Time
2009: 18 breach filings.
18 breaches of 500 or more individuals were submitted to HHS in 2009, affecting 134,773 individuals. 0% were hacking or IT incidents; 3 involved a business associate; California filed the most (8). 0 remain under investigation.
Filings
18
First year of the portal
Individuals affected
134,773
Median filing 2,000
Largest filing
83,000
Democracy Data & Communications, LLC (, VA
Hacking / IT share
0%
0 filings
Every year on the register
Section 2009.1 / Largest filings
Fifteen largest breaches submitted in 2009
| # | Covered entity | State | Type | Individuals | Submitted | Breach type | Location | BA |
|---|---|---|---|---|---|---|---|---|
| 1 | Democracy Data & Communications, LLC ( | VA | Business Associate | 83,000 | 8 Dec 2009 | |||
| 2 | Detroit Department of Health and Wellness Promotion | MI | Healthcare Provider | 10,000 | 15 Dec 2009 | |||
| 3 | Cogent Healthcare, Inc. | TN | Business Associate | 6,400 | 25 Nov 2009 | |||
| 4 | Michele Del Vicario, MD | CA | Healthcare Provider | 6,145 | 20 Nov 2009 | |||
| 5 | City of Hope National Medical Center | CA | Healthcare Provider | 5,900 | 23 Nov 2009 | |||
| 6 | L. Douglas Carlson, M.D. | CA | Healthcare Provider | 5,257 | 20 Nov 2009 | |||
| 7 | Mark D. Lurie, MD | CA | Healthcare Provider | 5,166 | 20 Nov 2009 | |||
| 8 | Health Services for Children with Special Needs, Inc. | DC | Health Plan | 3,800 | 17 Nov 2009 | |||
| 9 | Rick Lawson, Professional Computer Services | NC | Business Associate | 2,000 | 11 Dec 2009 | |||
| 10 | Mid America Kidney Stone Association, LLC | MO | Healthcare Provider | 1,000 | 28 Oct 2009 | |||
| 11 | Brooke Army Medical Center | TX | Healthcare Provider | 1,000 | 21 Oct 2009 | |||
| 12 | Joseph F. Lopez, MD | CA | Healthcare Provider | 952 | 20 Nov 2009 | |||
| 13 | The Children's Hospital of Philadelphia | PA | Healthcare Provider | 943 | 24 Nov 2009 | |||
| 14 | David I. Cohen, MD | CA | Healthcare Provider | 857 | 20 Nov 2009 | |||
| 15 | Detroit Department of Health and Wellness Promotion | MI | Healthcare Provider | 646 | 15 Dec 2009 |
Section 2009.2 / Composition
Breach type, location, filer type and state
Multi-valued fields count once per value.
Type of breach
Location of breached information
Covered entity type
States with the most filings
Section 2009.3 / Filing pages
2 filings of 10,000 or more individuals
Largest first. Each links to a page with the full filing, ranks, OCR's closing summary where archived, peers and the modelled cost.
| Covered entity | State | Type | Individuals | Submitted | Breach type | Location | BA |
|---|---|---|---|---|---|---|---|
| Democracy Data & Communications, LLC ( | VA | Business Associate | 83,000 | 8 Dec 2009 | |||
| Detroit Department of Health and Wellness Promotion | MI | Healthcare Provider | 10,000 | 15 Dec 2009 |
Section 2009.4 / All other filings
16 filings below 10,000 individuals
Listed in full from the HHS export, largest first.
| Covered entity | State | Type | Individuals | Submitted | Breach type | Location | BA |
|---|---|---|---|---|---|---|---|
| Cogent Healthcare, Inc. | TN | Business Associate | 6,400 | 25 Nov 2009 | |||
| Michele Del Vicario, MD | CA | Healthcare Provider | 6,145 | 20 Nov 2009 | |||
| City of Hope National Medical Center | CA | Healthcare Provider | 5,900 | 23 Nov 2009 | |||
| L. Douglas Carlson, M.D. | CA | Healthcare Provider | 5,257 | 20 Nov 2009 | |||
| Mark D. Lurie, MD | CA | Healthcare Provider | 5,166 | 20 Nov 2009 | |||
| Health Services for Children with Special Needs, Inc. | DC | Health Plan | 3,800 | 17 Nov 2009 | |||
| Rick Lawson, Professional Computer Services | NC | Business Associate | 2,000 | 11 Dec 2009 | |||
| Mid America Kidney Stone Association, LLC | MO | Healthcare Provider | 1,000 | 28 Oct 2009 | |||
| Brooke Army Medical Center | TX | Healthcare Provider | 1,000 | 21 Oct 2009 | |||
| Joseph F. Lopez, MD | CA | Healthcare Provider | 952 | 20 Nov 2009 | |||
| The Children's Hospital of Philadelphia | PA | Healthcare Provider | 943 | 24 Nov 2009 | |||
| David I. Cohen, MD | CA | Healthcare Provider | 857 | 20 Nov 2009 | |||
| Detroit Department of Health and Wellness Promotion | MI | Healthcare Provider | 646 | 15 Dec 2009 | |||
| University of California, San Francisco | CA | Healthcare Provider | 610 | 15 Dec 2009 | |||
| Kern Medical Center | CA | Healthcare Provider | 596 | 10 Dec 2009 | |||
| Alaska Department of Health and Social Services | AK | Healthcare Provider | 501 | 30 Oct 2009 |
Index / Companion schedules
13 HHS breach register
→Hub: every filing, by state, year and entity.
04 Biggest breaches
→Mega-breaches with primary-source cost figures.
Industry / Healthcare
→IBM 2026: $6.64M average, 13 years at #1.
Regulation / HIPAA penalties
→OCR enforcement tiers and the 60-day rule.
11 50-state laws
→Deadline, AG threshold and penalties per state.
Cost / Per record
→Where the per-record model is reliable.
Provenance
Source: U.S. Department of Health and Human Services, Office for Civil Rights, Breach Portal (breaches affecting 500 or more individuals), retrieved 2026-08-28. Public domain. Individuals affected and dates as reported by the covered entity.
Portal: ocrportal.hhs.gov breach report. Statutory basis: HITECH Act section 13402(e)(4): the Secretary must post a list of breaches of unsecured protected health information affecting 500 or more individuals. Breaches affecting fewer than 500 individuals are reported to OCR annually and are not posted, so they are not on this register. Status wording follows the portal's two tabs ("Cases Currently Under Investigation" and "Archive") as of 28 August 2026; a filing moves to the archive when OCR closes the case. Modelled costs on this site are a method applied to the reported count, using IBM Cost of a Data Breach per-record figures, and are never a cost disclosed by the entity.
Corrections: if you represent a listed entity and the portal row has been amended, email [email protected] with the portal entry and we will re-pull the export.