33,730individuals
Hacking/IT IncidentArchived
The Signal Directory
Health Data Breach Tracker
Search every US health data breach of 500 or more people reported to HHS OCR since 2009. Filter by entity, type and date. Built from the OCR public breach portal.
Breaches listed
8,066
2009 to 2026
Individuals affected
1,106,146,271
sum of reported counts
Under investigation
open OCR cases
Top breach types
- 4,864
- 1,694
- 1,003
- 216
Monthly roundups
8,066 breaches
1,120,629individuals
Hacking/IT IncidentArchived
14,402individuals
Hacking/IT IncidentArchived
68,212individuals
Hacking/IT IncidentArchived
425,749individuals
Hacking/IT IncidentArchived
111,555individuals
Hacking/IT IncidentArchived
881individuals
Hacking/IT IncidentArchived
TN · Jul 26, 2019
Perry County Medical Center Inc. d/b/a Three Rivers Community Health Group
Healthcare Provider
3,812individuals
Hacking/IT IncidentArchived
3,135individuals
LossArchived
5,903individuals
Hacking/IT IncidentArchived
43,676individuals
Hacking/IT IncidentArchived
820individuals
Hacking/IT IncidentArchived
140,590individuals
Hacking/IT IncidentArchived
4,082individuals
Hacking/IT IncidentArchived
13,270individuals
Hacking/IT IncidentArchived
8,992individuals
Hacking/IT IncidentArchived
774individuals
TheftArchived
2,399individuals
Hacking/IT IncidentArchived
536individuals
Hacking/IT IncidentArchived
4,079individuals
Hacking/IT IncidentArchived
3,000individuals
Improper DisposalArchived
102,000individuals
Hacking/IT IncidentArchived
422,496individuals
Hacking/IT IncidentArchived
1,458individuals
LossArchived
99,943individuals
Hacking/IT IncidentArchived
3,657individuals
Hacking/IT IncidentArchived
116,262individuals
Hacking/IT IncidentArchived
MD · Jul 17, 2019
Rockville Eye Surgery Center LLC dba Palisades Eye Surgery Center
Healthcare Provider
2,696individuals
Hacking/IT IncidentArchived
9,020individuals
Hacking/IT IncidentArchived
727individuals
Hacking/IT IncidentArchived
2,251individuals
TheftArchived
3,881individuals
Unauthorized Access/DisclosureArchived
583individuals
Unauthorized Access/DisclosureArchived
141,956individuals
Unauthorized Access/DisclosureArchived
1,733,836individuals
Hacking/IT IncidentArchived
4,478individuals
Hacking/IT IncidentArchived
TN · Jul 15, 2019
Memphis Pathology Laboratory d/b/a American Esoteric Laboratories
Healthcare Provider
417,146individuals
Hacking/IT IncidentArchived
3,035individuals
Hacking/IT IncidentArchived
5,563individuals
Unauthorized Access/DisclosureArchived
401,901individuals
Hacking/IT IncidentArchived
10,251,784individuals
Hacking/IT IncidentArchived
35,899individuals
Hacking/IT IncidentArchived
PA · Jul 12, 2019
Cancer Treatment Centers of America (CTCA) at Eastern Regional Medical Center
Healthcare Provider
3,904individuals
Hacking/IT IncidentArchived
GA · Jul 12, 2019
Cancer Treatment Centers of America (CTCA) at Southeastern Regional Medical Center
Healthcare Provider
4,559individuals
Hacking/IT IncidentArchived
2,085individuals
Hacking/IT IncidentArchived
3,700individuals
Hacking/IT IncidentArchived
5,000individuals
Unauthorized Access/DisclosureArchived
13,299individuals
Hacking/IT IncidentArchived
500individuals
Hacking/IT IncidentArchived
467,621individuals
Hacking/IT IncidentArchived
827individuals
Unauthorized Access/DisclosureArchived
1,377individuals
Hacking/IT IncidentArchived
21,407individuals
Hacking/IT IncidentArchived
39,675individuals
Hacking/IT IncidentArchived
713individuals
Unauthorized Access/DisclosureArchived
MN · Jul 8, 2019
Nemadji Research Corporation d/b/a California Reimbursement Enterprises
Business Associate
14,591individuals
Hacking/IT IncidentArchived
6,572individuals
Hacking/IT IncidentArchived
608individuals
Hacking/IT IncidentArchived
39,649individuals
Hacking/IT IncidentArchived
507individuals
Unauthorized Access/DisclosureArchived
About this data
By Dr. Dereck Mush, MD, MBA, Editor In Chief
It currently holds 8,066 breaches, with submission dates from October 21, 2009 to October 9, 2026, and it refreshes every week from OCR's public breach portal.
We built it for the people who have to act on this data: health system CISOs and security teams benchmarking their own risk, compliance and privacy leads tracking how breaches are reported, and investors doing diligence on healthcare companies and their vendors.
Here's how to read it. Each row is a single report filed with OCR. It shows the covered entity, its state and entity type, the number of individuals affected, the breach type (for example hacking or IT incident, or unauthorized access), where the information was held, and the date it was submitted. Use the filters to narrow by submission date, entity type or breach type, and open any row for its detail page. The monthly roundups group new reports by submission month, so you can see what changed recently without scrolling the full list.
- Source. Every record comes from the HHS OCR breach portal, which lists breaches of unsecured protected health information affecting 500 or more individuals. We show the data as OCR reports it and don't add or change the reported facts. Any editorial note we add is labeled as ours.
- Under investigation vs archive. OCR keeps two lists. "Under investigation" lists HIPAA breaches reported within the last 24 months that are currently under investigation by the Office for Civil Rights. "Archive" holds resolved HIPAA breach reports and/or reports older than 24 months. A breach can move from one list to the other between weekly refreshes.
- Individuals affected. These are the counts reported to OCR. Entities can revise them, and the same person can appear in more than one breach, especially when a single vendor incident is reported separately by several covered entities. Adding the counts together will overstate the number of unique people affected.
- No implication of wrongdoing. A listing means a breach was reported to OCR. It doesn't mean the entity broke the law or was at fault beyond what OCR itself has published. Check OCR's own records for any finding, resolution or penalty.
- Updates. The tracker refreshes weekly. If you spot something that doesn't match OCR's portal, tell us and we'll check it against the source.
Source: HHS Office for Civil Rights Breach Portal. Latest submission in the data: Oct 9, 2026. Refreshed weekly from the portal.