The HIPAA Journal has compiled healthcare data breach statistics from October 2009, when the Department of Health and Human Services (HHS) Office for Civil Rights (OCR) started publishing summaries of healthcare data breaches on its website. This page is regularly updated to reflect the latest healthcare data breach statistics. These statistics and graphs were last updated on October 15, 2026, and are based on breach data obtained from OCR on October 10, 2026.
The data covers the period from October 21, 2009 through August 25, 2026. Check back regularly to get the latest healthcare data breach statistics and healthcare data breach trends. You can view our 2025 healthcare data breach report here.
You can also receive a free copy of our HIPAA Compliance Checklist to understand your organization’s responsibilities under HIPAA. Trends In Healthcare Data Breach Statistics Our healthcare data breach statistics clearly show an upward trend in data breaches since 2009, when OCR first started publishing data breach summaries on its website, peaking in 2026, when 772 healthcare data breaches affecting 500 or more individuals were reported to OCR.
Get The FREE HIPAA Compliance Checklist Immediate Delivery of Checklist Link To Your Email Address Please enable JavaScript in your browser to complete this form. Business Email * Name * First Last Number * Company Name * Get Free Checklist Please Enter Correct Email Address Your Privacy Respected HIPAA Journal Privacy Policy There was a sharp increase in data breaches between 2018 and 2021, with data breaches doubling in just three years as cybercriminals aggressively adopted ransomware and actively targeted the healthcare sector.
The large annual increases in data breaches came to an end in 2021, increasing by around 4% between 2022 and 2023, and again by around 4% from 2024 to 2025, when a new annual record was set with 772 large data breaches reported. It is too early in the year to draw any conclusions about whether healthcare data breaches will increase, decrease, or remain at a similar level this year.
Based on the current data from the OCR data breach portal, from January 1, 2026, to April 30, 2026, 252 large healthcare data breaches have been reported to OCR, 9. 5% fewer data breaches than the corresponding period in 2025. It should be noted that OCR has been slow to publish data on its data breach portal this year, most likely due to a hangover from the longest-ever government shutdown in late 2025.
The HHS all but shut down for 43 days from October 1 to November 12, 2025, due to the failure of Congress to pass an appropriations bill, during which time data breaches stopped being added to the OCR breach portal. Additions to the portal have been slow since. For instance, in the month of March 2026, 3 months after staff returned to work at the HHS following the shutdown, no data breaches were added to the portal for that month.
As of June 2026, data breaches are still being added to the breach portal for March 2026. It stands to reason that as data breach numbers increase, the number of affected individuals rises, but the increase has been considerable due to an increase in very large healthcare data breaches. Between 2020 and 2021, data breaches increased by 7.
8%; however, the number of affected individuals increased by 73% over that period. The number of data breaches and affected individuals remained largely unchanged between 2021 and 2022, before another significant hike in breach victim count. Between 2022 and 2023, data breaches increased by around 3.
8%, but the number of affected individuals increased by more than 193%. There was a 0. 5% decline in reported large healthcare data breaches between 2023 and 2024, yet the number of affected individuals soared by 58% to more than 289 million individuals in a single year, which is almost 85% of the population of the United States.
The huge rise in affected individuals in 2023 and 2024 was due to an increase in mega data breaches, incidents involving unauthorized access to the protected health information of more than 1 million individuals. The largest healthcare data breach of all time, beating the previous record of 78. 8 million individuals set by Anthem Inc.
in 2015, was set in 2024, when Change Healthcare, a healthcare clearinghouse, experienced the mother of all data breaches. An estimated 192. 7 million individuals were affected by the Change Healthcare ransomware attack ( more information ).
In 2025, the mega data breaches continued, the largest of which occurred at the business associate Conduent Business Services. The review of the affected data has taken several months; however, the scale of the breach is now clear. The protected health information of more than 62 million Americans was compromised in the incident, making it the third-largest healthcare data breach of all time.
Mega data breaches were also announced in 2025 by Aflac, which affected almost 14 million individuals – the 5th-largest healthcare data breach of all time- and Episource, which affected more than 6. 7 million individuals. HIPAA requires all healthcare data breaches to be reported to OCR, regardless of their size; however, OCR is only required to publish details of data breaches affecting 500 or more individuals.
The healthcare data breach statistics in this article have been calculated using data obtained from OCR for data breaches affecting 500 or more individuals. The breaches included in the statistics and graphs below include closed cases and breaches that are still under or awaiting investigation by OCR for potential HIPAA violations. OCR does provide some insight into the volume and nature of the tens of thousands of small data breaches that are reported each year through its HITECH Act-mandated reports to Congress.
Originally published at hipaajournal.com
