An analysis of data breaches affecting 500 or more individuals reported to the U. S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) in August 2026 shows a considerable improvement from the previous month.
Data breaches are down 34% month-over-month, with August’s total of 52 data breaches, the second-lowest monthly total in the past 12 months, well below the 12-month average of 66 data breaches per month. While August was a relatively good month for healthcare data breaches, the year-to-date figures show that 2026 is turning out to be another bad year for healthcare data breaches.
Last year was the worst-ever year for healthcare data breaches, with 807 incidents reported. So far this year, 593 large healthcare data breaches have been reported to OCR. At this time last year, the total stood at 556 data breaches.
That’s a 6. 7% year-over-year increase. Across the 52 data breaches, the protected health information of at least 8,377,327 individuals was exposed or impermissibly accessed or disclosed.
While that represents a 75% month-over-month decrease in affected individuals, July was one of the worst months in recent history for breached healthcare records, with more than 33 million affected individuals. This year has already seen the protected health information of 78. 6 million individuals exposed or impermissibly accessed or disclosed.
That represents a 14. 8% year-over-year increase in affected individuals. Get The FREE HIPAA Compliance Checklist Immediate Delivery of Checklist Link To Your Email Address Please enable JavaScript in your browser to complete this form.
Business Email * Name * First Last Number * Company Name * Get Free Checklist Please Enter Correct Email Address Your Privacy Respected HIPAA Journal Privacy Policy The Biggest Healthcare Data Breaches in August 2026 Two data breaches stand out in August in terms of scale. The largest data breach of the month, and the fourth largest data breach to be reported by a HIPAA-regulated entity so far this year, involved unauthorized access to the protected health information of more than 4.
1 million individuals. The incident occurred at AdaptHealth, a healthcare company that provides home medical equipment, diabetes supplies, and sleep therapy products. AdaptHealth was contacted by a member of the ShinyHunters data theft and extortion group in June and was informed that its network had been accessed and sensitive data exfiltrated.
Data theft was later confirmed. The second largest data breach was reported by the clinical genomics company Baylor Genetics. An unknown hacker accessed parts of its network that contained the protected health information of more than 2.
8 million patients. These were two of 17 data breaches affecting more than 10,000 individuals, and all but two of those incidents were hacking incidents. No information has been released on one of the non-hacking incidents.
The other involved data theft by a former facilitator who stole data and attempted to sell it to another individual. Regulated Entity State Covered Entity Type Individuals Affected Type of Breach Location of Breached Information Cause of Breach AdaptHealth, LLC PA Healthcare Provider 4,115,802 Hacking/IT Incident Network Server Hacking incident involving data theft Baylor Genetics TX Healthcare Provider 2,810,878 Hacking/IT Incident Network Server Hacking incident American Addiction Centers TN Business Associate 327,754 Hacking/IT Incident Network Server Hacking incident involving theft of data from its Salesforce environment Premier Medical Group of the Hudson Valley P.
C. NY Healthcare Provider 282,075 Hacking/IT Incident Network Server Hacking incident Boston Healthcare for the Homeless Program MA Healthcare Provider 201,260 Hacking/IT Incident Network Server Hacking incident Midwest Spine & Brain Institute MN Healthcare Provider 108,487 Unauthorized Access/Disclosure Network Server, Other Hacking incident at business associate (3C Care Systems) Oakdale Ear Nose & Throat PA d/b/a Minnesota ENT MN Healthcare Provider 99,714 Hacking/IT Incident Email Unauthorized access to six employee email accounts Osceola Mental Health Inc.
dba Park Place Behavioral Healthcare FL Healthcare Provider 71,702 Hacking/IT Incident Network Server Hacking incident Kern Psychiatric Health and Wellness Center, Inc CA Healthcare Provider 51,352 Hacking/IT Incident Network Server Hacking incident at its management company (Genesis Healthcare Management) NFI North, Inc. NH Healthcare Provider 49,540 Hacking/IT Incident Network Server Hacking incident Hawaii Dental Group, Inc DBA Hawaii Family Dental HI Healthcare Provider 45,853 Hacking/IT Incident Email Hacking incident involving a compromised email account Connecticut Department of Social Services CT Health Plan 41,000 Hacking/IT Incident Network Server Hacking incident involving a provider reimbursement account Advantage Home Health Care IN Healthcare Provider 19,851 Hacking/IT Incident Network Server Hacking incident involving data exfiltration Viking Enterprises, Inc.
d/b/a City Ambulance Service TX Healthcare Provider 14,324 Hacking/IT Incident Email Ransomware attack (Qilin) Public Partnerships LLC NY Business Associate 12,018 Unauthorized Access/Disclosure Network Server Insider data theft incident involving a former network facilitator Kim Knobbe MO Business Associate 11,927 Unauthorized Access/Disclosure Network Server, Other Unauthorized access/disclosure incident – no information available Silver Summit Medical Corporation CA Healthcare Provider 11,349 Hacking/IT Incident Network Server, Other Hacking incident at an unnamed vendor.
Data theft confirmed When the breach notification deadline is reached, and the number of affected individuals has yet to be determined, data breaches need to be reported to OCR using an estimate of the number of affected individuals.
Originally published at hipaajournal.com
