HHS OCR breach portal data
HIPAA breach tracker: healthcare data breaches reported to HHS
Every breach of unsecured protected health information affecting 500 or more individuals reported to HHS OCR, newest first. Data from the OCR export October 2026; latest submission Sep 30, 2026.
8,024 reports, 1,094,628,651 individuals affected. Page 119 of 161. Clear filters
| Covered entity | State | Entity type | Individuals | Submitted | Type of breach | Status |
|---|---|---|---|---|---|---|
| Shop-Rite Supermarkets, Inc. | NY | Healthcare Provider | 12,172 | Nov 3, 2017 | Improper Disposal | Archive (closed) |
| Valley Family Medicine | VA | Healthcare Provider | 8,450 | Nov 3, 2017 | Unauthorized Access/Disclosure | Archive (closed) |
| Indiana University Health | IN | Healthcare Provider | 1,399 | Nov 3, 2017 | Improper Disposal | Archive (closed) |
| East Central Kansas Area Agency on Aging | KS | Business Associate | 8,750 | Oct 31, 2017 | Hacking/IT Incident | Archive (closed) |
| Catholic Charities of the Diocese of Albany | NY | Healthcare Provider | 4,624 | Oct 27, 2017 | Hacking/IT Incident | Archive (closed) |
| Florida Blue | FL | Health Plan | 939 | Oct 27, 2017 | Unauthorized Access/Disclosure | Archive (closed) |
| Texas Children's Health Plan | TX | Health Plan | 932 | Oct 27, 2017 | Unauthorized Access/Disclosure | Archive (closed) |
| Cook County Health & Hospitals System | IL | Healthcare Provider | 727 | Oct 27, 2017 | Unauthorized Access/Disclosure | Archive (closed) |
| Arch City Dental | OH | Healthcare Provider | 1,716 | Oct 26, 2017 | Unauthorized Access/Disclosure | Archive (closed) |
| MGA Home Healthcare Colorado, Inc. | AZ | Healthcare Provider | 2,898 | Oct 25, 2017 | Hacking/IT Incident | Archive (closed) |
| Brevard Physician Associates | FL | Healthcare Provider | 7,976 | Oct 24, 2017 | Theft | Archive (closed) |
| TJ Samson Community Hospital | KY | Healthcare Provider | 683 | Oct 24, 2017 | Unauthorized Access/Disclosure | Archive (closed) |
| Aetna, Inc. | CT | Health Plan | 1,506 | Oct 23, 2017 | Unauthorized Access/Disclosure | Archive (closed) |
| Recovery Institute of the South East P.A. | FL | Healthcare Provider | 689 | Oct 21, 2017 | Hacking/IT Incident | Archive (closed) |
| Iowa Department of Human Services | IA | Health Plan | 811 | Oct 20, 2017 | Hacking/IT Incident | Archive (closed) |
| Kaiser Foundation Health Plan | CA | Health Plan | 720 | Oct 20, 2017 | Unauthorized Access/Disclosure | Archive (closed) |
| EMERGENCY COVERAGE CORPORATION | TN | Healthcare Provider | 719 | Oct 20, 2017 | Loss | Archive (closed) |
| Mann-Grandstaff VA Medical Center | WA | Healthcare Provider | 1,915 | Oct 19, 2017 | Theft | Archive (closed) |
| The Union Labor Life Insurance Company | MD | Business Associate | 664 | Oct 19, 2017 | Unauthorized Access/Disclosure | Archive (closed) |
| Insulet Corporation | MA | Healthcare Provider | 1,469 | Oct 17, 2017 | Unauthorized Access/Disclosure | Archive (closed) |
| Carolina Oncology Specialists | NC | Healthcare Provider | 1,551 | Oct 16, 2017 | Unauthorized Access/Disclosure | Archive (closed) |
| Martinsville Henry County Coalition for Health and Wellness | VA | Healthcare Provider | 5,806 | Oct 13, 2017 | Theft | Archive (closed) |
| CVS Pharmacy | RI | Healthcare Provider | 836 | Oct 13, 2017 | Theft | Archive (closed) |
| Orthopedics NY, LLP | NY | Healthcare Provider | 2,493 | Oct 12, 2017 | Unauthorized Access/Disclosure | Archive (closed) |
| Bridget P Early MD LLC d/b/a Namaste Health Care | MO | Healthcare Provider | 1,617 | Oct 12, 2017 | Hacking/IT Incident | Archive (closed) |
| RiverMend Health, LLC | GA | Healthcare Provider | 1,300 | Oct 9, 2017 | Hacking/IT Incident | Archive (closed) |
| Lifestyle Therapy & Coaching | AL | Healthcare Provider | 550 | Oct 9, 2017 | Unauthorized Access/Disclosure | Archive (closed) |
| John Hancock Life Insurance Company (U.S.A.) | MA | Health Plan | 1,715 | Oct 6, 2017 | Hacking/IT Incident | Archive (closed) |
| Chase Brexton Health Care | MD | Healthcare Provider | 16,562 | Oct 3, 2017 | Hacking/IT Incident | Archive (closed) |
| LSU Health Care Services Division | LA | Healthcare Provider | 1,200 | Oct 2, 2017 | Unauthorized Access/Disclosure | Archive (closed) |
| Briggs & Stratton Corporation | WI | Health Plan | 12,789 | Sep 29, 2017 | Hacking/IT Incident | Archive (closed) |
| Amida Care | NY | Health Plan | 6,231 | Sep 29, 2017 | Unauthorized Access/Disclosure | Archive (closed) |
| Riaz Baber, M.D., S.C. | IL | Healthcare Provider | 10,500 | Sep 28, 2017 | Unauthorized Access/Disclosure | Archive (closed) |
| Advanced Spine & Pain Center | TX | Healthcare Provider | 8,352 | Sep 27, 2017 | Hacking/IT Incident | Archive (closed) |
| Patients Choice | TX | Healthcare Provider | 1,069 | Sep 26, 2017 | Hacking/IT Incident | Archive (closed) |
| Kraig R. Pepper, D.O., P.A. | TX | Healthcare Provider | 653 | Sep 26, 2017 | Unauthorized Access/Disclosure | Archive (closed) |
| Houston Methodist Hospital | TX | Healthcare Provider | 1,359 | Sep 25, 2017 | Unauthorized Access/Disclosure | Archive (closed) |
| Arkansas Oral & Facial Surgery Center | AR | Healthcare Provider | 128,000 | Sep 24, 2017 | Hacking/IT Incident | Archive (closed) |
| Our Lady of the Angels Hospital | LA | Healthcare Provider | 1,140 | Sep 22, 2017 | Unauthorized Access/Disclosure | Archive (closed) |
| Mercy Health Love County Hospital and Clinic | OK | Healthcare Provider | 13,004 | Sep 20, 2017 | Theft | Archive (closed) |
| Spokane VA Medical Center | WA | Healthcare Provider | 3,275 | Sep 20, 2017 | Loss | Archive (closed) |
| PeaceHealth | WA | Healthcare Provider | 1,969 | Sep 19, 2017 | Unauthorized Access/Disclosure | Archive (closed) |
| Urological Associates of Central Jersey P.A. | NJ | Healthcare Provider | 1,800 | Sep 18, 2017 | Hacking/IT Incident | Archive (closed) |
| W. W. Grainger, Inc. | IL | Health Plan | 1,594 | Sep 18, 2017 | Theft | Archive (closed) |
| MN Urology | MN | Healthcare Provider | 939 | Sep 18, 2017 | Unauthorized Access/Disclosure | Archive (closed) |
| The MS Center of Saint Louis and Mercy Clinic Neurology - Town and Country | MO | Healthcare Provider | 1,081 | Sep 16, 2017 | Unauthorized Access/Disclosure | Archive (closed) |
| Morehead Memorial Hospital | NC | Healthcare Provider | 66,000 | Sep 15, 2017 | Hacking/IT Incident | Archive (closed) |
| Arkansas Department of Human Services | AR | Health Plan | 26,000 | Sep 15, 2017 | Unauthorized Access/Disclosure | Archive (closed) |
| Medical Mutual of Ohio | OH | Health Plan | 6,119 | Sep 15, 2017 | Unauthorized Access/Disclosure | Archive (closed) |
| AU Medical Center, Inc. | GA | Healthcare Provider | 6,109 | Sep 15, 2017 | Hacking/IT Incident | Archive (closed) |
See also healthcare data breach statistics, breaches by state and how to read the OCR breach portal.
Frequently asked questions
What is a healthcare data breach?
Under HIPAA, a breach is generally an impermissible use or disclosure of protected health information that compromises its security or privacy. Covered entities must report breaches affecting 500 or more individuals to HHS, and those reports appear on the HHS OCR breach portal and in this tracker. See what is a HIPAA breach.