Healthcare data breaches cost $7.42M on average. Per record, $408.

The structural answer is that healthcare records carry a much richer payload than the data classes other sectors hold. A complete patient record contains name, address, date of birth, social security number, insurance ID, payer information, prescription history, diagnosis codes, provider notes, and frequently next-of-kin information. On underground markets that combination has historically priced at $250 to over $1,000 per record, against roughly $5 for a stolen credit card. The economic asymmetry is the foundation of every other cost driver.

The regulatory regime amplifies the underlying data sensitivity. The HIPAA Security Rule and Breach Notification Rule require covered entities to notify each affected individual, notify the Department of Health and Human Services Office for Civil Rights, and (for breaches affecting 500 or more individuals) notify prominent local media. The notification obligation alone produces a per-record letter cost of around $1 to $3 plus call-centre support of $20 to $80 per call handled. For a breach affecting 100,000 patients, baseline notification cost runs $200K to $400K before any regulator engagement.

Patient-care disruption is the most expensive line item that does not appear on a balance sheet until weeks later. When ransomware encrypts an electronic health record system, every patient appointment scheduled in that EHR has to be triaged manually, every prescription verified by paper chart, every insurance authorization rebuilt by phone. The ripple cost shows up across multiple cost categories: lost business (procedures rescheduled to competitors), post-breach response (overtime clinical staff), and detection-escalation (forensic and compliance investigation that has to run in parallel with the recovery operation). The Change Healthcare incident in 2024 illustrated this with brutal clarity, as the inability to process pharmacy claims left independent pharmacies and small medical practices unable to operate for weeks.

IBM's per-record figure of $408 is an aggregate of every cost the breached organisation incurred, divided by the number of compromised records. It includes detection and forensic investigation, notification, post-breach response activities such as credit monitoring and identity-protection enrolment, and the lost-business component covering customer churn and reputation damage. The figure is not a market price for stolen data, and it is not the cost paid by the affected patient. It is the per-record financial exposure carried by the breached entity.

The healthcare per-record cost has held above $400 for three consecutive IBM reports (2023, 2024, 2025), making it the most stable indicator in the dataset. Compared to other regulated sectors the gap is consistent: financial services sits at $228, technology at $196, retail at $142, government at $134. The persistence of the premium reflects the long-tail liability of PHI exposure rather than transient market conditions. Stolen credit-card numbers can be replaced within days of detection. A stolen genome or HIV diagnosis cannot be retracted.

For practical estimation, the per-record figure is most reliable when applied to mid-volume breaches of 10,000 to 1 million records. Below 10,000 records the fixed cost of forensics and legal counsel dominates, pushing effective per-record cost into the thousands. Above 1 million records the per-record cost declines because notification scale produces fixed-cost amortisation. Mega-breaches at the 100 million record scale typically show per-record cost in the $5 to $25 range, even though the totals are immense. Use the homepage calculator to model your specific record count instead of applying the $408 figure as a flat multiplier.

The HHS Office for Civil Rights is the principal federal enforcer of HIPAA. OCR maintains a public breach portal, frequently called the "Wall of Shame", listing every healthcare breach of 500 or more individuals. The OCR Breach Portal is the single most useful public dataset for benchmarking healthcare breach scale against your peer cohort. Resolution agreements that include monetary penalties are published as enforcement highlights on the OCR website.

HIPAA penalties operate on a four-tier civil monetary penalty structure introduced under the HITECH Act and adjusted annually for inflation. The current 2025 tier structure published in the Federal Register is approximately as follows: Tier 1 (lack of knowledge, $137 minimum to $68,928 per violation), Tier 2 (reasonable cause, $1,379 to $68,928), Tier 3 (willful neglect, corrected, $13,785 to $68,928), and Tier 4 (willful neglect, not corrected, $68,928 to $2,067,813 per violation). The cap per identical violation per calendar year is approximately $2.07M. Multiple distinct violations from a single incident can stack, which is how OCR settlements regularly reach mid-eight-figure totals.

Beyond OCR civil penalties, healthcare entities face state attorney-general actions that frequently exceed the federal penalty by an order of magnitude. The Anthem 2015 breach attracted a $39.5M multistate AG settlement on top of OCR's $16M HIPAA penalty (then a record) and $115M class-action settlement, for a total cost north of $260M. State AGs have grown more aggressive each year, with California, New York, and Texas leading volume.

Across IBM's 2025 dataset, the controls that produce the largest verified savings for healthcare entities are incident-response team retainer (around $2.66M average saving), AI and security automation deployed extensively (around $1.90M saving), employee security training that covers phishing recognition and basic data-handling discipline ($1.50M), and Zero Trust architecture ($1.50M). MFA enforcement on every account, especially clinical-staff accounts and contractor accounts, produces an $800K saving and is by far the highest-ROI control on a dollar-per-dollar basis.

Healthcare-specific overlays that compound the generic controls: network segmentation between clinical and corporate networks limits ransomware blast radius; encryption at rest with documented key-management practice insulates against safe-harbor exposure under most state breach notification laws; tabletop exercises that include the clinical leadership team (not only IT and security) materially reduce the response time for the patient-care components of the incident.

On the prevention pricing side, see PenetrationTestingCost.com for healthcare pen-test pricing benchmarks, PCIComplianceCost.com for the card-data side of healthcare billing operations, and EDRCost.com for endpoint detection pricing in clinical environments.