Public record
Every HIPAA breach of 500 or more, since 2009.
The HHS Office for Civil Rights must post every breach of unsecured protected health information that affects 500 or more individuals. This register rebuilds that list as browsable pages: 50 states plus DC and Puerto Rico, 18 years, 2,794 filing pages for breaches of 10,000 or more individuals, and a modelled cost on each, with the method shown.
Filings on the portal
8,092
732 under investigation, 7,360 archived
Individuals affected
1.11B
1,109,007,370, the sum of every filing as reported
Largest single filing
192,700,000
Change Healthcare, Inc., 2024
Hacking / IT incidents
61%
4,900 filings carry the type
Direct answer / What the HHS breach portal shows
As of 12 November 2026 the portal lists 8,092 breaches affecting 500 or more individuals, submitted between 2009 and 2026. The largest is Change Healthcare, Inc. (192,700,000 individuals, 2024); California has filed the most (792); 2,423 filings (30%) involve a business associate; and 811 filings were submitted in 2025 alone. Counts and dates are as reported by the covered entity; nothing here is estimated except the clearly labelled modelled cost.
Lookup / Search the register
Find an organisation on the HHS portal
Type any part of a covered entity or business associate name. The search runs in your browser over all 8,092 filings on the register as of 12 November 2026, 2009 to 2026, and returns what HHS published: state, submission date, individuals affected as reported, breach type and entity type.
52 states and territories
2009 to 2026
Source: HHS OCR breach portal export retrieved 12 November 2026. 8,092 filings, 2,794 of them at or above 10,000 individuals with a page of their own. Counts are as reported by the entity; no cost figure is shown here.
Section 13.1 / Latest filings
The twenty most recent submissions
Newest first, by breach submission date. Filings marked Open sit on the portal's "Cases Currently Under Investigation" tab; filings of 10,000 or more individuals link to their own page.
| Covered entity | State | Type | Individuals | Submitted | Breach type | Location | BA |
|---|---|---|---|---|---|---|---|
| Central Ohio Primary Care Physicians, Inc. (COPC)Open | OH | Healthcare Provider | 1,351,650 | 16 Oct 2026 | |||
| Rose Poney, LCMHC; Restoration Counseling LLCOpen | VT | Healthcare Provider | 662 | 16 Oct 2026 | |||
| Lisa Jo Adornetto, DDS, PAOpen | NC | Healthcare Provider | 2,000 | 15 Oct 2026 | |||
| Minnesota Epilepsy Group, P.A.Open | MN | Healthcare Provider | 82,574 | 14 Oct 2026 | |||
| Dorsata, Inc.Open | VA | Business Associate | 58,249 | 14 Oct 2026 | |||
| Cohesity, Inc.Open | CA | Health Plan | 916 | 13 Oct 2026 | |||
| Hospice of Murray County Inc.Open | MN | Healthcare Provider | 800 | 13 Oct 2026 | |||
| Capitol Pain InstituteOpen | TX | Healthcare Provider | 666 | 13 Oct 2026 | |||
| NorthShore Health CentersOpen | IN | Healthcare Provider | 501 | 13 Oct 2026 | |||
| Arkansas Hospice Inc. dba LifeTouch HealthOpen | AR | Healthcare Provider | 38,629 | 12 Oct 2026 | |||
| Photon HealthOpen | NY | Business Associate | 30,625 | 9 Oct 2026 | |||
| Blended Health Services, LLCOpen | TX | Healthcare Provider | 707 | 9 Oct 2026 | |||
| Allswell Health Medical Group PAOpen | CA | Healthcare Provider | 638 | 9 Oct 2026 | |||
| Liberty Healthcare Group, LLCOpen | NC | Healthcare Provider | 501 | 9 Oct 2026 | |||
| Cognitive Health Technologies LLCOpen | NY | Business Associate | 49,467 | 8 Oct 2026 | |||
| Hood River DentalOpen | OR | Healthcare Provider | 16,609 | 8 Oct 2026 | |||
| Hood River DentalOpen | OR | Healthcare Provider | 14,677 | 8 Oct 2026 | |||
| Anup K. Deol, OD PS d/b/a Eye Care Center of SnohomishOpen | WA | Healthcare Provider | 3,059 | 8 Oct 2026 | |||
| AllCare Health, Inc.Open | OR | Health Plan | 782 | 8 Oct 2026 | |||
| Ant Farm II, LLCOpen | GA | Business Associate | 608 | 8 Oct 2026 |
Section 13.2 / Largest filings
Fifteen largest breaches on the portal
Ranked by individuals affected as reported at submission. 154 filings involve one million or more people; 825 involve 100,000 or more.
Two of these have full editorial case files with disclosed costs: Anthem 2015 and Change Healthcare 2024. The rest of the mega-breach register is cross-sector and not HIPAA-specific.
Section 13.3 / By state
52 state and territory pages
Each state page carries every filing from that state as a table, counts by year and breach type, the state's own notification statute, and links to the filing pages. State is the covered entity's registered state, not where the affected people live.
101 filings, 14,149,604 affected
33 filings, 935,038 affected
167 filings, 16,232,820 affected
96 filings, 2,643,627 affected
792 filings, 89,175,035 affected
144 filings, 29,625,843 affected
146 filings, 11,380,761 affected
32 filings, 5,341,160 affected
34 filings, 741,808 affected
478 filings, 54,215,253 affected
232 filings, 38,872,991 affected
24 filings, 614,294 affected
32 filings, 1,543,757 affected
366 filings, 22,595,635 affected
207 filings, 93,127,105 affected
102 filings, 6,649,545 affected
84 filings, 2,102,421 affected
124 filings, 11,757,126 affected
67 filings, 4,438,165 affected
39 filings, 3,296,092 affected
172 filings, 19,570,764 affected
245 filings, 28,784,150 affected
242 filings, 16,165,048 affected
197 filings, 212,327,388 affected
56 filings, 2,465,767 affected
169 filings, 17,599,407 affected
37 filings, 2,123,924 affected
60 filings, 5,402,377 affected
55 filings, 12,507,230 affected
42 filings, 1,336,911 affected
177 filings, 79,985,058 affected
57 filings, 4,378,605 affected
523 filings, 42,953,579 affected
213 filings, 28,699,969 affected
21 filings, 823,546 affected
282 filings, 20,567,475 affected
83 filings, 6,107,720 affected
123 filings, 5,440,197 affected
347 filings, 21,213,077 affected
32 filings, 1,712,827 affected
41 filings, 544,697 affected
87 filings, 2,631,488 affected
15 filings, 178,652 affected
201 filings, 40,062,379 affected
662 filings, 50,561,258 affected
68 filings, 7,085,448 affected
17 filings, 202,340 affected
161 filings, 25,412,265 affected
190 filings, 23,878,404 affected
49 filings, 1,850,823 affected
126 filings, 12,722,346 affected
19 filings, 287,419 affected
23 filings carry no state in the HHS export (Puerto Rico, Guam and US Virgin Islands entities); they appear on the year pages under "State not given".
Section 13.4 / By year
2009 to 2026, year by year
Filings per submission year with the sum of individuals affected and the share recorded as Hacking/IT Incident. 2026 is a partial year to 16 October 2026.
| Year | Filings | Individuals affected | Hacking / IT share | Filings with a page |
|---|---|---|---|---|
| 2009 | 18 | 134,773 | 0% | 2 |
| 2010 | 199 | 5,932,276 | 4% | 41 |
| 2011 | 200 | 13,162,158 | 9% | 42 |
| 2012 | 218 | 2,854,525 | 8% | 38 |
| 2013 | 277 | 7,018,839 | 10% | 43 |
| 2014 | 314 | 19,073,551 | 12% | 78 |
| 2015 | 270 | 112,466,720 | 21% | 50 |
| 2016 | 328 | 16,711,004 | 35% | 83 |
| 2017 | 358 | 5,314,987 | 42% | 84 |
| 2018 | 369 | 15,256,235 | 45% | 103 |
| 2019 | 511 | 44,969,724 | 61% | 159 |
| 2020 | 663 | 35,321,223 | 69% | 251 |
| 2021 | 715 | 61,206,238 | 76% | 283 |
| 2022 | 718 | 64,570,326 | 79% | 331 |
| 2023 | 745 | 183,256,225 | 81% | 337 |
| 2024 | 741 | 290,088,141 | 83% | 338 |
| 2025 | 811 | 141,747,246 | 81% | 321 |
| 2026 | 637 | 89,923,179 | 86% | 210 |
Section 13.5 / Composition
Who files, how the data was breached, where it sat
Multi-valued fields (a filing can list two breach types or several locations) count once per value, so shares can sum above 100%.
Covered entity type
Type of breach
Location of breached information
Section 13.6 / The modelled cost
A method on every filing page, never a disclosed figure
HHS publishes the number of individuals affected and nothing about cost. Each filing page therefore multiplies that number by IBM's customer-PII cost per record, $160 in the Cost of a Data Breach Report 2025 (the figure this site's calculator uses) and $192 in the 2026 edition, and labels the result a modelled estimate with the method shown. A 10,000-person filing models at $1.60M and $1.92M; IBM's 2026 average cost of a healthcare breach is $6.64M.
The model is only shown as an estimate inside the range where IBM's per-record figure behaves: above roughly 100,000 records the page stamps it an upper bound, because fixed costs are spread across far more records at that scale and IBM itself cautions against multiplying per-record figures across breaches involving millions of records. Change Healthcare's disclosed $2.45B against 192.7 million individuals is the standing example of why.
Section 13.7 / How a breach reaches the portal
500 individuals, 60 days, one public list
Threshold
A breach of unsecured protected health information affecting 500 or more individuals must be reported to HHS; smaller breaches are logged and reported annually and never appear here.
Clock
Notice to affected individuals and to HHS without unreasonable delay and no later than 60 days after discovery. The submission date on each filing is when that notice reached OCR, not when the breach happened.
Two tabs
New filings sit under Cases Currently Under Investigation; when OCR closes the case the row moves to the archive and usually gains a short closing summary of what was exposed and what the entity did. 7,146 archived filings carry one.
Index / Companion schedules
04 Biggest breaches
→Cross-sector mega-breaches with primary-source cost figures: Equifax, Yahoo, Change Healthcare, MOVEit.
Industry / Healthcare
→IBM 2026: $6.64M average, the costliest sector for the thirteenth consecutive year.
Regulation / HIPAA penalties
→OCR enforcement tiers, settlements and the notification rule behind this register.
11 50-state laws
→State statute, deadline, AG threshold and penalties for every state on the register.
Cost / Per record
→The $160 and $192 figures behind the modelled cost, and where they stop being reliable.
02 Statistics
→IBM headline figures that contextualise the register.
Provenance
Source: U.S. Department of Health and Human Services, Office for Civil Rights, Breach Portal (breaches affecting 500 or more individuals), retrieved 2026-11-12. Public domain. Individuals affected and dates as reported by the covered entity.
Portal: ocrportal.hhs.gov breach report. Statutory basis: HITECH Act section 13402(e)(4): the Secretary must post a list of breaches of unsecured protected health information affecting 500 or more individuals. Breaches affecting fewer than 500 individuals are reported to OCR annually and are not posted, so they are not on this register. Status wording follows the portal's two tabs ("Cases Currently Under Investigation" and "Archive") as of 12 November 2026; a filing moves to the archive when OCR closes the case. Modelled costs on this site are a method applied to the reported count, using IBM Cost of a Data Breach per-record figures, and are never a cost disclosed by the entity. Export files: hhs-breach-under-investigation__2026-11-12.csv (732 rows); hhs-breach-archive__2026-11-12.csv (7,360 rows).
Corrections: if you represent a listed entity and the portal row has been amended, email questions@databreachcost.com with the portal entry and we will re-pull the export.
Schedule F / Reference Q&A