Geography
Virginia: 157 healthcare breach filings.
Virginia entities have reported 157 breaches of 500 or more individuals to HHS since 2009, the 20th most of the 52 states and territories on the register, covering 25,301,951 individuals (13th by people affected). 12 are still under investigation. Hacking/IT Incident is the breach type on 63% of them, and network server the most common location (53%).
Filings
157
20th of 52 states and territories
Individuals affected
25,301,951
Median filing 4,441
Largest filing
9,179,390
Maximus, Inc., 2023
Hacking / IT share
63%
61 filings involve a business associate
Direct answer / Virginia on the HHS portal
The largest Virginia filing is Maximus, Inc. (9,179,390 individuals, submitted 4 August 2023). The busiest year was 2022 with 24 filings. Healthcare Providers account for 69% of the state's filings. 57 filings of 10,000 or more individuals have their own page; the remaining 100 are listed in the table at the foot of this page.
Section VA.1 / Largest filings
Ten largest Virginia breaches
| # | Covered entity | Type | Individuals | Submitted | Breach type | Location | BA |
|---|---|---|---|---|---|---|---|
| 1 | Maximus, Inc. | Business Associate | 9,179,390 | 4 Aug 2023 | |||
| 2 | Science Applications International Corporation (SA | Business Associate | 4,900,000 | 4 Nov 2011 | |||
| 3 | Dominion Dental Services, Inc., Dominion National Insurance Company, and Dominion Dental Services USA, Inc. | Health Plan | 2,964,778 | 21 Jun 2019 | |||
| 4 | Radiology Associates of Richmond, Inc.Open | Healthcare Provider | 1,419,091 | 1 Jul 2025 | |||
| 5 | Virginia Department of Medical Assistance Services | Health Plan | 1,229,333 | 18 Sep 2023 | |||
| 6 | Inova Health System | Healthcare Provider | 1,045,270 | 9 Sep 2020 | |||
| 7 | Virginia Department of Medical Assistance Services (VA-DMAS) | Health Plan | 697,586 | 12 Mar 2015 | |||
| 8 | R&B Corporation of Virginia d/b/a Credit Control Corporation | Business Associate | 607,787 | 13 May 2023 | |||
| 9 | Virginia Department of Medical Assistance Services | Health Plan | 423,824 | 9 Aug 2023 | |||
| 10 | Med Atlantic, Inc. | Business Associate | 410,326 | 21 Nov 2025 |
Section VA.2 / By year
Virginia filings by submission year
Each year links to the national year page.
| Year | Filings | Individuals affected | Hacking / IT share | Filings with a page |
|---|---|---|---|---|
| 2009 | 1 | 83,000 | 0% | 1 |
| 2010 | 4 | 5,782 | 0% | 0 |
| 2011 | 4 | 4,916,682 | 0% | 2 |
| 2012 | 3 | 8,163 | 0% | 0 |
| 2013 | 3 | 18,352 | 0% | 1 |
| 2014 | 8 | 117,197 | 0% | 2 |
| 2015 | 3 | 702,276 | 67% | 1 |
| 2016 | 5 | 39,615 | 40% | 2 |
| 2017 | 4 | 22,426 | 25% | 0 |
| 2018 | 8 | 26,345 | 50% | 1 |
| 2019 | 6 | 2,997,946 | 67% | 3 |
| 2020 | 18 | 1,231,834 | 89% | 6 |
| 2021 | 15 | 277,743 | 87% | 7 |
| 2022 | 24 | 92,649 | 67% | 3 |
| 2023 | 14 | 11,748,582 | 79% | 8 |
| 2024 | 10 | 257,937 | 90% | 5 |
| 2025 | 16 | 2,310,471 | 75% | 11 |
| 2026 | 11 | 444,951 | 82% | 4 |
Section VA.3 / Composition
Breach type, location and who filed
Multi-valued fields count once per value.
Type of breach
Location of breached information
Covered entity type
Section VA.4 / Notification law
What Virginia law required alongside HIPAA
State notification statute
Virginia: Va. Code 18.2-186.6
- Notice to individuals
- Without unreasonable delay
- Attorney general threshold
- All breaches (concurrent with individual notice) (Concurrent with individual notification)
- Private right of action
- Limited: Individuals may recover direct economic damages (no non-economic damages)
- Penalty
- AG may impose civil penalties up to $150,000 per breach
The HIPAA Breach Notification Rule runs alongside the state statute: notice to affected individuals and to HHS without unreasonable delay and no later than 60 days after discovery.
Section VA.5 / Filing pages
57 filings of 10,000 or more individuals
Each links to a page with the full filing, its rank in the state and year, OCR's closing summary where the case is archived, peers, and the modelled cost.
Section VA.6 / All other filings
100 filings below 10,000 individuals
Listed in full from the HHS export, largest first. These filings do not have their own page.
| Covered entity | Type | Individuals | Submitted | Breach type | Location | BA |
|---|---|---|---|---|---|---|
| Averhealth HoldingsOpen | Healthcare Provider | 9,909 | 2 Jul 2026 | |||
| Valley Family Medicine | Healthcare Provider | 8,450 | 3 Nov 2017 | |||
| Kristina T Nguyen, DDS, PC | Healthcare Provider | 8,182 | 21 Dec 2020 | |||
| Capital Vision Services d/b/a MyEyeDr. (MED Southwest PLLC) | Healthcare Provider | 7,983 | 13 Feb 2020 | |||
| Goodwin Living Incorporated | Healthcare Provider | 7,170 | 29 Aug 2024 | |||
| Stafford Oral Surgery P.C. | Healthcare Provider | 7,019 | 15 May 2026 | |||
| The Foleck Center, LTD | Healthcare Provider | 6,965 | 22 Dec 2023 | |||
| Virtual Private Network Solutions, LLC d/b/a VPN Solutions, LLC | Business Associate | 6,400 | 30 Dec 2021 | |||
| Virginia Cancer Institute | Healthcare Provider | 6,258 | 2 Oct 2020 | |||
| Virginia Department of Medical Assistance Services | Health Plan | 6,120 | 31 Jan 2020 | |||
| Martinsville Henry County Coalition for Health and Wellness | Healthcare Provider | 5,806 | 13 Oct 2017 | |||
| Bon Secours Mary Immaculate Hospital | Healthcare Provider | 5,764 | 29 May 2013 | |||
| NOVA Chiropractic & Rehab Center | Healthcare Provider | 5,534 | 27 Mar 2014 | |||
| Sentara Healthcare | Healthcare Provider | 5,454 | 16 Jan 2017 | |||
| Grohler Hearing Aid Center, INC DBA Beltone Hearing Aid Centers | Healthcare Provider | 5,272 | 28 Apr 2023 | |||
| Garrisonville Dental L.L.C | Healthcare Provider | 5,204 | 15 May 2026 | |||
| Benefit Plan Administrators, Inc. | Business Associate | 5,004 | 22 Jul 2022 | |||
| Maximus, Inc. | Business Associate | 4,955 | 25 Apr 2025 | |||
| Valley Plastic Surgery, P.C. | Healthcare Provider | 4,873 | 13 Sep 2012 | |||
| VCU Health System | Healthcare Provider | 4,686 | 6 Jul 2018 | |||
| The Art & Science of Dermatology, P.C. | Healthcare Provider | 4,500 | 25 Feb 2022 | |||
| Virginia Commonwealth University Health System | Healthcare Provider | 4,441 | 27 May 2022 | |||
| Northern Virginia Oral, Maxillofacial & Implant Surgery | Healthcare Provider | 4,333 | 29 Mar 2024 | |||
| Virginia Department of Behavioral Health and Developmental Services | Healthcare Provider | 4,037 | 3 Dec 2021 | |||
| Benefits Administration Services, Inc. | Business Associate | 4,000 | 22 Sep 2011 | |||
| Sentara Healthcare | Healthcare Provider | 3,861 | 16 Jan 2014 | |||
| Dr. Kochurani Puthumana | Healthcare Provider | 3,805 | 30 Dec 2021 | |||
| Heartland Health Clinic | Healthcare Provider | 3,650 | 21 Sep 2015 | |||
| Fairfax Radiological Consultants | Healthcare Provider | 3,512 | 12 Jul 2024 | |||
| Defense Health Headquarters | Health Plan | 3,500 | 4 Oct 2019 | |||
| Care Advantage, Inc. | Healthcare Provider | 3,458 | 26 Feb 2014 | |||
| North Spring Behavioral Healthcare, Inc. | Healthcare Provider | 3,245 | 9 Nov 2021 | |||
| Augusta Health Care, Inc. d/b/a Augusta Health | Healthcare Provider | 3,061 | 11 Sep 2020 | |||
| MAXIMUS, Inc. / Business Ink, Co. | Business Associate | 3,029 | 17 Apr 2018 | |||
| Mediko, Inc. | Healthcare Provider | 2,809 | 31 Oct 2022 | |||
| Curtis R. Bryan, M.D. | Healthcare Provider | 2,739 | 8 Sep 2010 | |||
| Virginia Commonwealth University Health System | Healthcare Provider | 2,716 | 10 Mar 2017 | |||
| Williamsburg Area Medical Assistance Corporation d/b/a Olde Towne Medical and Dental Center (OTMDC)Open | Healthcare Provider | 2,567 | 13 Jul 2025 | |||
| PORTAL HEALTHCARE SOLUTIONS LLC | Business Associate | 2,360 | 4 Apr 2013 | |||
| Cancer Specialists of Tidewater | Healthcare Provider | 2,318 | 31 Jul 2014 | |||
| Chesapeake Regional Medical Center | Healthcare Provider | 2,100 | 6 Apr 2018 | |||
| Rockbridge Area Community Services Board | Healthcare Provider | 2,000 | 4 Oct 2021 | |||
| Linda J White, DDS, PC | Healthcare Provider | 2,000 | 27 Jun 2016 | |||
| University of Virginia Medical Center | Healthcare Provider | 1,882 | 21 Feb 2018 | |||
| TOWERS WATSON | Business Associate | 1,874 | 27 Apr 2010 | |||
| University of Virginia Medical Center | Healthcare Provider | 1,846 | 30 Nov 2012 | |||
| Inova Health System | Healthcare Provider | 1,680 | 22 Jan 2021 | |||
| Practice Transformation Solutions, LLC | Business Associate | 1,678 | 13 Oct 2020 | |||
| Personal Touch Hospice of VA, Inc. | Healthcare Provider | 1,657 | 28 Jan 2020 | |||
| Sentara Health | Healthcare Provider | 1,620 | 28 Mar 2025 | |||
| Defense Health Headquarters | Health Plan | 1,620 | 9 Sep 2020 | |||
| Verisma Systems, Inc. | Business Associate | 1,586 | 29 Dec 2022 | |||
| Fair Oaks Ortho P.C.Open | Healthcare Provider | 1,544 | 2 Feb 2026 | |||
| Benefit Plan Administrators, Inc. | Business Associate | 1,457 | 25 Jul 2022 | |||
| ACS, Affiliated Computer Services, Inc., A Xerox Company | Business Associate | 1,444 | 23 Jan 2012 | |||
| Virginia Department of Behavioral Health & Developmental Services | Healthcare Provider | 1,442 | 25 Oct 2019 | |||
| Defense Health AgencyOpen | Health Plan | 1,300 | 14 Apr 2026 | |||
| Defense Health Agency | Health Plan | 1,279 | 12 Oct 2022 | |||
| Benefit Plan Administrators, Inc. | Business Associate | 1,267 | 27 Jun 2022 | |||
| Inova Health System | Business Associate | 1,265 | 19 Nov 2018 | |||
| Lakewood Manor Baptist Retirement Community, Inc. d/b/a Lakewood | Healthcare Provider | 1,205 | 27 Sep 2021 | |||
| Benefit Plan Administrators, Inc. | Business Associate | 1,145 | 29 Jun 2022 | |||
| River City Insurance Group d/b/a Lavinder Group & Associates | Business Associate | 1,118 | 5 Apr 2022 | |||
| Zoe Therapy Services | Healthcare Provider | 1,100 | 23 Feb 2022 | |||
| Benefit Plan Administrators, Inc. | Business Associate | 1,089 | 8 Jul 2022 | |||
| Mount Vernon Dental Smiles | Healthcare Provider | 1,074 | 19 Jan 2024 | |||
| Vision Care Specialists, P.C. a part of MyEyeDr. Optometry of Colorado, PC | Healthcare Provider | 1,070 | 7 Feb 2020 | |||
| Sentara Healthcare | Healthcare Provider | 1,040 | 2 Oct 2015 | |||
| Verisma Systems, Inc. | Business Associate | 1,031 | 29 Dec 2022 | |||
| Practice Transformation Solutions, LLC | Business Associate | 1,016 | 2 Oct 2020 | |||
| Henrico Doctors Hospital | Healthcare Provider | 990 | 21 Feb 2023 | |||
| VA Department of Medical Assistance Services | Health Plan | 928 | 14 Sep 2023 | |||
| Riverside Medical Group | Healthcare Provider | 919 | 13 Jan 2014 | |||
| Thomas J. Hubbard, MD, Inc. DBA Hubbard Plastic Surgery & Skin Enhancement Center | Healthcare Provider | 914 | 7 Oct 2022 | |||
| Children's Hospital of The King's Daughters | Healthcare Provider | 914 | 11 Aug 2021 | |||
| SomnoSleep Consultants, LLC | Healthcare Provider | 913 | 24 Nov 2025 | |||
| Benefit Plan Administrators, Inc. | Business Associate | 878 | 8 Jul 2022 | |||
| Harrisonburg OB GYN Associates, P.C. | Healthcare Provider | 800 | 20 Oct 2016 | |||
| Sentara Healthcare | Healthcare Provider | 741 | 24 Feb 2023 | |||
| Benefit Plan Administrators, Inc. | Business Associate | 735 | 27 Jun 2022 | |||
| Homestead Building Systems | Health Plan | 727 | 21 Apr 2022 | |||
| Virginia Department of Behavioral Health and Developmental Services | Healthcare Provider | 724 | 7 Apr 2026 | |||
| Andersen Air Force Base, Guam | Healthcare Provider | 700 | 22 Jul 2011 | |||
| Sentara Health | Healthcare Provider | 696 | 3 Sep 2025 | |||
| SEVA Medical Group LLC | Healthcare Provider | 690 | 19 Jun 2023 | |||
| Sheltering Arms Physical Rehabilitation Centers | Healthcare Provider | 683 | 16 Sep 2020 | |||
| Prince William County Community Services (CS) | Healthcare Provider | 669 | 15 Jul 2010 | |||
| Virginia Department of Behavioral Health and Developmental Services | Healthcare Provider | 657 | 20 Mar 2020 | |||
| One Care Medical, LLC | Healthcare Provider | 651 | 6 Aug 2019 | |||
| Benefit Plan Administrators, Inc. | Business Associate | 628 | 30 Jun 2022 | |||
| Genetics & IVF Institute | Healthcare Provider | 606 | 11 May 2022 | |||
| Sentara Williamsburg Regional Medical Center | Healthcare Provider | 591 | 1 Aug 2022 | |||
| Universal Health Corporation | Healthcare Provider | 583 | 6 Nov 2024 | |||
| Riverside Health System | Healthcare Provider | 578 | 10 Jun 2016 | |||
| Southwest Virginia Physicians for Women | Healthcare Provider | 568 | 10 Oct 2014 | |||
| Wardell Orthopaedics, P.C. | Healthcare Provider | 552 | 16 Aug 2018 | |||
| Belmont Aesthetic and Reconstructive Plastic SurgeryOpen | Healthcare Provider | 528 | 23 Apr 2026 | |||
| Health Care Administrative Services | Healthcare Provider | 500 | 20 May 2022 | |||
| Family Physicians of Old Town Fairfax PC | Healthcare Provider | 500 | 19 Jul 2018 | |||
| Rockbridge Area Community Services | Healthcare Provider | 500 | 29 Apr 2010 |
Index / Other states
Every state on the register
98
32
164
92
776
139
144
31
33
463
226
22
29
358
200
98
80
124
66
37
170
241
238
189
55
164
36
60
55
38
174
57
511
207
19
276
80
120
339
32
41
86
15
196
633
68
15
185
47
126
19
Index / Companion schedules
13 HHS breach register
→Hub: every filing, by state, year and entity.
04 Biggest breaches
→Mega-breaches with primary-source cost figures.
Industry / Healthcare
→IBM 2026: $6.64M average, 13 years at #1.
Regulation / HIPAA penalties
→OCR enforcement tiers and the 60-day rule.
11 50-state laws
→Deadline, AG threshold and penalties per state.
Cost / Per record
→Where the per-record model is reliable.
Provenance
Source: U.S. Department of Health and Human Services, Office for Civil Rights, Breach Portal (breaches affecting 500 or more individuals), retrieved 2026-08-28. Public domain. Individuals affected and dates as reported by the covered entity.
Portal: ocrportal.hhs.gov breach report. Statutory basis: HITECH Act section 13402(e)(4): the Secretary must post a list of breaches of unsecured protected health information affecting 500 or more individuals. Breaches affecting fewer than 500 individuals are reported to OCR annually and are not posted, so they are not on this register. Status wording follows the portal's two tabs ("Cases Currently Under Investigation" and "Archive") as of 28 August 2026; a filing moves to the archive when OCR closes the case. Modelled costs on this site are a method applied to the reported count, using IBM Cost of a Data Breach per-record figures, and are never a cost disclosed by the entity.
Corrections: if you represent a listed entity and the portal row has been amended, email [email protected] with the portal entry and we will re-pull the export.