HHS OCR breach portal

HIPAA breaches by state

Reports of HIPAA breaches affecting 500 or more individuals, grouped by the state listed for the covered entity.

State	Reports	Under investigation	Individuals affected	Top breach type	State law
Alaska	32	2	925,719	Hacking/IT Incident	Alaska law
Alabama	101	12	14,149,604	Hacking/IT Incident	Alabama law
Arkansas	94	7	2,597,059	Hacking/IT Incident	Arkansas law
Arizona	167	11	16,201,503	Hacking/IT Incident	Arizona law
California	786	56	79,958,213	Hacking/IT Incident	California law
Colorado	142	18	29,384,025	Hacking/IT Incident	Colorado law
Connecticut	146	8	11,380,761	Hacking/IT Incident	Connecticut law
District of Columbia	34	3	741,808	Unauthorized Access/Disclosure	District of Columbia law
Delaware	32	1	5,341,160	Hacking/IT Incident	Delaware law
Florida	473	59	54,112,976	Hacking/IT Incident	Florida law
Georgia	230	17	38,859,962	Hacking/IT Incident	Georgia law
Hawaii	24	3	614,294	Hacking/IT Incident	Hawaii law
Iowa	100	7	6,614,525	Hacking/IT Incident	Iowa law
Idaho	32	6	1,543,757	Hacking/IT Incident	Idaho law
Illinois	364	28	22,594,404	Hacking/IT Incident	Illinois law
Indiana	204	13	93,117,155	Hacking/IT Incident	Indiana law
Kansas	83	14	2,096,082	Hacking/IT Incident	Kansas law
Kentucky	124	7	11,757,126	Hacking/IT Incident	Kentucky law
Louisiana	67	7	4,438,165	Hacking/IT Incident	Louisiana law
Massachusetts	245	22	28,784,150	Hacking/IT Incident	Massachusetts law
Maryland	172	14	19,570,764	Hacking/IT Incident	Maryland law
Maine	39	9	3,296,092	Hacking/IT Incident	Maine law
Michigan	241	26	16,131,814	Hacking/IT Incident	Michigan law
Minnesota	194	26	212,076,397	Hacking/IT Incident	Minnesota law
Missouri	167	19	17,582,532	Hacking/IT Incident	Missouri law
Mississippi	55	4	2,459,630	Hacking/IT Incident	Mississippi law
Montana	36	1	1,865,004	Hacking/IT Incident	Montana law
North Carolina	210	22	28,692,755	Hacking/IT Incident	North Carolina law
North Dakota	21	2	823,546	Hacking/IT Incident	North Dakota law
Nebraska	60	5	5,403,241	Hacking/IT Incident	Nebraska law
New Hampshire	41	4	1,163,058	Hacking/IT Incident	New Hampshire law
New Jersey	177	18	79,985,058	Hacking/IT Incident	New Jersey law
New Mexico	57	4	4,378,605	Hacking/IT Incident	New Mexico law
Nevada	55	7	12,507,230	Hacking/IT Incident	Nevada law
New York	516	44	42,558,825	Hacking/IT Incident	New York law
Ohio	278	26	18,927,883	Hacking/IT Incident	Ohio law
Oklahoma	83	9	6,107,720	Hacking/IT Incident	Oklahoma law
Oregon	120	8	5,405,904	Hacking/IT Incident	Oregon law
Pennsylvania	345	34	21,205,627	Hacking/IT Incident	Pennsylvania law
Puerto Rico	32	0	1,712,827	Theft	Not in PRC 2026 summary
Rhode Island	41	3	544,697	Hacking/IT Incident	Rhode Island law
South Carolina	87	13	2,631,488	Hacking/IT Incident	South Carolina law
South Dakota	15	1	178,652	Hacking/IT Incident	South Dakota law
Tennessee	200	18	39,597,433	Hacking/IT Incident	Tennessee law
Texas	656	70	49,863,944	Hacking/IT Incident	Texas law
Utah	68	10	7,085,448	Hacking/IT Incident	Utah law
Virginia	158	13	25,324,969	Hacking/IT Incident	Virginia law
Vermont	16	2	201,678	Hacking/IT Incident	Vermont law
Washington	187	20	23,291,258	Hacking/IT Incident	Washington law
Wisconsin	126	12	12,717,130	Hacking/IT Incident	Wisconsin law
West Virginia	49	6	1,850,823	Hacking/IT Incident	West Virginia law
Wyoming	19	0	287,419	Unauthorized Access/Disclosure	Wyoming law