Loading...
Patient Accountability
A healthcare data breach is an incident where protected health information is accessed without authorization. Under HIPAA, organizations must report breaches affecting 500+ individuals to HHS.
See which healthcare organizations have been breached, how many patients were affected, and what you can do if your data was exposed. Data sourced from the HHS OCR breach portal.
1,638 breaches affecting 462M+ patients across 50 states, sourced from the HHS OCR Breach Portal.
Search our database to see if your healthcare provider was involved in a breach.
Healthcare breaches are getting bigger and more frequent. When your medical records are exposed, the damage goes beyond identity theft — it can mess with your credit, your insurance coverage, and even your medical care if someone alters your records.
If your data was exposed in a healthcare breach, you may qualify for compensation through an active class action. Check which lawsuits are open and whether you're eligible.
View data breach lawsuitsHHS maintains a public database of every healthcare breach affecting 500 or more people. You can search it by organization name or location.
Search OCR Breach PortalNote: The OCR portal only includes breaches affecting 500+ individuals. Smaller breaches may not appear, but organizations are still required to notify affected patients directly.
Cyberattacks targeting healthcare systems, including ransomware, malware, and unauthorized access to electronic health records.
Employees accessing patient records without authorization, or accidentally sending records to wrong recipients.
Physical theft of devices containing patient data, including laptops, hard drives, and paper records.
Lost devices, paper records, or storage media containing patient information.
Failure to properly destroy patient records, resulting in records being found in dumpsters or recycling bins.
Your healthcare provider must notify you within 60 days. Ask for specific details: what data was compromised, how it happened, and what they're doing to prevent future breaches.
Request a copy of your medical records to verify accuracy. Look for any unfamiliar diagnoses, prescriptions, or procedures that could indicate identity theft.
Medical identity theft often leads to financial fraud. Place a fraud alert on your credit reports and monitor for suspicious activity.
If you believe your provider violated HIPAA, you can file a complaint with the Office for Civil Rights within 180 days of the incident.
In some cases, patients affected by data breaches may be eligible for compensation through class action lawsuits. Consult with an attorney specializing in healthcare data breaches.
Date: 2024-07-19 | Type: Hacking/IT Incident | State: Minnesota
Change Healthcare Massive Network Breach Affects 192.7M
Date: 2025-08-08 | Type: Hacking/IT Incident | State: Georgia
Aflac Data Breach Affects Nearly 14 Million Individuals
Date: 2024-04-12 | Type: Unauthorized Access/Disclosure | State: California
Kaiser Foundation Health Plan Data Breach Affects 13.4M Patients
Date: 2023-07-31 | Type: Hacking/IT Incident | State: Tennessee
HCA Healthcare Hacking Incident Affects 11.3M Patients
Date: 2023-11-03 | Type: Hacking/IT Incident | State: Nevada
PJ&A Network Server Breach Affects Nearly 9M Individuals
Hacking/IT Incident · Georgia · 626,540 affected
Hacking/IT Incident · Texas · 22,552 affected
Hacking/IT Incident · California · 650 affected
Hacking/IT Incident · South Carolina · 501 affected
Hacking/IT Incident · Missouri · 17,110 affected
Hacking/IT Incident · Oregon · 543 affected
Unauthorized Access/Disclosure · Tennessee · 1,341 affected
Hacking/IT Incident · Colorado · 82,331 affected
Hacking/IT Incident · Maryland · 2,597 affected
Hacking/IT Incident · Indiana · 691 affected
Understand your rights under HIPAA and how to exercise them
Step-by-step guide to filing a complaint with OCR
Order copies of your medical records to verify accuracy
Legal precedents and patient protections from class action cases
Active and settled cases related to this topic
Track class action lawsuits against healthcare organizations that failed to protect patient data.
Learn moreClass Actions100M+ patients affected. Multiple class actions filed for inadequate cybersecurity.
Learn moreClass ActionsHospital-specific data breach lawsuits and patient privacy violations.
Learn moreClass ActionsFind out if you qualify for an active class action related to a data breach.
Learn moreA healthcare data breach is an unauthorized access, use, or disclosure of protected health information (PHI) as defined by HIPAA. Breaches affecting 500 or more individuals must be reported to the HHS Office for Civil Rights (OCR), state attorneys general, and affected patients within 60 days of discovery.
The HHS OCR Breach Portal reports an average of 600-700 large breaches (500+ records) annually, affecting tens of millions of patient records. In 2023, over 133 million records were exposed in healthcare breaches, more than doubling the previous year. The frequency and scale of breaches continues to increase year over year.
Immediately place a fraud alert or credit freeze with the three major credit bureaus (Equifax, Experian, TransUnion). Monitor your explanation of benefits (EOB) statements for services you did not receive. Enroll in any free credit monitoring offered by the breached organization. Report suspicious activity to the FTC at IdentityTheft.gov and your state attorney general.
Hacking and IT incidents account for approximately 75% of healthcare breaches, with ransomware being the leading attack vector. Unauthorized access or disclosure by insiders causes about 15% of breaches. Lost or stolen devices, improper disposal of records, and business associate failures account for the remainder.
Yes. You may be able to join a class action lawsuit or file an individual claim against the breached organization. Most healthcare data breach settlements range from $100-$1,000 per affected individual for basic claims, with higher amounts for documented identity theft or financial harm. Many cases settle for $5-50 million total.
HIPAA violations carry penalties of $100-$50,000 per violation (up to $1.5 million per year per violation category). The HHS OCR can also require corrective action plans. State attorneys general can levy additional fines. In 2023, OCR settlements and penalties exceeded $4 million, with individual cases reaching $1.25 million.
Most breached organizations offer 12-24 months of free credit monitoring and identity theft protection. Some major breaches (like the Anthem breach) offered longer monitoring periods. After the free monitoring expires, consider maintaining your own credit monitoring through annualcreditreport.com or a paid service if your Social Security number was exposed.
Healthcare breaches can expose names, dates of birth, Social Security numbers, health insurance information, medical record numbers, diagnosis and treatment details, prescription information, and financial data. Healthcare records are particularly valuable to criminals because they contain both identity and medical information, selling for $250-1,000 per record on the dark web.
Yes. Telehealth platforms that handle PHI are covered entities or business associates under HIPAA and must comply with the same breach notification rules. The FTC Health Breach Notification Rule also applies to health apps and telehealth services not covered by HIPAA, requiring them to notify users of unauthorized disclosures.
Search the HHS OCR Breach Portal (ocrportal.hhs.gov) to verify reported breaches. Breached organizations are required to send individual notification letters to affected patients. You can also contact the organization directly to ask if your records were involved. State attorney general websites often maintain breach notification databases with additional details.
Disclaimer: This page provides educational information about healthcare data breaches and patient rights. It is not legal advice. For specific questions about a data breach affecting you, consult with a qualified attorney. Data breach statistics are sourced from the U.S. Department of Health & Human Services OCR Breach Portal and are updated regularly but may not reflect the most current data.