Public record
Every HIPAA breach of 500 or more, since 2009.
The HHS Office for Civil Rights must post every breach of unsecured protected health information that affects 500 or more individuals. This register rebuilds that list as browsable pages: 50 states plus DC and Puerto Rico, 18 years, 2,729 filing pages for breaches of 10,000 or more individuals, and a modelled cost on each, with the method shown.
Filings on the portal
7,927
737 under investigation, 7,190 archived
Individuals affected
1.09B
1,091,520,080, the sum of every filing as reported
Largest single filing
192,700,000
Change Healthcare, Inc., 2024
Hacking / IT incidents
60%
4,763 filings carry the type
Direct answer / What the HHS breach portal shows
As of 10 September 2026 the portal lists 7,927 breaches affecting 500 or more individuals, submitted between 2009 and 2026. The largest is Change Healthcare, Inc. (192,700,000 individuals, 2024); California has filed the most (777); 2,374 filings (30%) involve a business associate; and 804 filings were submitted in 2025 alone. Counts and dates are as reported by the covered entity; nothing here is estimated except the clearly labelled modelled cost.
Lookup / Search the register
Find an organisation on the HHS portal
Type any part of a covered entity or business associate name. The search runs in your browser over all 7,927 filings on the register as of 10 September 2026, 2009 to 2026, and returns what HHS published: state, submission date, individuals affected as reported, breach type and entity type.
52 states and territories
2009 to 2026
Source: HHS OCR breach portal export retrieved 10 September 2026. 7,927 filings, 2,729 of them at or above 10,000 individuals with a page of their own. Counts are as reported by the entity; no cost figure is shown here.
Section 13.1 / Latest filings
The twenty most recent submissions
Newest first, by breach submission date. Filings marked Open sit on the portal's "Cases Currently Under Investigation" tab; filings of 10,000 or more individuals link to their own page.
| Covered entity | State | Type | Individuals | Submitted | Breach type | Location | BA |
|---|---|---|---|---|---|---|---|
| AnMed HealthOpen | SC | Healthcare Provider | 501 | 27 Aug 2026 | |||
| Magnolia Medical Clinic PAOpen | FL | Healthcare Provider | 1,601 | 25 Aug 2026 | |||
| North Dakota Department of Health and Human Services, Developmental Disabilities SectionOpen | ND | Healthcare Provider | 1,750 | 21 Aug 2026 | |||
| Baraga County Memorial HospitalOpen | MI | Healthcare Provider | 501 | 21 Aug 2026 | |||
| AdaptHealth, LLCOpen | PA | Healthcare Provider | 4,115,802 | 14 Aug 2026 | |||
| Baylor GeneticsOpen | TX | Healthcare Provider | 2,810,878 | 14 Aug 2026 | |||
| Midwest Spine & Brain InstituteOpen | MN | Healthcare Provider | 108,487 | 14 Aug 2026 | |||
| Mountain Rheumatology Professional, LLCOpen | CO | Healthcare Provider | 5,378 | 14 Aug 2026 | |||
| Gardiner Family Chiropractic, PCOpen | ME | Healthcare Provider | 5,000 | 14 Aug 2026 | |||
| Integrative Emergency Services, LLCOpen | TX | Business Associate | 2,009 | 14 Aug 2026 | |||
| Well Child, Inc.Open | TN | Healthcare Provider | 500 | 14 Aug 2026 | |||
| BestCare Treatment Services, Inc.Open | IL | Healthcare Provider | 4,216 | 13 Aug 2026 | |||
| Community Health Care, Inc.Open | OH | Healthcare Provider | 808 | 11 Aug 2026 | |||
| Longview ER Operations, LLCOpen | TX | Healthcare Provider | 501 | 11 Aug 2026 | |||
| Westchester Institute for Human Development, Inc.Open | NY | Healthcare Provider | 938 | 10 Aug 2026 | |||
| Indico Data Solutions, Inc.Open | MA | Business Associate | 4,840 | 7 Aug 2026 | |||
| Central Arkansas Pediatrics, P.A.Open | AR | Healthcare Provider | 1,500 | 7 Aug 2026 | |||
| Deseye, PLLC d/b/a Princeton Family Eye CareOpen | TX | Healthcare Provider | 1,050 | 7 Aug 2026 | |||
| Horizon Eye Care Laser & Eye Surgery CenterOpen | NJ | Healthcare Provider | 501 | 7 Aug 2026 | |||
| NFI North, Inc.Open | NH | Healthcare Provider | 49,540 | 5 Aug 2026 |
Section 13.2 / Largest filings
Fifteen largest breaches on the portal
Ranked by individuals affected as reported at submission. 152 filings involve one million or more people; 805 involve 100,000 or more.
Two of these have full editorial case files with disclosed costs: Anthem 2015 and Change Healthcare 2024. The rest of the mega-breach register is cross-sector and not HIPAA-specific.
Section 13.3 / By state
52 state and territory pages
Each state page carries every filing from that state as a table, counts by year and breach type, the state's own notification statute, and links to the filing pages. State is the covered entity's registered state, not where the affected people live.
100 filings, 14,148,981 affected
32 filings, 925,719 affected
164 filings, 16,196,141 affected
94 filings, 2,597,059 affected
777 filings, 79,756,006 affected
140 filings, 29,369,166 affected
144 filings, 11,295,626 affected
31 filings, 5,339,813 affected
33 filings, 685,611 affected
465 filings, 53,916,202 affected
226 filings, 38,854,537 affected
23 filings, 568,441 affected
30 filings, 1,455,204 affected
361 filings, 22,560,060 affected
200 filings, 93,061,324 affected
99 filings, 6,612,832 affected
81 filings, 2,077,430 affected
124 filings, 11,757,126 affected
66 filings, 4,437,665 affected
39 filings, 3,296,092 affected
170 filings, 19,168,200 affected
242 filings, 28,044,799 affected
239 filings, 16,123,410 affected
191 filings, 211,834,620 affected
55 filings, 2,459,630 affected
164 filings, 17,507,373 affected
36 filings, 1,865,004 affected
60 filings, 5,403,241 affected
55 filings, 12,507,230 affected
39 filings, 1,160,944 affected
176 filings, 79,983,967 affected
57 filings, 4,378,605 affected
512 filings, 42,250,776 affected
207 filings, 28,689,174 affected
21 filings, 823,546 affected
278 filings, 18,927,883 affected
81 filings, 6,101,176 affected
120 filings, 5,405,904 affected
340 filings, 21,197,187 affected
32 filings, 1,712,827 affected
41 filings, 544,697 affected
87 filings, 2,631,488 affected
15 filings, 178,652 affected
197 filings, 39,364,041 affected
641 filings, 49,597,062 affected
68 filings, 7,085,448 affected
15 filings, 200,270 affected
158 filings, 25,324,969 affected
186 filings, 23,287,447 affected
47 filings, 1,849,107 affected
126 filings, 12,726,197 affected
19 filings, 287,419 affected
23 filings carry no state in the HHS export (Puerto Rico, Guam and US Virgin Islands entities); they appear on the year pages under "State not given".
Section 13.4 / By year
2009 to 2026, year by year
Filings per submission year with the sum of individuals affected and the share recorded as Hacking/IT Incident. 2026 is a partial year to 27 August 2026.
| Year | Filings | Individuals affected | Hacking / IT share | Filings with a page |
|---|---|---|---|---|
| 2009 | 18 | 134,773 | 0% | 2 |
| 2010 | 199 | 5,932,276 | 4% | 41 |
| 2011 | 200 | 13,162,158 | 9% | 42 |
| 2012 | 218 | 2,854,525 | 8% | 38 |
| 2013 | 277 | 7,018,839 | 10% | 43 |
| 2014 | 314 | 19,073,551 | 12% | 78 |
| 2015 | 270 | 112,466,720 | 21% | 50 |
| 2016 | 328 | 16,711,004 | 35% | 83 |
| 2017 | 358 | 5,314,987 | 42% | 84 |
| 2018 | 369 | 15,256,235 | 45% | 103 |
| 2019 | 511 | 44,969,724 | 61% | 159 |
| 2020 | 663 | 35,321,223 | 69% | 251 |
| 2021 | 715 | 61,206,238 | 76% | 283 |
| 2022 | 718 | 64,053,662 | 79% | 331 |
| 2023 | 746 | 183,266,304 | 82% | 338 |
| 2024 | 741 | 290,054,222 | 83% | 338 |
| 2025 | 804 | 140,514,189 | 81% | 313 |
| 2026 | 478 | 74,209,450 | 86% | 152 |
Section 13.5 / Composition
Who files, how the data was breached, where it sat
Multi-valued fields (a filing can list two breach types or several locations) count once per value, so shares can sum above 100%.
Covered entity type
Type of breach
Location of breached information
Section 13.6 / The modelled cost
A method on every filing page, never a disclosed figure
HHS publishes the number of individuals affected and nothing about cost. Each filing page therefore multiplies that number by IBM's customer-PII cost per record, $160 in the Cost of a Data Breach Report 2025 (the figure this site's calculator uses) and $192 in the 2026 edition, and labels the result a modelled estimate with the method shown. A 10,000-person filing models at $1.60M and $1.92M; IBM's 2026 average cost of a healthcare breach is $6.64M.
The model is only shown as an estimate inside the range where IBM's per-record figure behaves: above roughly 100,000 records the page stamps it an upper bound, because fixed costs are spread across far more records at that scale and IBM itself cautions against multiplying per-record figures across breaches involving millions of records. Change Healthcare's disclosed $2.45B against 192.7 million individuals is the standing example of why.
Section 13.7 / How a breach reaches the portal
500 individuals, 60 days, one public list
Threshold
A breach of unsecured protected health information affecting 500 or more individuals must be reported to HHS; smaller breaches are logged and reported annually and never appear here.
Clock
Notice to affected individuals and to HHS without unreasonable delay and no later than 60 days after discovery. The submission date on each filing is when that notice reached OCR, not when the breach happened.
Two tabs
New filings sit under Cases Currently Under Investigation; when OCR closes the case the row moves to the archive and usually gains a short closing summary of what was exposed and what the entity did. 7,008 archived filings carry one.
Index / Companion schedules
04 Biggest breaches
→Cross-sector mega-breaches with primary-source cost figures: Equifax, Yahoo, Change Healthcare, MOVEit.
Industry / Healthcare
→IBM 2026: $6.64M average, the costliest sector for the thirteenth consecutive year.
Regulation / HIPAA penalties
→OCR enforcement tiers, settlements and the notification rule behind this register.
11 50-state laws
→State statute, deadline, AG threshold and penalties for every state on the register.
Cost / Per record
→The $160 and $192 figures behind the modelled cost, and where they stop being reliable.
02 Statistics
→IBM headline figures that contextualise the register.
Provenance
Source: U.S. Department of Health and Human Services, Office for Civil Rights, Breach Portal (breaches affecting 500 or more individuals), retrieved 2026-09-10. Public domain. Individuals affected and dates as reported by the covered entity.
Portal: ocrportal.hhs.gov breach report. Statutory basis: HITECH Act section 13402(e)(4): the Secretary must post a list of breaches of unsecured protected health information affecting 500 or more individuals. Breaches affecting fewer than 500 individuals are reported to OCR annually and are not posted, so they are not on this register. Status wording follows the portal's two tabs ("Cases Currently Under Investigation" and "Archive") as of 10 September 2026; a filing moves to the archive when OCR closes the case. Modelled costs on this site are a method applied to the reported count, using IBM Cost of a Data Breach per-record figures, and are never a cost disclosed by the entity. Export files: hhs-breach-under-investigation__2026-09-10.csv (737 rows); hhs-breach-archive__2026-09-10.csv (7,190 rows).
Corrections: if you represent a listed entity and the portal row has been amended, email questions@databreachcost.com with the portal entry and we will re-pull the export.
Schedule F / Reference Q&A