Geography
Iowa: 99 healthcare breach filings.
Iowa entities have reported 99 breaches of 500 or more individuals to HHS since 2010, the 27th most of the 52 states and territories on the register, covering 6,612,832 individuals (28th by people affected). 7 are still under investigation. Hacking/IT Incident is the breach type on 68% of them, and network server the most common location (49%).
Filings
99
27th of 52 states and territories
Individuals affected
6,612,832
Median filing 3,340
Largest filing
1,421,107
Iowa Health System d/b/a UnityPoint Health, 2018
Hacking / IT share
68%
33 filings involve a business associate
Direct answer / Iowa on the HHS portal
The largest Iowa filing is Iowa Health System d/b/a UnityPoint Health (1,421,107 individuals, submitted 30 July 2018). The busiest year was 2020 with 26 filings. Healthcare Providers account for 75% of the state's filings. 39 filings of 10,000 or more individuals have their own page; the remaining 60 are listed in the table at the foot of this page.
Section IA.1 / Largest filings
Ten largest Iowa breaches
| # | Covered entity | Type | Individuals | Submitted | Breach type | Location | BA |
|---|---|---|---|---|---|---|---|
| 1 | Iowa Health System d/b/a UnityPoint Health | Business Associate | 1,421,107 | 30 Jul 2018 | |||
| 2 | PurFoods, LLC | Healthcare Provider | 1,289,643 | 25 Aug 2023 | |||
| 3 | OpenLoop Health, Inc.Open | Business Associate | 716,000 | 17 Mar 2026 | |||
| 4 | Wolfe Clinic, P.C. | Healthcare Provider | 530,299 | 9 Sep 2022 | |||
| 5 | Wolfe Clinic, P.C. | Healthcare Provider | 499,779 | 9 Apr 2021 | |||
| 6 | Des Moines Orthopaedic Surgeons, P.C. | Healthcare Provider | 307,864 | 22 Jan 2024 | |||
| 7 | Iowa Department of Health and Human Services - Iowa Medicaid | Health Plan | 233,834 | 30 May 2023 | |||
| 8 | CR Pharmacy Services, Inc. d/b/a CarePro | Healthcare Provider | 151,499 | 15 Jan 2024 | |||
| 9 | St. Anthony Regional Hospital | Healthcare Provider | 139,214 | 25 Oct 2024 | |||
| 10 | Timberline Billing Service, LLC | Business Associate | 117,088 | 30 Oct 2020 |
Section IA.2 / By year
Iowa filings by submission year
Each year links to the national year page.
| Year | Filings | Individuals affected | Hacking / IT share | Filings with a page |
|---|---|---|---|---|
| 2010 | 1 | 19,222 | 0% | 1 |
| 2012 | 2 | 4,298 | 0% | 0 |
| 2013 | 2 | 9,160 | 0% | 0 |
| 2014 | 3 | 4,304 | 0% | 0 |
| 2016 | 4 | 22,051 | 25% | 1 |
| 2017 | 4 | 9,629 | 25% | 0 |
| 2018 | 10 | 1,519,026 | 50% | 5 |
| 2019 | 5 | 22,707 | 60% | 1 |
| 2020 | 26 | 297,908 | 81% | 5 |
| 2021 | 5 | 605,446 | 100% | 4 |
| 2022 | 2 | 531,906 | 100% | 1 |
| 2023 | 13 | 1,846,963 | 92% | 10 |
| 2024 | 8 | 733,177 | 75% | 6 |
| 2025 | 7 | 218,559 | 86% | 2 |
| 2026 | 7 | 768,476 | 71% | 3 |
Section IA.3 / Composition
Breach type, location and who filed
Multi-valued fields count once per value.
Type of breach
Location of breached information
Covered entity type
Section IA.4 / Notification law
What Iowa law required alongside HIPAA
State notification statute
Iowa: Iowa Code Ch. 715C
Personal Information Security Breach Protection Act
- Notice to individuals
- In the most expedient time possible and without unreasonable delay
- Attorney general threshold
- 500 or more Iowa residents (Within five business days after notifying consumers)
- Private right of action
- No: No private right of action; AG enforcement only
- Penalty
- Unlawful practice under the consumer fraud statute; injunctive relief, civil penalties, and damages
The HIPAA Breach Notification Rule runs alongside the state statute: notice to affected individuals and to HHS without unreasonable delay and no later than 60 days after discovery.
Section IA.5 / Filing pages
39 filings of 10,000 or more individuals
Each links to a page with the full filing, its rank in the state and year, OCR's closing summary where the case is archived, peers, and the modelled cost.
Section IA.6 / All other filings
60 filings below 10,000 individuals
Listed in full from the HHS export, largest first. These filings do not have their own page.
| Covered entity | Type | Individuals | Submitted | Breach type | Location | BA |
|---|---|---|---|---|---|---|
| Monroe County Hospital & Clinics | Healthcare Provider | 8,487 | 17 Feb 2020 | |||
| Iowa Department of Human Services | Healthcare Provider | 7,335 | 26 Jun 2013 | |||
| Iowa Department of Health and Human Services | Health Plan | 6,717 | 16 Apr 2026 | |||
| Wellmark Health Insurance | Health Plan | 6,666 | 26 May 2026 | |||
| University of Iowa Hospitals & Clinics | Healthcare Provider | 5,292 | 22 Jun 2017 | |||
| Northern Iowa Therapy PC | Business Associate | 5,112 | 29 Oct 2023 | |||
| Virginia Gay Hospital | Healthcare Provider | 5,030 | 16 Aug 2019 | |||
| Crossroads Behavioral Health | Healthcare Provider | 5,000 | 28 Aug 2018 | |||
| Iowa Department of Human Services | Health Plan | 4,501 | 27 Jan 2020 | |||
| Scott County, Iowa | Healthcare Provider | 4,336 | 28 Feb 2025 | |||
| Iowa Health and Human ServicesOpen | Health Plan | 3,340 | 6 Jan 2026 | |||
| Iowa Department of Human Services | Health Plan | 3,000 | 11 May 2012 | |||
| Iowa Veterans Home | Healthcare Provider | 2,969 | 21 Apr 2017 | |||
| Planned Parenthood of the Heartland | Healthcare Provider | 2,506 | 1 Jul 2016 | |||
| Grx Holdings, LLC dba Medicap Pharmacy | Healthcare Provider | 2,300 | 2 Feb 2016 | |||
| Iowa Dept. of Human Services | Health Plan | 2,042 | 10 Mar 2014 | |||
| Muscatine Community School District | Healthcare Provider | 2,039 | 29 Oct 2020 | |||
| Wayne County Hospital | Healthcare Provider | 2,016 | 1 Jul 2021 | |||
| Mercy Medical Center- North Iowa | Healthcare Provider | 1,971 | 26 Nov 2018 | |||
| Burlington Community School District | Healthcare Provider | 1,884 | 29 Oct 2020 | |||
| UnityPoint Health Affiliated | Healthcare Provider | 1,825 | 2 Oct 2013 | |||
| Johnston Community School District | Healthcare Provider | 1,656 | 30 Oct 2020 | |||
| Molina Healthcare of Iowa, Inc. | Business Associate | 1,647 | 22 Nov 2023 | |||
| Clinton Community School District | Healthcare Provider | 1,643 | 30 Oct 2020 | |||
| UnityPoint Health Affiliated Covered Entity | Healthcare Provider | 1,620 | 11 May 2016 | |||
| Scott County, Iowa | Business Associate | 1,607 | 25 Jul 2022 | |||
| Cedar Falls Community School District | Healthcare Provider | 1,445 | 30 Oct 2020 | |||
| VGM Homelink | Business Associate | 1,400 | 18 Apr 2014 | |||
| City of Dubuque Fire Department | Healthcare Provider | 1,381 | 14 Feb 2024 | |||
| Visiting Nurse Services of Iowa | Healthcare Provider | 1,298 | 16 Jul 2012 | |||
| Balance Autism | Healthcare Provider | 1,281 | 16 May 2025 | |||
| Amerigroup Iowa, Inc. | Business Associate | 1,191 | 29 Mar 2019 | |||
| Indianola Community School District | Healthcare Provider | 1,141 | 29 Oct 2020 | |||
| Cedar County Iowa | Healthcare Provider | 1,138 | 8 Oct 2020 | |||
| Polk County Health Services, Inc | Health Plan | 1,071 | 12 Apr 2018 | |||
| University of Iowa Hospitals & Clinics | Healthcare Provider | 950 | 25 Jun 2019 | |||
| June E. Nylen Cancer Center | Healthcare Provider | 927 | 11 Sep 2019 | |||
| The Iowa Clinic, P.C. | Healthcare Provider | 914 | 11 Aug 2020 | |||
| Lewis Central Community School District | Healthcare Provider | 905 | 30 Oct 2020 | |||
| Iowa Medicaid Enterprise | Health Plan | 862 | 25 Apr 2014 | |||
| Iowa Department of Health and Human Services | Health Plan | 833 | 26 May 2023 | |||
| Iowa Department of Human Services | Health Plan | 811 | 20 Oct 2017 | |||
| Primary Health Care, Inc. | Healthcare Provider | 787 | 6 May 2025 | |||
| Clear Creek Amana Community School District | Healthcare Provider | 771 | 29 Oct 2020 | |||
| United Community Health Center | Healthcare Provider | 750 | 28 Feb 2025 | |||
| Manning Regional Healthcare CenterOpen | Healthcare Provider | 746 | 31 Jul 2026 | |||
| Maquoketa Community School District | Healthcare Provider | 743 | 29 Oct 2020 | |||
| Mending Minds LLC dba Walnut Creek Psychiatry | Healthcare Provider | 733 | 1 Jun 2024 | |||
| Prelude Behavioral Services | Healthcare Provider | 699 | 14 Sep 2020 | |||
| Urbandale Community School District | Healthcare Provider | 647 | 30 Oct 2020 | |||
| Bondurant-Farrar Community School District | Healthcare Provider | 603 | 30 Oct 2020 | |||
| Thielen Student Health Center | Healthcare Provider | 599 | 30 Nov 2018 | |||
| Saydel Community School District | Healthcare Provider | 590 | 30 Oct 2020 | |||
| Charles City Community School District | Healthcare Provider | 580 | 29 Oct 2020 | |||
| Carlisle Community School District | Healthcare Provider | 562 | 30 Oct 2020 | |||
| Central Iowa Hospital Corporation d/b/a Blank Children's Hospital | Healthcare Provider | 557 | 8 Dec 2017 | |||
| Iowa Total Care, Inc. | Health Plan | 536 | 18 Dec 2020 | |||
| Planned Parenthood of the Heartland | Healthcare Provider | 515 | 29 Jun 2018 | |||
| PDCM InsuranceOpen | Business Associate | 501 | 27 Jun 2025 | |||
| June E. Nylen Cancer Center | Healthcare Provider | 500 | 14 Sep 2020 |
Index / Other states
Every state on the register
100
32
164
94
777
140
144
31
33
465
226
23
30
361
200
81
124
66
39
170
242
239
191
55
164
36
60
55
39
176
57
512
207
21
278
81
120
340
32
41
87
15
197
641
68
15
158
186
47
126
19
Index / Companion schedules
13 HHS breach register
→Hub: every filing, by state, year and entity.
04 Biggest breaches
→Mega-breaches with primary-source cost figures.
Industry / Healthcare
→IBM 2026: $6.64M average, 13 years at #1.
Regulation / HIPAA penalties
→OCR enforcement tiers and the 60-day rule.
11 50-state laws
→Deadline, AG threshold and penalties per state.
Cost / Per record
→Where the per-record model is reliable.
Provenance
Source: U.S. Department of Health and Human Services, Office for Civil Rights, Breach Portal (breaches affecting 500 or more individuals), retrieved 2026-09-10. Public domain. Individuals affected and dates as reported by the covered entity.
Portal: ocrportal.hhs.gov breach report. Statutory basis: HITECH Act section 13402(e)(4): the Secretary must post a list of breaches of unsecured protected health information affecting 500 or more individuals. Breaches affecting fewer than 500 individuals are reported to OCR annually and are not posted, so they are not on this register. Status wording follows the portal's two tabs ("Cases Currently Under Investigation" and "Archive") as of 10 September 2026; a filing moves to the archive when OCR closes the case. Modelled costs on this site are a method applied to the reported count, using IBM Cost of a Data Breach per-record figures, and are never a cost disclosed by the entity.
Corrections: if you represent a listed entity and the portal row has been amended, email questions@databreachcost.com with the portal entry and we will re-pull the export.