State File TN / HHS OCR Breach Register196 filings, 2009 to 2026Retrieved 28 August 2026

Geography

Tennessee: 196 healthcare breach filings.

Tennessee entities have reported 196 breaches of 500 or more individuals to HHS since 2009, the 13th most of the 52 states and territories on the register, covering 39,363,541 individuals (8th by people affected). 18 are still under investigation. Hacking/IT Incident is the breach type on 62% of them, and network server the most common location (43%).

Filings

196

13th of 52 states and territories

Individuals affected

39,363,541

Median filing 3,371

Largest filing

11,270,000

HCA Healthcare, 2023

Hacking / IT share

62%

71 filings involve a business associate

Direct answer / Tennessee on the HHS portal

The largest Tennessee filing is HCA Healthcare (11,270,000 individuals, submitted 31 July 2023). The busiest year was 2024 with 26 filings. Healthcare Providers account for 69% of the state's filings. 70 filings of 10,000 or more individuals have their own page; the remaining 126 are listed in the table at the foot of this page.

Section TN.1 / Largest filings

Ten largest Tennessee breaches

#	Covered entity	Type	Individuals	Submitted	Breach type	Location	BA
1	HCA Healthcare	Business Associate	11,270,000	31 Jul 2023	Hacking/IT Incident	Network Server	Yes
2	Community Health Systems Professional Services Corporations	Healthcare Provider	6,121,158	21 Aug 2014	Hacking/IT Incident	Network Server	No
3	Community Health Systems Professional Services Corporation	Business Associate	4,500,000	20 Aug 2014	Theft	Network Server	Yes
4	QualDerm Partners, LLCOpen	Healthcare Provider	3,117,874	22 Feb 2026	Hacking/IT Incident	Network Server	No
5	Xsolis, Inc.Open	Business Associate	1,396,519	5 Jun 2026	Hacking/IT Incident	Network Server	Yes
6	Community Health Systems Professional Services Corporations (CHSPSC), LLC	Business Associate	1,173,555	16 Mar 2023	Hacking/IT Incident	Network Server	Yes
7	BlueCross BlueShield of Tennessee, Inc.	Health Plan	1,023,209	1 Nov 2010	Theft	Other	No
8	United Seating and Mobility, L.L.C., d/b/a Numotion	Healthcare Provider	688,852	1 May 2024	Hacking/IT Incident	Network Server	No
9	Plaza Radiology, LLC	Healthcare Provider	569,022	20 Dec 2023	Hacking/IT Incident	Desktop Computer, Network Server	No
10	MSK Group	Healthcare Provider	566,236	22 May 2018	Hacking/IT Incident	Network Server	No

Section TN.2 / By year

Tennessee filings by submission year

Each year links to the national year page.

Year	Filings	Individuals affected	Hacking / IT share	Filings with a page
2009	1	6,400	0%	0
2010	6	1,040,302	0%	1
2011	7	8,079	0%	0
2012	2	28,901	0%	1
2013	8	57,716	0%	1
2014	10	11,031,397	20%	5
2015	5	147,909	0%	2
2016	7	35,670	43%	1
2017	11	113,904	27%	3
2018	7	611,564	86%	3
2019	10	445,391	80%	2
2020	10	447,802	70%	5
2021	14	580,177	71%	6
2022	18	1,611,986	83%	9
2023	15	15,309,343	80%	9
2024	26	2,162,728	88%	10
2025	25	912,350	84%	6
2026	14	4,811,922	79%	6

Section TN.3 / Composition

Breach type, location and who filed

Multi-valued fields count once per value.

Type of breach

Hacking/IT Incident121 (62%)

Unauthorized Access/Disclosure35 (18%)

Theft25 (13%)

Loss8 (4%)

Improper Disposal5 (3%)

Other2 (1%)

Location of breached information

Network Server85 (43%)

Email48 (24%)

Paper/Films29 (15%)

Laptop14 (7%)

Other11 (6%)

Electronic Medical Record7 (4%)

Desktop Computer6 (3%)

Other Portable Electronic Device6 (3%)

Covered entity type

Healthcare Provider135 (69%)

Business Associate35 (18%)

Health Plan26 (13%)

Section TN.4 / Notification law

What Tennessee law required alongside HIPAA

State notification statute

Tennessee: Tenn. Code Ann. 47-18-2107

Notice to individuals: Immediately, but no later than 45 days from discovery or notification
Attorney general threshold: No mandatory AG notification for private-sector breaches
Private right of action: Yes: Affected customers may sue to recover damages and obtain injunctive relief
Penalty: AG may pursue civil penalties, injunctive relief, and restitution; class actions restricted

The HIPAA Breach Notification Rule runs alongside the state statute: notice to affected individuals and to HHS without unreasonable delay and no later than 60 days after discovery.

Tennessee notification law in full HIPAA breach penalties

Section TN.5 / Filing pages

70 filings of 10,000 or more individuals

Each links to a page with the full filing, its rank in the state and year, OCR's closing summary where the case is archived, peers, and the modelled cost.

Covered entity	Type	Individuals	Submitted	Breach type	Location	BA
HCA Healthcare	Business Associate	11,270,000	31 Jul 2023	Hacking/IT Incident	Network Server	Yes
Community Health Systems Professional Services Corporations	Healthcare Provider	6,121,158	21 Aug 2014	Hacking/IT Incident	Network Server	No
Community Health Systems Professional Services Corporation	Business Associate	4,500,000	20 Aug 2014	Theft	Network Server	Yes
QualDerm Partners, LLCOpen	Healthcare Provider	3,117,874	22 Feb 2026	Hacking/IT Incident	Network Server	No
Xsolis, Inc.Open	Business Associate	1,396,519	5 Jun 2026	Hacking/IT Incident	Network Server	Yes
Community Health Systems Professional Services Corporations (CHSPSC), LLC	Business Associate	1,173,555	16 Mar 2023	Hacking/IT Incident	Network Server	Yes
BlueCross BlueShield of Tennessee, Inc.	Health Plan	1,023,209	1 Nov 2010	Theft	Other	No
United Seating and Mobility, L.L.C., d/b/a Numotion	Healthcare Provider	688,852	1 May 2024	Hacking/IT Incident	Network Server	No
Plaza Radiology, LLC	Healthcare Provider	569,022	20 Dec 2023	Hacking/IT Incident	Desktop Computer, Network Server	No
MSK Group	Healthcare Provider	566,236	22 May 2018	Hacking/IT Incident	Network Server	No
Unum Group SACE	Health Plan	559,315	3 Aug 2023	Hacking/IT Incident	Network Server	No
Murfreesboro Medical Clinic & SurgiCenter	Healthcare Provider	559,000	21 Jun 2023	Hacking/IT Incident	Network Server	No
The Chattanooga Heart Institute	Healthcare Provider	545,491	28 Jul 2023	Hacking/IT Incident	Network Server	No
United Seating and Mobility, LLC d/b/a Numotion	Healthcare Provider	529,004	7 Mar 2025	Hacking/IT Incident	Email	No
Intellihartx, LLC	Business Associate	489,830	8 Jun 2023	Hacking/IT Incident	Network Server	Yes
Summit Medical Group, PLLC	Healthcare Provider	464,159	13 Dec 2024	Hacking/IT Incident	Email	No
QRS, Inc.	Business Associate	430,334	22 Oct 2021	Hacking/IT Incident	Network Server	Yes
East Tennessee Children's Hospital	Healthcare Provider	422,531	7 Apr 2022	Hacking/IT Incident	Network Server	No
Memphis Pathology Laboratory d/b/a American Esoteric Laboratories	Healthcare Provider	417,146	15 Jul 2019	Hacking/IT Incident	Network Server	No
Specialty Networks, Inc.	Business Associate	411,037	15 Aug 2024	Hacking/IT Incident	Network Server	Yes
American Addiction Centers, Inc.	Business Associate	410,747	25 Nov 2024	Hacking/IT Incident	Network Server	Yes
Molecular Pathology Laboratory Network, Inc.	Healthcare Provider	339,471	3 Mar 2022	Hacking/IT Incident	Network Server	No
Touchstone Medical Imaging, LLC	Healthcare Provider	307,528	3 Oct 2014	Unauthorized Access/Disclosure	Network Server	No
The Stern Cardiovascular Foundation, Inc.	Healthcare Provider	270,645	5 Nov 2022	Hacking/IT Incident	Network Server	No
University of Tennessee Medical Center	Healthcare Provider	234,954	14 Sep 2020	Hacking/IT Incident	Network Server	Yes
Norwood Clinic	Healthcare Provider	228,000	25 Feb 2022	Hacking/IT Incident	Electronic Medical Record	No
CDHA Management, LLC and Spark DSO, LLC dba Chord Specialty Dental PartnersOpen	Healthcare Provider	173,430	14 Mar 2025	Hacking/IT Incident	Email	No
Anatomic and Clinical Laboratory Associates, P.C.Open	Healthcare Provider	169,626	23 Jun 2026	Hacking/IT Incident	Network Server	No
Urgent Team Holdings	Healthcare Provider	166,601	31 Mar 2022	Hacking/IT Incident	Network Server	No
Tennessee Orthopaedic Alliance	Healthcare Provider	81,146	14 Feb 2020	Hacking/IT Incident	Email	No
Tennessee Rural Health Improvement Association	Health Plan	79,000	13 Jan 2015	Unauthorized Access/Disclosure	Other	No
International Paper Company Group Health and Welfare Plan	Health Plan	78,692	14 Nov 2023	Hacking/IT Incident	Network Server	Yes
Summit Behavioral Healthcare	Healthcare Provider	70,822	26 Feb 2021	Unauthorized Access/Disclosure	Email	No
Mid-South Pulmonary & Sleep Specialists P.C.Open	Healthcare Provider	70,211	30 Dec 2025	Hacking/IT Incident	Network Server	No
Tri-Cities GastroenterologyOpen	Healthcare Provider	67,115	29 Apr 2026	Hacking/IT Incident	Network Server	No
Primary Care Specialists, Inc.	Healthcare Provider	65,000	9 Mar 2017	Hacking/IT Incident	Network Server	No
State of Tennessee State Insurance Plan	Health Plan	60,582	15 Aug 2014	Hacking/IT Incident	Network Server	No
Dyersburg Family Walk-In Clinic, LLC dba Reelfoot Family Walk-In Clinic	Healthcare Provider	58,562	23 Sep 2022	Hacking/IT Incident	Network Server	No
Boston Baskin Cancer Foundation	Healthcare Provider	56,694	2 Feb 2015	Theft	Other Portable Electronic Device	No
SUMMIT EYE ASSOCIATES P.C.	Healthcare Provider	53,818	27 Apr 2022	Hacking/IT Incident	Electronic Medical Record	Yes
Centerstone of Tennessee, Inc.	Healthcare Provider	50,965	23 Oct 2020	Hacking/IT Incident	Email	No
Nissan North America, Inc.	Health Plan	50,410	31 Dec 2020	Hacking/IT Incident	Email, Network Server	Yes
Tennessee Orthopaedic Clinics	Healthcare Provider	46,679	19 May 2023	Hacking/IT Incident	Network Server	No
Artemis Healthcare Inc.	Healthcare Provider	45,867	23 Dec 2025	Hacking/IT Incident	Network Server	No
AHS Management Company, Inc.	Business Associate	38,361	22 Jan 2024	Hacking/IT Incident	Network Server	Yes
Advent Health Partners, Inc.	Business Associate	37,183	6 Jan 2022	Hacking/IT Incident	Email	Yes
Lucent Health Solutions, LLC	Business Associate	37,000	30 Jan 2025	Hacking/IT Incident	Email	Yes
Cogent Healthcare, Inc.	Business Associate	32,000	30 Aug 2013	Theft	Network Server	Yes
Wakefield & Associates, LLC	Business Associate	31,751	30 Jan 2026	Hacking/IT Incident	Network Server	Yes
CareAll Management, LLC	Healthcare Provider	28,300	12 Aug 2014	Improper Disposal	Other	No
Blount Memorial Hospital, Inc	Healthcare Provider	27,799	17 Oct 2012	Theft	Laptop	No
GPS Sango Family Dentistry, PLLC d/b/a Sango Family Dentistry	Healthcare Provider	27,000	24 Oct 2024	Hacking/IT Incident	Network Server	No
Regional Obstetrical Consultants PCOpen	Healthcare Provider	25,650	2 Jul 2024	Hacking/IT Incident	Network Server	No
Politzer and Durocher, PLC d/b/a Optometric Physicians of Middle Tennessee	Healthcare Provider	24,996	4 Apr 2024	Hacking/IT Incident	Network Server	No
Human Technology Inc., and its affiliates	Healthcare Provider	24,580	1 Jul 2024	Hacking/IT Incident	Network Server	No
Decatur County General Hospital	Healthcare Provider	24,000	26 Jan 2018	Hacking/IT Incident	Network Server	No
Cleveland Medical Associates, PLLC	Healthcare Provider	22,000	20 Jun 2017	Hacking/IT Incident	Network Server	No
Haven Behavioral Healthcare	Business Associate	21,714	23 Mar 2021	Hacking/IT Incident	Network Server	Yes
Meharry Medical College	Healthcare Provider	20,963	4 Dec 2020	Hacking/IT Incident	Email	No
University of Tennessee Health Science Center	Healthcare Provider	19,353	1 Apr 2024	Hacking/IT Incident	Network Server	Yes
Cancer Care Center	Healthcare Provider	17,809	9 Jun 2021	Hacking/IT Incident	Electronic Medical Record	Yes
Knoxville Heart Group, Inc.	Healthcare Provider	15,995	27 Apr 2018	Hacking/IT Incident	Email	No
Hamilton County Government	Healthcare Provider	14,081	3 Apr 2025	Hacking/IT Incident	Network Server	Yes
American Home Patient	Healthcare Provider	13,709	6 Mar 2017	Theft	Other Portable Electronic Device	No
Bryan Myers, MD PC, Ashley DeWitt, DO PC, Michael Nobles, MD PC	Healthcare Provider	13,150	30 Dec 2016	Hacking/IT Incident	Network Server	No
SEES Group, LLC	Healthcare Provider	13,000	31 Dec 2019	Hacking/IT Incident	Email	No
Professional Healthcare Management, Inc.	Healthcare Provider	12,306	28 Oct 2021	Hacking/IT Incident	Network Server	No
Hermitage Eye Care, PLLC dba Dover Eye Care	Healthcare Provider	11,672	5 Nov 2021	Hacking/IT Incident	Network Server	Yes
Surgery Center of Oak Ridge, LLC dba Advanced Family Surgery CenterOpen	Healthcare Provider	10,320	23 Jan 2026	Hacking/IT Incident	Network Server	No
Epic Management LLC	Healthcare Provider	10,050	14 Nov 2022	Hacking/IT Incident	Email	No

Section TN.6 / All other filings

126 filings below 10,000 individuals

Listed in full from the HHS export, largest first. These filings do not have their own page.

Covered entity	Type	Individuals	Submitted	Breach type	Location	BA
National Seating & Mobility, Inc.	Healthcare Provider	9,627	12 Jun 2015	Theft	Email, Laptop, Paper/Films	No
Fred's Stores of Tennessee, Incorporated	Healthcare Provider	9,624	29 Sep 2016	Theft	Laptop	No
Network Pharmacy Knoxville	Healthcare Provider	9,602	15 Jan 2014	Theft	Laptop	No
RHEA MEDICAL CENTER	Healthcare Provider	8,309	10 Apr 2025	Hacking/IT Incident	Network Server	Yes
Surgery Partners (North Carolina Specialty Hospital)	Business Associate	8,258	28 Jun 2022	Hacking/IT Incident	Network Server	Yes
University of Tennessee Medical Center	Healthcare Provider	8,200	30 Nov 2010	Improper Disposal	Paper/Films	No
Skin MD, PLLC	Healthcare Provider	7,558	6 Feb 2023	Improper Disposal	Paper/Films	No
HOPE Family Health	Healthcare Provider	6,932	30 Sep 2013	Theft	Laptop	No
Grace Primary Care, PC	Healthcare Provider	6,853	7 Jun 2016	Hacking/IT Incident	Network Server	Yes
Cogent Healthcare, Inc.	Business Associate	6,400	25 Nov 2009	Theft	Laptop	Yes
Foundations Recovery Network	Healthcare Provider	5,690	15 Aug 2013	Unauthorized Access/Disclosure	Laptop	No
Cumberland Heights Foundation, Inc.Open	Healthcare Provider	5,078	19 Apr 2024	Hacking/IT Incident	Email	No
Erlanger Health System	Healthcare Provider	4,938	4 Sep 2020	Loss	Other Portable Electronic Device	Yes
City of Bristol, Tennessee	Healthcare Provider	4,708	22 Apr 2025	Hacking/IT Incident	Network Server	Yes
Healthcare Management System	Business Associate	4,330	4 Oct 2013	Unauthorized Access/Disclosure	Paper/Films	Yes
Ballad Health	Healthcare Provider	4,295	8 Apr 2022	Hacking/IT Incident	Email	No
NHC HealthCare, Oak Ridge	Healthcare Provider	4,268	13 Sep 2013	Loss	Other	No
Erlanger Health	Healthcare Provider	4,237	1 Jul 2026	Unauthorized Access/Disclosure	Electronic Medical Record	No
Integrated Oncology Network	Business Associate	4,174	27 Jun 2025	Hacking/IT Incident	Email	Yes
Summit Medical Group, PLLC	Healthcare Provider	4,135	12 Jan 2024	Hacking/IT Incident	Email	No
State of TN, Bureau of TennCare	Health Plan	3,900	19 Feb 2010	Theft	Paper/Films	No
Perry County Medical Center Inc. d/b/a Three Rivers Community Health Group	Healthcare Provider	3,812	26 Jul 2019	Hacking/IT Incident	Email	No
National Seating & Mobility, Inc.	Healthcare Provider	3,800	15 Apr 2019	Hacking/IT Incident	Email	No
SEES Group, LLC	Healthcare Provider	3,797	27 Apr 2021	Hacking/IT Incident	Email	No
Centerstone of Tennessee, Inc.	Healthcare Provider	3,675	12 Sep 2022	Hacking/IT Incident	Email	No
Vista Radiology, P.C.	Healthcare Provider	3,664	9 Sep 2021	Hacking/IT Incident	Network Server	No
Surgery Partners (Lafayette Surgical Specialty Hospital)	Business Associate	3,527	28 Jun 2022	Hacking/IT Incident	Network Server	Yes
Erlanger Health	Healthcare Provider	3,371	28 May 2025	Hacking/IT Incident	Network Server	Yes
Vanderbilt University Medical CenterOpen	Healthcare Provider	3,298	24 Jul 2026	Hacking/IT Incident	Email	No
Vanderbilt University Medical Center	Healthcare Provider	3,247	24 Feb 2017	Unauthorized Access/Disclosure	Electronic Medical Record	No
Erlanger Health	Healthcare Provider	3,193	10 Apr 2025	Hacking/IT Incident	Network Server	Yes
Interventional Pain Center, PLLCOpen	Healthcare Provider	3,171	31 Mar 2026	Hacking/IT Incident	Email	No
Roark's Pharmacy	Healthcare Provider	3,000	19 Feb 2016	Theft	Network Server	No
Saint Thomas Rutherford Hospital	Healthcare Provider	2,837	22 Jun 2017	Improper Disposal	Paper/Films	No
Colby DeHart	Business Associate	2,777	19 Dec 2013	Theft	Laptop	Yes
Erlanger Health, Inc.	Healthcare Provider	2,753	18 Sep 2023	Hacking/IT Incident	Network Server	Yes
FC Compassus, LLC	Healthcare Provider	2,703	2 Dec 2024	Hacking/IT Incident	Email	Yes
Alana Healthcare	Healthcare Provider	2,691	18 Apr 2019	Hacking/IT Incident	Email	No
BlueCross BlueShield of Tennessee, Inc.	Business Associate	2,688	25 Jul 2023	Unauthorized Access/Disclosure	Paper/Films	Yes
Professional Counseling & Medical Associates	Healthcare Provider	2,500	13 Jul 2017	Hacking/IT Incident	Electronic Medical Record	Yes
Franklin Dermatology Group, PLC	Healthcare Provider	2,457	11 Sep 2025	Hacking/IT Incident	Network Server	Yes
Tennessee River Physicians, PLLC	Healthcare Provider	2,363	16 Sep 2025	Hacking/IT Incident	Network Server	Yes
Core Dental Health	Healthcare Provider	2,349	1 Jul 2024	Hacking/IT Incident	Email, Network Server	No
United Seating and Mobility, LLC dba Numotion	Healthcare Provider	2,319	11 Nov 2024	Hacking/IT Incident	Email	No
TennCareOpen	Health Plan	2,300	27 Jul 2026	Unauthorized Access/Disclosure	Paper/Films	No
Aegis Sciences Corporation	Healthcare Provider	2,185	21 Dec 2011	Theft	Laptop, Other Portable Electronic Device	No
BlueCross BlueShield of TN, Inc.	Health Plan	2,117	21 Jul 2017	Unauthorized Access/Disclosure	Paper/Films	No
Germantown Emergency Physicians, PLLC	Healthcare Provider	2,084	16 Sep 2025	Hacking/IT Incident	Network Server	Yes
FPMCM LLCOpen	Business Associate	2,072	15 Dec 2025	Unauthorized Access/Disclosure	Email	Yes
Associated Pathologists, LLC dba PathGroup Health Plan	Health Plan	2,031	18 Jul 2023	Hacking/IT Incident	Network Server	Yes
Speight Family Medical, LLC	Healthcare Provider	2,000	6 Dec 2019	Hacking/IT Incident	Network Server	No
Delta Specialty Hospital	Healthcare Provider	1,998	31 May 2024	Hacking/IT Incident	Email	No
WyndRidge Health and Rehabilitation Center	Healthcare Provider	1,958	26 Nov 2021	Hacking/IT Incident	Network Server	No
Alive Hospice	Healthcare Provider	1,868	13 Jul 2018	Hacking/IT Incident	Email	No
Acadia Healthcare Company, IncOpen	Business Associate	1,807	22 May 2026	Hacking/IT Incident	Email	Yes
State of Tennessee Sponsored Group Health Plan	Health Plan	1,770	28 Nov 2011	Unauthorized Access/Disclosure	Paper/Films	No
Crestwyn Behavioral Health Hospital, Inc.	Healthcare Provider	1,757	31 May 2024	Hacking/IT Incident	Email	No
St. Jude Children's Research Hospital	Healthcare Provider	1,745	8 Jun 2010	Loss	Laptop	No
Wellmont Health System	Healthcare Provider	1,726	24 Apr 2015	Improper Disposal	Other, Paper/Films	No
Metropolitan Government of Nashville and Davidson County (Metro) Public Health Department	Health Plan	1,717	29 Aug 2014	Other	Other	No
Chattanooga Family Practice Associates, P.C.	Healthcare Provider	1,711	16 Aug 2010	Loss	Other, Other Portable Electronic Device	No
TennCare	Health Plan	1,694	9 Sep 2022	Unauthorized Access/Disclosure	Network Server, Paper/Films	No
Children's Dental Center at Preston Trail, P.C. d/b/a Park Place Pediatric Dentistry (Arlington, TX)	Healthcare Provider	1,690	14 Feb 2025	Theft	Laptop	No
BlueCross BlueShield of Tennessee, Inc.	Health Plan	1,676	19 Dec 2023	Hacking/IT Incident	Network Server	Yes
BlueCross BlueShield of Tennessee, Inc.	Business Associate	1,670	11 Feb 2026	Hacking/IT Incident	Network Server	Yes
Methodist Healthcare - Memphis Hospitals	Healthcare Provider	1,658	27 Oct 2025	Unauthorized Access/Disclosure	Electronic Medical Record	No
Centerstone	Healthcare Provider	1,537	2 Jul 2010	Theft	Desktop Computer, Paper/Films	No
United Neighborhood Health Services d/b/a Neighborhood Health	Healthcare Provider	1,519	22 Jun 2021	Hacking/IT Incident	Network Server	Yes
Robert Smith DMD, PC	Healthcare Provider	1,500	22 Jan 2018	Hacking/IT Incident	Network Server	No
PathGroup	Health Plan	1,443	29 Dec 2016	Unauthorized Access/Disclosure	Other	No
Volunteer State Health Plan, Inc. d/b/a BlueCare Tennessee	Business Associate	1,435	26 Feb 2021	Unauthorized Access/Disclosure	Other	Yes
FC Compassus, LLC	Healthcare Provider	1,383	31 May 2024	Hacking/IT Incident	Email	No
Windsor Health Plan	Business Associate	1,378	22 Jul 2011	Unauthorized Access/Disclosure	Paper/Films	Yes
Methodist Le Bonheur Healthcare	Healthcare Provider	1,370	2 May 2022	Unauthorized Access/Disclosure	Desktop Computer	No
Clinical & Forensic Consultation, LLC d/b/a Thriveworks Bristol, Johnson City, and Knoxville	Healthcare Provider	1,360	7 Oct 2020	Unauthorized Access/Disclosure	Email	No
Chattanooga C.A.R.E.S. d/b/a Cempa Community Care	Healthcare Provider	1,341	30 Jan 2026	Unauthorized Access/Disclosure	Other	Yes
BlueCross BlueShield of Tennessee, Inc.	Health Plan	1,340	18 Dec 2020	Hacking/IT Incident	Email	Yes
UTMP Surgical Oncology	Healthcare Provider	1,310	16 Aug 2021	Unauthorized Access/Disclosure	Paper/Films	No
PhyNet Dermatology, LLCOpen	Business Associate	1,308	29 Jul 2025	Hacking/IT Incident	Email	Yes
Quorum Health	Healthcare Provider	1,269	11 Aug 2019	Unauthorized Access/Disclosure	Email	No
BlueCross BlueShield of Tennessee, Inc. and Volunteer State Health Plan, Inc. d/b/a BlueCare Plus Tennessee	Health Plan	1,251	5 Mar 2024	Hacking/IT Incident	Network Server	No
Regional Medical Center	Healthcare Provider	1,180	7 May 2013	Unauthorized Access/Disclosure	Email	No
Monroe Operations, LLC d/b/a Newport Academy and Center for Families	Healthcare Provider	1,165	17 Aug 2018	Hacking/IT Incident	Email	No
University Urology, P.C.	Healthcare Provider	1,144	14 Apr 2014	Unauthorized Access/Disclosure	Paper/Films	No
Volunteer State Health Plan, Inc.	Health Plan	1,102	31 May 2012	Loss	Paper/Films	No
Health Incent, LLC	Healthcare Provider	1,100	11 Jul 2016	Hacking/IT Incident	Other	No
Center for a Brighter Tomorrow PLLC	Healthcare Provider	1,082	26 Sep 2022	Loss	Other Portable Electronic Device	No
Methodist University Emergency Physicians, PLLC	Healthcare Provider	1,070	16 Sep 2025	Hacking/IT Incident	Network Server	Yes
Tennova Healthcare Harton	Healthcare Provider	1,070	27 Apr 2020	Unauthorized Access/Disclosure	Paper/Films	Yes
FedEx Corporation Group Health PlanOpen	Health Plan	1,066	1 Dec 2025	Hacking/IT Incident	Network Server	Yes
RevSpring, Inc.	Business Associate	1,053	22 Dec 2023	Unauthorized Access/Disclosure	Network Server	Yes
Delta Specialty Hospital	Healthcare Provider	1,019	8 May 2024	Unauthorized Access/Disclosure	Email	No
State of TN Finance & Administration	Health Plan	947	27 May 2021	Unauthorized Access/Disclosure	Email	No
Open Arms Care CorporationOpen	Healthcare Provider	893	11 Jun 2026	Hacking/IT Incident	Email	No
CleanSlate Centers, Inc.	Healthcare Provider	890	16 Jul 2021	Hacking/IT Incident	Email	No
Cigna-HealthSpring	Health Plan	862	2 Apr 2015	Unauthorized Access/Disclosure	Paper/Films	No
Insured Recovery	Healthcare Provider	850	11 Dec 2024	Hacking/IT Incident	Network Server	No
NOL, LLC d/b/a Premier Radiology	Healthcare Provider	810	22 Jun 2011	Theft	Laptop	No
Center for Sports Medicine and Orthopedics	Healthcare Provider	800	26 Feb 2018	Unauthorized Access/Disclosure	Paper/Films	Yes
Emdeon	Business Associate	800	12 Sep 2014	Theft	Paper/Films	Yes
BlueCross BlueShield of Tennessee, Inc. and Volunteer State Health Plan, Inc. d/b/a BlueCare Plus Tennessee	Health Plan	790	15 Feb 2024	Hacking/IT Incident	Network Server	No
BlueCross BlueShield of Tennessee, Inc.	Business Associate	780	26 Dec 2025	Unauthorized Access/Disclosure	Email	Yes
Summit Medical Group, PLLC	Healthcare Provider	731	28 Sep 2011	Theft	Paper/Films	No
EMERGENCY COVERAGE CORPORATION	Healthcare Provider	719	20 Oct 2017	Loss	Paper/Films	No
BlueCross BlueShield of Tennessee, Inc.	Business Associate	717	5 Apr 2024	Unauthorized Access/Disclosure	Network Server	Yes
Advanced Diagnostic Imaging, P.C.	Healthcare Provider	705	22 Jun 2011	Theft	Laptop	No
Methodist North Emergency Physicians, PLLC	Healthcare Provider	699	16 Sep 2025	Hacking/IT Incident	Network Server	Yes
Memphis VA Medical Center	Healthcare Provider	687	1 Mar 2017	Unauthorized Access/Disclosure	Paper/Films	No
FEDERAL EXPRESS CORPORATION GROUP HEALTH PLAN FOR PILOTS	Health Plan	668	9 Sep 2022	Hacking/IT Incident	Network Server	Yes
Maxwell Aesthetics	Healthcare Provider	656	30 Jun 2020	Hacking/IT Incident	Desktop Computer	No
Cookeville Hospitalist Group, PLLC	Healthcare Provider	654	16 Sep 2025	Hacking/IT Incident	Network Server	Yes
Alive Hospice	Healthcare Provider	608	3 Jul 2019	Hacking/IT Incident	Email	No
Methodist South Emergency Physicians, PLLC	Healthcare Provider	601	16 Sep 2025	Hacking/IT Incident	Network Server	Yes
Ad Valorem Records, Inc.Open	Business Associate	590	11 Oct 2024	Unauthorized Access/Disclosure	Paper/Films	Yes
Tennessee Rural Health Improvement Association	Health Plan	588	8 Jun 2017	Loss	Paper/Films	Yes
Emdeon	Business Associate	566	4 Sep 2014	Theft	Paper/Films	Yes
Vanderbilt University Medical Center	Healthcare Provider	556	5 Jan 2022	Hacking/IT Incident	Email	Yes
FedEx Corporation Group Health Plan	Health Plan	553	24 Jan 2024	Hacking/IT Incident	Network Server	Yes
North Atlantic Telecom, Inc.	Business Associate	539	8 May 2013	Other	Desktop Computer	Yes
Alive Hospice	Healthcare Provider	533	6 Sep 2019	Unauthorized Access/Disclosure	Paper/Films	No
Unum Group, on behalf of its subsidiaries - Unum Life Insurance and Colonial Life & Accident Insurance	Health Plan	532	24 Jan 2019	Hacking/IT Incident	Email	No
AMERICAN RENAL MANAGEMENT	Business Associate	501	29 Apr 2024	Hacking/IT Incident	Network Server	Yes
Cookeville Regional Medical Center	Healthcare Provider	500	12 Sep 2025	Hacking/IT Incident	Network Server	No
Memphis Pathology Laboratory d/b/a American Esoteric Laboratory	Healthcare Provider	500	14 Dec 2017	Theft	Laptop	No
Phoenix Dental Care	Healthcare Provider	500	15 Aug 2016	Theft	Paper/Films	No
CHC MEMPHIS CMHC, LLC	Healthcare Provider	500	28 Jan 2011	Theft	Desktop Computer	No

Index / Companion schedules

13 HHS breach register

→

Hub: every filing, by state, year and entity.

04 Biggest breaches

→

Mega-breaches with primary-source cost figures.

Industry / Healthcare

→

IBM 2026: $6.64M average, 13 years at #1.

Regulation / HIPAA penalties

→

OCR enforcement tiers and the 60-day rule.

11 50-state laws

→

Deadline, AG threshold and penalties per state.

Cost / Per record

→

Where the per-record model is reliable.

Provenance

Source: U.S. Department of Health and Human Services, Office for Civil Rights, Breach Portal (breaches affecting 500 or more individuals), retrieved 2026-08-28. Public domain. Individuals affected and dates as reported by the covered entity.

Portal: ocrportal.hhs.gov breach report. Statutory basis: HITECH Act section 13402(e)(4): the Secretary must post a list of breaches of unsecured protected health information affecting 500 or more individuals. Breaches affecting fewer than 500 individuals are reported to OCR annually and are not posted, so they are not on this register. Status wording follows the portal's two tabs ("Cases Currently Under Investigation" and "Archive") as of 28 August 2026; a filing moves to the archive when OCR closes the case. Modelled costs on this site are a method applied to the reported count, using IBM Cost of a Data Breach per-record figures, and are never a cost disclosed by the entity.

Corrections: if you represent a listed entity and the portal row has been amended, email [email protected] with the portal entry and we will re-pull the export.