonOpen	Health Plan	6,988	26 Dec 2025	Unauthorized Access/Disclosure	Network Server	No
River City Eye Care, LLCOpen	Healthcare Provider	6,588	16 Oct 2025	Hacking/IT Incident	Network Server	No
Robert Peterson DDS, PC	Healthcare Provider	6,500	23 Mar 2024	Theft	Paper/Films	No
Charles E. Jones DDS PC, DBA Jones Family Dental	Healthcare Provider	6,493	18 Jun 2021	Hacking/IT Incident	Network Server	No
Providence Medical Group- Gateway Clinics	Healthcare Provider	5,978	15 Jul 2016	Unauthorized Access/Disclosure	Electronic Medical Record	No
AllCare Health, Inc.	Health Plan	5,707	28 Dec 2020	Hacking/IT Incident	Network Server	Yes
Sky Lakes Medical Center	Healthcare Provider	5,514	23 Dec 2020	Hacking/IT Incident	Network Server	No
Providence Health Plan	Health Plan	5,509	7 Jun 2021	Unauthorized Access/Disclosure	Email	No
Monterey Health Center	Healthcare Provider	5,400	11 Oct 2019	Hacking/IT Incident	Network Server	No
Northwest Primary Care Group	Healthcare Provider	5,327	11 Dec 2015	Theft	Desktop Computer, Paper/Films	No
AgeRight Clinical ServicesOpen	Healthcare Provider	4,859	5 Dec 2025	Hacking/IT Incident	Network Server	No
St. Charles Health System, Inc.	Healthcare Provider	4,687	14 Jun 2021	Hacking/IT Incident	Network Server	Yes
Mid-Columbia Center for Living	Healthcare Provider	4,435	19 Aug 2024	Hacking/IT Incident	Email	No
Molalla Family Dental	Healthcare Provider	4,354	16 Jul 2012	Hacking/IT Incident, Other, Unauthorized Access/Disclosure	Network Server	No
Eastmoreland Surgical Clinic, William Graham, DO	Healthcare Provider	4,328	20 Aug 2010	Theft	Desktop Computer, Laptop, Other, Other Portable Electronic Device	No
Sutton Dental Arts	Healthcare Provider	4,109	22 Jul 2024	Hacking/IT Incident	Network Server	No
Tillamook Chiropractic, PC	Healthcare Provider	4,058	3 Oct 2018	Hacking/IT Incident	Desktop Computer, Network Server	No
Willamette Family, Inc.Open	Healthcare Provider	3,899	31 Mar 2025	Hacking/IT Incident	Email	No
Oregon Specialty Group	Healthcare Provider	3,337	18 Jul 2025	Hacking/IT Incident	Network Server	No
Thomas L. Davis, Jr. DDS	Healthcare Provider	3,269	15 Mar 2013	Theft	Desktop Computer, Electronic Medical Record	No
Partners In Care	Healthcare Provider	3,048	26 Apr 2019	Hacking/IT Incident	Email	No
Oregon Endodontic Group	Healthcare Provider	2,952	2 Apr 2019	Hacking/IT Incident	Email	No
Native American Rehabilitation Association of the Northwest, Inc.	Healthcare Provider	2,915	28 Oct 2022	Hacking/IT Incident	Email	No
Adapt Integrated Health Care	Healthcare Provider	2,908	9 Feb 2026	Hacking/IT Incident	Network Server	Yes
Don White, RN, DC, PC dba Canyon Rd Chiropractic and Massage	Healthcare Provider	2,900	3 Aug 2018	Hacking/IT Incident	Network Server	No
RegenceOpen	Health Plan	2,856	21 May 2026	Hacking/IT Incident	Network Server	No
Multnomah County Health Department	Healthcare Provider	2,719	12 Apr 2023	Theft	Paper/Films	No
St. Charles Health System	Healthcare Provider	2,459	16 Mar 2017	Unauthorized Access/Disclosure	Electronic Medical Record	No
Asante	Healthcare Provider	2,400	9 Sep 2016	Unauthorized Access/Disclosure	Electronic Medical Record	No
Dr. Trandinh	Business Associate	2,300	20 Feb 2012	Theft, Unauthorized Access/Disclosure	Laptop	Yes
Mosaic Medical	Healthcare Provider	2,207	5 Mar 2015	Unauthorized Access/Disclosure	Paper/Films	No
Family Medical Group Northeast PC	Healthcare Provider	2,077	22 Aug 2018	Unauthorized Access/Disclosure	Desktop Computer	No
Morrison Child and Family Services	Healthcare Provider	2,044	20 Oct 2023	Hacking/IT Incident	Network Server	No
Family Tree Relief Nursery	Healthcare Provider	2,000	30 Aug 2018	Hacking/IT Incident	Network Server	No
Paul C. Gering, Jr., M.D.	Healthcare Provider	2,000	29 Jun 2017	Theft	Desktop Computer	No
Howard R. Jarvis, D.M.D., L.L.C. dba Southwest Portland Dental	Healthcare Provider	1,980	30 Aug 2016	Hacking/IT Incident	Network Server	No
Advantage Orthopedic & Sports Medicine, LLP	Healthcare Provider	1,914	29 Jul 2024	Hacking/IT Incident	Network Server	No
Lane Community College Health Clinic	Healthcare Provider	1,911	25 Mar 2017	Hacking/IT Incident	Laptop	No
CareOregon, Inc.	Health Plan	1,786	30 May 2025	Hacking/IT Incident	Email	No
Portland VA Medical Center	Healthcare Provider	1,740	29 Oct 2014	Theft	Paper/Films	No
Western Skies Wellness LLC	Healthcare Provider	1,700	11 Sep 2025	Unauthorized Access/Disclosure	Electronic Medical Record, Other	No
Multnomah County	Healthcare Provider	1,700	20 Jan 2017	Unauthorized Access/Disclosure	Email	No
Frideres Dental LLC	Healthcare Provider	1,596	24 Mar 2023	Hacking/IT Incident	Email	No
Fora Health, Inc.	Healthcare Provider	1,568	28 May 2024	Hacking/IT Incident	Email	No
Atique Orthodontics	Healthcare Provider	1,506	15 Apr 2016	Hacking/IT Incident	Desktop Computer	No
PT Northwest, LLC	Healthcare Provider	1,500	21 Aug 2015	Unauthorized Access/Disclosure	Email	No
Benton County HealthOpen	Healthcare Provider	1,476	16 Jan 2026	Hacking/IT Incident	Network Server	Yes
Southwest Oregon IPA	Health Plan	1,449	18 Sep 2018	Unauthorized Access/Disclosure	Paper/Films	No
Oregon Health & Science University	Healthcare Provider	1,361	28 Jul 2013	Unauthorized Access/Disclosure	Other	No
Albertina Kerr Centers	Healthcare Provider	1,320	6 Oct 2014	Theft	Laptop	No
Deschutes County Health Services	Healthcare Provider	1,305	22 Jan 2026	Hacking/IT Incident	Network Server	Yes
Samaritan Health Services, Inc.	Healthcare Provider	1,296	27 Jun 2024	Unauthorized Access/Disclosure	Electronic Medical Record	No
Yamhill Community Care Organization (YCCO)	Health Plan	1,251	22 Oct 2025	Unauthorized Access/Disclosure	Other	No
Treatment Services Northwest	Healthcare Provider	1,200	29 Jul 2011	Theft	Desktop Computer	No
La Pine Community Health Center	Healthcare Provider	1,190	5 Feb 2026	Hacking/IT Incident	Desktop Computer	Yes
Integrated Supports for Living, Inc.	Healthcare Provider	1,161	20 Mar 2023	Hacking/IT Incident	Network Server	No
Oregon Health & Science University	Healthcare Provider	1,114	26 Mar 2013	Theft	Laptop	No
Multnomah County Health Department	Healthcare Provider	1,092	20 May 2024	Unauthorized Access/Disclosure	Laptop	No
Oregon Health & Science University	Healthcare Provider	1,076	11 Apr 2013	Theft	Laptop	No
Southern Oregon Neurosurgical and Spine Associates, PCOpen	Healthcare Provider	1,000	9 Dec 2025	Hacking/IT Incident	Email	No
Lincoln County Health and Human Services/Lincoln Community Health Center	Healthcare Provider	959	14 Jun 2013	Unauthorized Access/Disclosure	Paper/Films	No
Northwest Eye Care Professionals	Healthcare Provider	950	22 Nov 2023	Hacking/IT Incident	Network Server	No
Absolute Dental Hygiene, LLC	Healthcare Provider	871	20 Dec 2017	Hacking/IT Incident	Desktop Computer, Electronic Medical Record, Network Server	No
Regence BlueCross BlueShield of Oregon	Health Plan	856	18 Jan 2024	Unauthorized Access/Disclosure	Paper/Films	No
Rogue Community Health	Healthcare Provider	847	25 May 2021	Hacking/IT Incident	Network Server	Yes
Regence	Health Plan	803	12 Apr 2021	Hacking/IT Incident	Email	Yes
Regence BlueShield	Business Associate	783	31 Jan 2025	Unauthorized Access/Disclosure	Network Server	Yes
Columbia County Child Abuse Assessment Center dba The Amani Center	Healthcare Provider	760	28 Nov 2023	Hacking/IT Incident	Email	No
Lane County Health & Human Services	Healthcare Provider	715	1 Aug 2018	Loss	Paper/Films	No
Multnomah County Department of Human Services	Business Associate	713	8 Jul 2019	Unauthorized Access/Disclosure	Other	Yes
Multnomah County	Healthcare Provider	709	14 Sep 2021	Theft	Paper/Films	No
Oregon Health & Science University	Healthcare Provider	702	31 Jul 2012	Theft	Other	No
Regence BlueShield Washington	Business Associate	684	21 Aug 2019	Unauthorized Access/Disclosure	Paper/Films	Yes
Huggins Insurance Services, Inc.	Business Associate	667	24 May 2019	Hacking/IT Incident	Email	Yes
Providence Health Plan	Health Plan	651	19 Mar 2019	Theft	Laptop	Yes
Kaiser Foundation Health Plan of the Northwest	Health Plan	647	3 Sep 2013	Unauthorized Access/Disclosure	Electronic Medical Record	No
Pacific Clear Vision Institute	Healthcare Provider	626	15 Oct 2023	Unauthorized Access/Disclosure	Email	No
Regence BlueCross BlueShield	Health Plan	610	29 Oct 2024	Unauthorized Access/Disclosure	Paper/Films	Yes
The Waldorf Center	Healthcare Provider	608	15 Jun 2020	Hacking/IT Incident	Email	No
Care Partners Hospice and Palliative Care	Healthcare Provider	600	25 May 2018	Hacking/IT Incident	Email	No
White Bird Clinic	Healthcare Provider	584	23 Feb 2023	Unauthorized Access/Disclosure	Email	No
Kaiser Foundation Health Plan of Northwest	Health Plan	578	14 Jun 2024	Unauthorized Access/Disclosure	Paper/Films	No
Oregon Health Authority	Healthcare Provider	550	26 Apr 2012	Theft	Paper/Films	No
Canby ClinicOpen	Healthcare Provider	549	30 Apr 2025	Unauthorized Access/Disclosure	Email	No
Klamath County	Healthcare Provider	547	29 Nov 2022	Unauthorized Access/Disclosure	Email	No
Kaiser Foundation Health Plan of the Northwest	Health Plan	544	6 Nov 2016	Unauthorized Access/Disclosure	Network Server	No
Ko-Kwel Wellness Center	Healthcare Provider	543	3 Feb 2026	Hacking/IT Incident	Network Server	Yes
Northwest Medical Homes, LLC	Healthcare Provider	500	13 Jul 2025	Hacking/IT Incident	Network Server	No
Northwest Behavioral Healthcare Services	Healthcare Provider	500	27 Jul 2017	Unauthorized Access/Disclosure	Email	No

Index / Companion schedules

13 HHS breach register

→

Hub: every filing, by state, year and entity.

04 Biggest breaches

→

Mega-breaches with primary-source cost figures.

Industry / Healthcare

→

IBM 2026: $6.64M average, 13 years at #1.

Regulation / HIPAA penalties

→

OCR enforcement tiers and the 60-day rule.

11 50-state laws

→

Deadline, AG threshold and penalties per state.

Cost / Per record

→

Where the per-record model is reliable.

Provenance

Source: U.S. Department of Health and Human Services, Office for Civil Rights, Breach Portal (breaches affecting 500 or more individuals), retrieved 2026-08-28. Public domain. Individuals affected and dates as reported by the covered entity.

Portal: ocrportal.hhs.gov breach report. Statutory basis: HITECH Act section 13402(e)(4): the Secretary must post a list of breaches of unsecured protected health information affecting 500 or more individuals. Breaches affecting fewer than 500 individuals are reported to OCR annually and are not posted, so they are not on this register. Status wording follows the portal's two tabs ("Cases Currently Under Investigation" and "Archive") as of 28 August 2026; a filing moves to the archive when OCR closes the case. Modelled costs on this site are a method applied to the reported count, using IBM Cost of a Data Breach per-record figures, and are never a cost disclosed by the entity.

Corrections: if you represent a listed entity and the portal row has been amended, email [email protected] with the portal entry and we will re-pull the export.