Loading...
If you got a breach letter
A breach means someone got at your health information who shouldn't have. That can be unsettling, but there are a few clear things you can do: find out what was exposed, check your own records for anything that isn't yours, and watch your credit. We'll show you which organizations have been breached and walk you through each step.
Source: HHS Office for Civil Rights breach portal
A healthcare data breach is an incident where your protected health information is accessed, used, or shared without permission. Under HIPAA, organizations must report breaches affecting 500 or more people to HHS, and must notify you directly within 60 days of discovering one.
Below: which organizations have been breached, how many people were affected, and what you can do if your information was part of one.
Look up your hospital, clinic, or insurer and we'll show you whether it has reported a breach.
Breaches are getting bigger and more common. When your medical information is exposed, the risk goes beyond identity theft: it can touch your credit, your insurance, and even your care if someone uses your identity to get treatment and it ends up in your file.
Some breaches lead to class action lawsuits that affected patients can join. See which ones are open and what they cover.
View data breach lawsuitsHHS maintains a public database of every healthcare breach affecting 500 or more people. You can search it by organization name or location.
Search OCR Breach PortalNote: The OCR portal only includes breaches affecting 500+ individuals. Smaller breaches may not appear, but organizations are still required to notify affected patients directly.
Cyberattacks targeting healthcare systems, including ransomware, malware, and unauthorized access to electronic health records.
Employees accessing patient records without authorization, or accidentally sending records to wrong recipients.
Physical theft of devices containing patient data, including laptops, hard drives, and paper records.
Lost devices, paper records, or storage media containing patient information.
Failure to properly destroy patient records, resulting in records being found in dumpsters or recycling bins.
The organization has to notify you within 60 days. Ask them exactly what was taken, how it happened, and what they're offering you, such as free credit monitoring.
Get a copy of your records and read through them. A diagnosis, prescription, or visit you don't recognize can be a sign someone used your identity. We can request the copy for you.
Medical identity theft often turns into financial fraud. Put a fraud alert or freeze on your credit reports and keep an eye out for anything you didn't do.
If you think the organization broke HIPAA rules, you can file a complaint with the HHS Office for Civil Rights. You generally have 180 days from when you learned about it.
Some breaches lead to class actions that affected patients can join. A lawyer who handles healthcare data breaches can tell you whether that applies to you. We can't give legal advice.
Date: 2024-07-19 | Type: Hacking/IT Incident | State: Minnesota
Change Healthcare Massive Network Breach Affects 192.7M
Date: 2025-08-08 | Type: Hacking/IT Incident | State: Georgia
Aflac Data Breach Affects Nearly 14 Million Individuals
Date: 2024-04-12 | Type: Unauthorized Access/Disclosure | State: California
Kaiser Foundation Health Plan Data Breach Affects 13.4M Patients
Date: 2023-07-31 | Type: Hacking/IT Incident | State: Tennessee
HCA Healthcare Hacking Incident Affects 11.3M Patients
Date: 2023-11-03 | Type: Hacking/IT Incident | State: Nevada
PJ&A Network Server Breach Affects Nearly 9M Individuals
Hacking/IT Incident · Georgia · 626,540 affected
Hacking/IT Incident · Texas · 22,552 affected
Hacking/IT Incident · California · 650 affected
Hacking/IT Incident · South Carolina · 501 affected
Hacking/IT Incident · Missouri · 17,110 affected
Hacking/IT Incident · Oregon · 543 affected
Unauthorized Access/Disclosure · Tennessee · 1,341 affected
Hacking/IT Incident · Colorado · 82,331 affected
Hacking/IT Incident · Maryland · 2,597 affected
Hacking/IT Incident · Indiana · 691 affected
Understand your rights under HIPAA and how to exercise them
Step-by-step guide to filing a complaint with OCR
Order copies of your medical records to verify accuracy
Legal precedents and patient protections from class action cases
Active and settled cases related to this topic
Track class action lawsuits against healthcare organizations that failed to protect patient data.
Learn moreClass Actions100M+ patients affected. Multiple class actions filed for inadequate cybersecurity.
Learn moreClass ActionsHospital-specific data breach lawsuits and patient privacy violations.
Learn moreClass ActionsFind out if you qualify for an active class action related to a data breach.
Learn moreA healthcare data breach is an unauthorized access, use, or disclosure of protected health information (PHI) as defined by HIPAA. Breaches affecting 500 or more individuals must be reported to the HHS Office for Civil Rights (OCR), state attorneys general, and affected patients within 60 days of discovery.
The HHS OCR Breach Portal reports an average of 600-700 large breaches (500+ records) annually, affecting tens of millions of patient records. In 2023, over 133 million records were exposed in healthcare breaches, more than doubling the previous year. The frequency and scale of breaches continues to increase year over year.
Start with your credit: place a fraud alert or a freeze with the three bureaus (Equifax, Experian, TransUnion). Read your explanation-of-benefits statements for care you didn't receive. Take any free credit monitoring the organization offers. If you spot something wrong, report it to the FTC at IdentityTheft.gov and your state attorney general. And get a copy of your own medical records so you can check nothing in them belongs to someone else.
Hacking and IT incidents account for approximately 75% of healthcare breaches, with ransomware being the leading attack vector. Unauthorized access or disclosure by insiders causes about 15% of breaches. Lost or stolen devices, improper disposal of records, and business associate failures account for the remainder.
Often, yes. You may be able to join a class action or bring your own claim against the organization. What a settlement pays varies a great deal, and people who can document identity theft or financial harm generally receive more. A lawyer who handles healthcare data breaches can tell you what applies to you; we can't give legal advice.
HIPAA violations carry penalties of $100-$50,000 per violation (up to $1.5 million per year per violation category). The HHS OCR can also require corrective action plans. State attorneys general can levy additional fines. In 2023, OCR settlements and penalties exceeded $4 million, with individual cases reaching $1.25 million.
Most breached organizations offer 12-24 months of free credit monitoring and identity theft protection. Some major breaches (like the Anthem breach) offered longer monitoring periods. After the free monitoring expires, consider maintaining your own credit monitoring through annualcreditreport.com or a paid service if your Social Security number was exposed.
Names, dates of birth, Social Security numbers, insurance details, medical record numbers, diagnoses and treatment notes, prescriptions, and sometimes financial information. Health records are especially valuable to criminals because they combine your identity and your medical history in one place.
Yes. Telehealth platforms that handle your health information fall under HIPAA and have to follow the same breach notification rules. Health apps and telehealth services outside HIPAA are covered by the FTC Health Breach Notification Rule instead, which also requires them to tell you when your data has been exposed.
Search the HHS OCR Breach Portal (ocrportal.hhs.gov) to verify reported breaches. Breached organizations are required to send individual notification letters to affected patients. You can also contact the organization directly to ask if your records were involved. State attorney general websites often maintain breach notification databases with additional details.
A note on what this is: This page explains healthcare data breaches and your rights. It isn't legal advice; for questions about a breach that affected you, a lawyer is the right person to ask. The numbers come from the U.S. Department of Health & Human Services OCR Breach Portal. We update them regularly, but the portal may have newer entries than we do.