What should I do if my healthcare data was breached?

If your healthcare data was breached: (1) Request your complete medical records immediately as documentation; (2) Freeze your credit at all three bureaus; (3) Monitor your Explanation of Benefits statements for fraudulent claims; (4) Change passwords on all healthcare accounts and enable 2FA; (5) File a complaint with HHS OCR at hhs.gov/ocr/complaints; (6) Consult a data breach attorney if you suffered financial harm.

Resource Center

Healthcare Data Breaches: What You Need to Know

Recent incidents, your legal rights, and the exact steps to take if your health data was exposed.

190M+ Records Exposed in 2024 HIPAA Breach Rights Updated March 2026

Durjoy BhattacharjyaFounder & CEOHealthcare Technology

What should I do immediately if my health data was breached?

Request your complete medical records as documentation, freeze your credit at all three bureaus, monitor your insurance Explanation of Benefits for fraudulent claims, change all healthcare account passwords, and file a complaint with HHS OCR.

HIPAA requires providers to notify you within 60 days of discovering a breach. Medical identity theft — using your data to receive care or prescriptions — is the primary financial risk and can take years to resolve if not caught early.

6 Steps to Take After a Healthcare Data Breach

Step 1.Request a copy of your medical records

A breach is the most urgent reason to get your complete records now — before they're altered, deleted, or further compromised. Under HIPAA, you're entitled to your full record within 30 days.

Step 2.Place a credit freeze and fraud alert

Medical data breaches often expose Social Security Numbers. Freeze your credit at all three bureaus (Equifax, Experian, TransUnion) and set a fraud alert immediately. Freezes are free under federal law.

Step 3.Monitor your Explanation of Benefits (EOB)

Fraudulent medical claims are a major consequence of health data theft. Review every EOB from your insurer and report claims you don't recognize. Also monitor your Medicare/Medicaid statements.

Step 4.Call HHS OCR to file a complaint

If you believe a covered entity violated HIPAA in connection with the breach, file a complaint with the HHS Office for Civil Rights at 1-800-368-1019 or online at hhs.gov/ocr/complaints. This is free and anonymous.

Step 5.Change passwords on all healthcare accounts

Immediately change passwords on patient portals, health insurance accounts, pharmacy apps, and any account that uses your email or health data. Use unique passwords and enable 2FA everywhere.

Step 6.Watch the statute of limitations

If you were harmed by the breach, you may have a legal claim. Statutes of limitations for data breach claims vary by state — typically 1 to 3 years. Consult an attorney if you've suffered financial harm.

Recent Major Healthcare Breaches

Incidents affecting 3+ million patients. Source: HHS OCR Breach Portal and public filings.

Change Healthcare (UnitedHealth Group)

February 2024 · Ransomware

~190 million affected

Data exposed: Claims data, prescription info, insurance details, SSNs, DOBs

Status: Notifications ongoing. Class action suits filed.

Ascension Health

May 2024 · Ransomware (Black Basta)

5.6 million affected

Data exposed: Lab results, medications, medical procedures, insurance, SSNs

Status: Notifications sent. OCR investigation open.

Kaiser Permanente

April 2024 · Unauthorized disclosure (tracking pixels)

13.4 million affected

Data exposed: Search terms, names, IP addresses, health conditions searched

Status: Notifications sent to affected members.

HealthEC

December 2023 · Hacking/IT incident

4.5 million affected

Data exposed: Names, SSNs, DOBs, addresses, diagnoses, insurance info

Status: Notifications complete. FTC monitoring.

HCA Healthcare

July 2023 · External storage theft

11 million affected

Data exposed: Names, email addresses, appointment scheduling data

Status: Notifications sent. Class action filed.

Advocate Aurora Health

October 2022 · Unauthorized disclosure (tracking pixels)

3 million affected

Data exposed: Patient portal activity, IP addresses, health conditions searched

Status: Settlement reached.

Search the full HHS OCR Breach Portal for all reported incidents since 2009.

Your Rights Under HIPAA Breach Notification Rule

When a covered entity or its business associate discovers a breach of unsecured PHI, federal law (45 CFR §164.404) requires:

Individual notice: Written notice to affected individuals within 60 days of discovery, by first-class mail (or email if consented).
Media notice: For breaches affecting 500+ residents in a state, notice to prominent media outlets in that state.
HHS notice: Breaches affecting 500+ individuals must be reported to HHS immediately; smaller breaches annually.
Notice content: Must include a description of what happened, what PHI was involved, what the entity is doing, and contact information for questions.

If you believe these requirements were not met, file a complaint with HHS OCR at ocrportal.hhs.gov or call 1-800-368-1019.

Why your records matter after a breach

A certified copy of your medical records serves as your legal baseline. If fraudulent entries are added to your record — a common consequence of medical identity theft — your pre-breach records are essential evidence for dispute resolution and litigation.

Request Your Records Now

Frequently Asked Questions

What is a healthcare data breach?

A healthcare data breach is an unauthorized access, acquisition, use, or disclosure of protected health information (PHI) that compromises the security or privacy of that information. Under HIPAA, breaches affecting 500 or more individuals must be reported to HHS and media outlets. Smaller breaches must be logged and reported annually.

How will I know if my health data was breached?

Covered entities must notify affected individuals within 60 days of discovering a breach. You'll typically receive a letter by mail (or email if you consented to electronic communications) explaining what happened, what data was involved, and what steps the organization is taking. You can also check the HHS "Wall of Shame" — the public database of breaches affecting 500+ individuals at hhs.gov/hipaa/breaches.

Can I sue a healthcare provider for a data breach?

HIPAA itself does not create a private right of action — you cannot sue directly for a HIPAA violation. However, you may have claims under state laws (negligence, breach of contract, consumer protection statutes) or through class action litigation. Many major healthcare breaches have resulted in multi-million dollar class action settlements. Consult a data breach attorney if you suffered actual harm.

What is medical identity theft and how do I detect it?

Medical identity theft occurs when someone uses your name or insurance information to receive medical services or prescription drugs fraudulently. Signs include: EOB statements for services you didn't receive, bills from unknown providers, claims denied because your benefits were "used up," or incorrect information in your medical records. Request an accounting of disclosures from your providers and review your records regularly.

Does the government track healthcare data breaches?

Yes. The HHS Office for Civil Rights maintains a public "Breach Portal" listing all reported breaches affecting 500 or more individuals since 2009. The FTC also tracks healthcare-related identity theft. You can search this database at hhs.gov/hipaa/for-professionals/breach-notification/breach-reporting.

How can getting my records help after a breach?

Your medical records are your baseline documentation of what information existed about you before a breach. If fraudulent claims are added to your record, or if your records are altered, having a certified copy of your pre-breach records is essential evidence. It also lets you spot inaccuracies introduced by identity thieves.

Need a copy of your records?

Review the request service, starting price, authorization steps, provider-dependent timing, and separate provider fees before submitting.

Request Your Records

Related resources