Loading...
If you got a breach letter
A breach means someone got at your health information who shouldn't have. That can be unsettling, but there are a few clear things you can do: find out what was exposed, check your own records for anything that isn't yours, and watch your credit. We'll show you which organizations have been breached and walk you through each step.
Source: HHS Office for Civil Rights breach portal
A healthcare data breach is an incident where your protected health information is accessed, used, or shared without permission. Under HIPAA, organizations must report breaches affecting 500 or more people to HHS, and must notify you directly within 60 days of discovering one.
Below: which organizations have been breached, how many people were affected, and what you can do if your information was part of one.
Look up your hospital, clinic, or insurer and we'll show you whether it has reported a breach.
Breaches are getting bigger and more common. When your medical information is exposed, the risk goes beyond identity theft: it can touch your credit, your insurance, and even your care if someone uses your identity to get treatment and it ends up in your file.
Some breaches lead to class action lawsuits that affected patients can join. See which ones are open and what they cover.
View data breach lawsuitsHHS maintains a public database of every healthcare breach affecting 500 or more people. You can search it by organization name or location.
Search OCR Breach PortalNote: The OCR portal only includes breaches affecting 500+ individuals. Smaller breaches may not appear, but organizations are still required to notify affected patients directly.
Cyberattacks targeting healthcare systems, including ransomware, malware, and unauthorized access to electronic health records.
Employees accessing patient records without authorization, or accidentally sending records to wrong recipients.
Physical theft of devices containing patient data, including laptops, hard drives, and paper records.
Lost devices, paper records, or storage media containing patient information.
Failure to properly destroy patient records, resulting in records being found in dumpsters or recycling bins.
The organization has to notify you within 60 days. Ask them exactly what was taken, how it happened, and what they're offering you, such as free credit monitoring.
Get a copy of your records and read through them. A diagnosis, prescription, or visit you don't recognize can be a sign someone used your identity. We can request the copy for you.
Medical identity theft often turns into financial fraud. Put a fraud alert or freeze on your credit reports and keep an eye out for anything you didn't do.
If you think the organization broke HIPAA rules, you can file a complaint with the HHS Office for Civil Rights. You generally have 180 days from when you learned about it.
Some breaches lead to class actions that affected patients can join. A lawyer who handles healthcare data breaches can tell you whether that applies to you. We can't give legal advice.
Date: 2024-07-19 | Type: Hacking/IT Incident | State: Minnesota
Change Healthcare Massive Network Breach Affects 192.7M
Date: 2025-08-08 | Type: Hacking/IT Incident | State: Georgia
Aflac Data Breach Affects Nearly 14 Million Individuals
Date: 2024-04-12 | Type: Unauthorized Access/Disclosure | State: California
Kaiser Foundation Health Plan Data Breach Affects 13.4M Patients
Date: 2023-07-31 | Type: Hacking/IT Incident | State: Tennessee
HCA Healthcare Hacking Incident Affects 11.3M Patients
Date: 2023-11-03 | Type: Hacking/IT Incident | State: Nevada
PJ&A Network Server Breach Affects Nearly 9M Individuals
Hacking/IT Incident · Georgia · 626,540 affected
Hacking/IT Incident · Texas · 22,552 affected
Hacking/IT Incident · California · 650 affected
Hacking/IT Incident · South Carolina · 501 affected
Hacking/IT Incident · Missouri · 17,110 affected
Hacking/IT Incident · Oregon · 543 affected
Unauthorized Access/Disclosure · Tennessee · 1,341 affected
Hacking/IT Incident · Colorado · 82,331 affected
Hacking/IT Incident · Maryland · 2,597 affected
Hacking/IT Incident · Indiana · 691 affected
Understand your rights under HIPAA and how to exercise them
Step-by-step guide to filing a complaint with OCR
Order copies of your medical records to verify accuracy
Legal precedents and patient protections from class action cases
Active and settled cases related to this topic
Track class action lawsuits against healthcare organizations that failed to protect patient data.
Learn moreClass Actions100M+ patients affected. Multiple class actions filed for inadequate cybersecurity.
Learn moreClass ActionsHospital-specific data breach lawsuits and patient privacy violations.
Learn moreClass ActionsFind out if you qualify for an active class action related to a data breach.
Learn moreA healthcare data breach is an unauthorized access, use, or disclosure of protected health information (PHI) as defined by HIPAA. Breaches affecting 500+ individuals must be reported to the HHS OCR within 60 days.
The HHS OCR reports 600-700 large breaches annually. In 2023, over 133 million records were exposed, more than doubling the previous year.
Place a fraud alert or credit freeze, monitor EOB statements, enroll in free credit monitoring, and report suspicious activity to the FTC at IdentityTheft.gov.
Hacking and IT incidents account for 75% of breaches, with ransomware as the leading vector. Insider access causes about 15%. Lost devices and improper disposal account for the remainder.
Often, yes. You may be able to join a class action or bring your own claim. Settlement amounts vary widely, and documented identity theft or financial harm generally receives more. A lawyer can tell you what applies to you.
HIPAA violations carry penalties of $100-$50,000 per violation, up to $1.5 million per year per category. State attorneys general can levy additional fines.
Most organizations offer 12-24 months of free credit monitoring. After expiration, maintain monitoring through annualcreditreport.com if your SSN was exposed.
Names, dates of birth, Social Security numbers, insurance details, medical record numbers, diagnoses, prescriptions, and sometimes financial data. Health records are valuable to criminals because they combine identity and medical history.
Yes. HIPAA-covered telehealth platforms must comply with the same rules. The FTC Health Breach Notification Rule also applies to non-HIPAA health apps.
Search the HHS OCR Breach Portal, check for notification letters, contact the organization directly, or check your state attorney general breach database.
You can search our breach checker tool at medicalrecords.com/breach-check by entering your provider's name. Healthcare organizations are also required to notify affected individuals within 60 days of discovering a breach. You can also search the HHS OCR Breach Portal directly.
After a breach: 1) Review the breach notification for details on what data was exposed, 2) Request copies of your medical records to check for unauthorized changes, 3) Place fraud alerts on your credit reports, 4) Monitor Explanation of Benefits statements for services you didn't receive, and 5) Consider filing a complaint with HHS OCR or consulting a healthcare privacy attorney.
In many cases, yes. Patients affected by large healthcare data breaches may be eligible for compensation through class action lawsuits. Eligibility typically depends on the breach size, type of data exposed, and whether you suffered financial harm or identity theft. Consult a healthcare privacy attorney to evaluate your specific situation.
A note on what this is: This page explains healthcare data breaches and your rights. It isn't legal advice; for questions about a breach that affected you, a lawyer is the right person to ask. The numbers come from the U.S. Department of Health & Human Services OCR Breach Portal. We update them regularly, but the portal may have newer entries than we do.