Skip to content
Network USA

Guide ยท Data

How do you read the HHS OCR breach portal?

The HHS OCR breach portal lists every breach of unsecured protected health information affecting 500 or more individuals that covered entities report to HHS. Each row gives the entity, its state and type, the number of individuals affected, the submission date, the breach type and where the information was held.

Two lists: under investigation and archive

Recent reports and those OCR is still reviewing appear as under investigation (753 in our data). Reports OCR has closed move to the archive. Our tracker shows this in the Status column.

Every column, explained

Name of covered entity
The health plan, provider, clearinghouse or business associate that filed the report.
State
The state listed for the entity, not necessarily where affected people live.
Covered entity type
Healthcare provider, health plan, business associate or healthcare clearinghouse.
Individuals affected
The number reported by the entity; it may be updated later.
Breach submission date
When the report was submitted to HHS, not when the breach happened.
Type of breach
Hacking/IT incident, unauthorized access/disclosure, theft, loss, improper disposal, other or unknown. A report can list several.
Location of breached information
Where the PHI was, such as network server, email, paper/films, laptop or electronic medical record.
Business associate present
Whether a business associate was involved.
Web description
For many archived reports, OCR's summary of the incident and its review.

Limits of the data

  • Only breaches of 500 or more individuals are listed.
  • Counts are self-reported and may be revised.
  • A listing is not a finding that HIPAA was violated.

Search the data in our HIPAA breach list or see the statistics.

Frequently asked questions

What is the OCR breach portal?

The HHS Office for Civil Rights website that publicly lists breaches of unsecured protected health information affecting 500 or more individuals.

What does under investigation mean on the HIPAA breach list?

That the report is recent or OCR has not closed its review. Closed reports move to the archive.

Does the breach submission date show when the breach happened?

No. It is the date the report was submitted to HHS.

Sources

Last updated 2026-10-20.