Healthcare Data Breach and HIPAA Enforcement Statistics for 2026

Last updated: October 20, 2026

Healthcare data breach statistics show 2024 was the worst year on record for exposed patient records. The HHS Office for Civil Rights (OCR) breach portal lists 741 large breaches reported that year, affecting about 290 million people. A single attack on Change Healthcare accounted for roughly 192.7 million of them. This page compiles the key healthcare data breach statistics and HIPAA enforcement numbers for 2026, with primary sources listed at the end.

In 2025, exposures fell by about half, to roughly 141 million people. Yet the number of reports rose to 804, the most of any year on the portal. Through September 2026, the portal lists 592 more, affecting about 78.6 million people. Healthcare remains the most expensive industry for breaches for the 15th straight year, at an average of $6.64 million per incident (IBM, 2026). Portal counts on this page are our own count of the OCR portal on October 20, 2026. You are welcome to cite any figure here with a link to this page.

TL;DR: Quick answer

• 2024: 741 breaches of 500 or more records on the OCR portal and about 290 million people affected, a record for people affected.

• The Change Healthcare ransomware attack is the largest health data breach in history, at about 192.7 million people. That is roughly two thirds of all 2024 exposures.

• 2025: 804 breach reports, the most of any year, and about 141 million people affected. Exposures roughly halved, but 16 breaches still topped one million records each.

• 2026 so far: 592 breaches reported from January through September, affecting about 78.6 million people (our count of the OCR portal, October 20, 2026).

• Healthcare breaches cost an average of $6.64 million in IBM's 2026 report. That is the highest of any industry for the 15th consecutive year.

• OCR announced 21 enforcement actions in 2025. So far in 2026 it has announced 11 settlements totaling $3,170,250. 2026 penalties run from $145 to $73,011 per violation in the lowest tier. The regulatory annual cap is $2,190,294 per provision, though OCR applies lower caps to Tiers 1 to 3.

• What reduces the damage: encrypted, isolated hosting with audit logs and a signed BAA. Our managed plans include all four, from $229 a month.

How many healthcare data breaches happen each year?

OCR publishes every reported breach affecting 500 or more people on its public breach portal. The recent totals, by the year each report was submitted:

Counts are our tally of both portal lists (Under Investigation and Archive) on October 20, 2026, by breach submission date, with exact duplicates removed. Earlier tallies, including an earlier version of this page, put 2024 at 725 breaches. Some published tallies also put 2025 lower, at 772 reports, so check the date and method behind any count you compare. The portal changes as entities file and update reports.

The 2025 decline is less reassuring than it looks. It reflects the absence of another Change Healthcare, not a quiet year. Conduent Business Services alone reported about 62.2 million people, and 16 separate 2025 breaches each affected more than one million. Reports stayed above 700 for the fifth consecutive year and hit a new high of 804. Attackers have not slowed down.

2026 so far: healthcare data breaches and OCR enforcement

The newest healthcare data breach statistics come from OCR's breach portal. It lists 592 breaches of 500 or more records reported from January through September 2026. They affected about 78.6 million people. That is our count of the OCR portal, October 20, 2026, when no October reports had been posted yet.

Hacking and IT incidents caused 85% of those reports and 97% of the affected records. Monthly totals ranged from 50 reports in April to 79 in July.

On enforcement, OCR has announced 11 HIPAA settlements in 2026 so far (through October 20), totaling $3,170,250. It has announced no civil money penalties this year. Nine of the 11 followed cyberattacks: six ransomware cases, two phishing attacks and one system intrusion. The other two were Right of Access cases. The largest settlement is $700,000 with Ambry Genetics, after a phishing attack affecting 225,370 people.

• OCR's 14th Risk Analysis Initiative action came in June 2026: $450,000 with Spencer Gifts LLC health plans. What OCR expects is laid out in our HIPAA risk analysis guide.

• OCR announced its 21st ransomware enforcement action on July 29, 2026: $552,250 with OSF Healthcare System. Recovery planning is covered in our HIPAA backup and disaster recovery guide.

• OCR's 56th Right of Access action came in October 2026: $140,000 with Shen Smiles, P.C.

What are the largest healthcare data breaches of all time?

These are the seven largest reports on OCR's breach portal, ranked by people affected (our count, October 20, 2026):

Two patterns stand out. First, none of the seven is a hospital. They are business associates and health plans, where one system holds data on millions of people. Change Healthcare processed claims for a huge share of the country, so one compromise became a national event. We cover that concentration risk in HIPAA compliant hosting for medical billing. Second, not every mega-breach is a hack. Kaiser's 13.4 million came from advertising pixels on its own websites, the exact exposure we map in HIPAA tracking technologies. What makes a record identifiable is defined by the 18 HIPAA identifiers.

What does a healthcare data breach cost?

IBM's 2026 Cost of a Data Breach Report puts the average healthcare breach at $6.64 million. That is down from $7.42 million in the 2025 report, but still the highest of any industry for the 15th consecutive year. The global average across all industries is $4.99 million. Healthcare breaches also take a long time to find and fix. In IBM's 2025 study, they took an average of 279 days to identify and contain, more than five weeks longer than the 241-day global average. IBM's 2026 all-industry average is 247 days. Those numbers are related. The longer ePHI sits exposed, the more records leak and the more the cleanup costs.

Encryption also changes the math after a loss: properly encrypted data can qualify for the breach notification safe harbor. Yet in IBM's 2026 study, only 37% of breached organizations said they encrypt sensitive data both at rest and in transit. That gap is one reason the safeguards in our HIPAA hosting security measures checklist treat encryption as non-negotiable. It is also why healthcare hosting should encrypt stored patient data by default, not sell it as a paid upgrade. Whether a single mistake even counts as a breach is decided by the steps in our accidental HIPAA violation guide.

HIPAA enforcement statistics: what OCR actually does

• 21 enforcement actions in 2025: 19 settlements and 2 civil money penalties, counted by the date OCR announced them. The penalties were $1,500,000 against Warby Parker and $200,000 against Oregon Health & Science University. Those actions land on employers, not staff; for what happens to individual employees who misuse patient data, see our roundup of real cases.

• 56 Right of Access actions as of October 8, 2026, when OCR announced a $140,000 settlement with Shen Smiles, P.C. The initiative enforces patients' right to get copies of their own records.

• The Risk Analysis Initiative continues in 2026, with its 14th action in June. A risk analysis is required under 45 CFR § 164.308(a)(1)(ii)(A), and risk management under (B). OCR's 2026 ransomware releases each advise both: update the risk analysis periodically and implement a risk management plan.

The 2026 civil penalty amounts, effective January 28, 2026:

One caveat on the caps. Under the 2019 HHS Notice of Enforcement Discretion, OCR uses lower annual caps for Tiers 1 to 3: $25,000, $100,000 and $250,000 before inflation adjustments. Tier 4 keeps its $1.5 million cap, also adjusted for inflation. The notice is effective indefinitely, and HHS said it would use these caps until further notice.

How those tiers get applied, and what recent cases settled for, is covered in our guide to HIPAA violation fines and penalties. The hosting side of staying out of those tiers is laid out in our guide to HIPAA hosting requirements.

What the numbers mean for infrastructure

Read together, the healthcare data breach statistics point at the server room. The record breaches happened where patient data concentrates: clearinghouses, health plans, and vendors running large systems. In IBM's 2025 study, healthcare breaches took 279 days to identify and contain, which is an audit logging problem as much as a security one. And a 13 million record breach happened through website tracking scripts, not a break-in. That is why HIPAA compliant hosting is less about any single product and more about basics done consistently. Those basics are encryption, isolation, logging that someone reads, and a BAA chain with no missing links.

What that contract must contain is in our HIPAA business associate agreement guide. One structural defense is limiting how far a single incident can spread. That is the case for client-level isolation. For smaller practices, having encryption, isolation and audit logging built into the plan is the strongest argument for managed HIPAA hosting.

How we handle it: each managed plan runs on single-tenant AWS with encryption at rest and in transit. Every plan also includes a web application firewall, tested encrypted backups and six-year audit logging. We sign a BAA within 24 hours of signup, before patient data moves. Our BAA covers the servers and services we run; email, EHR and forms vendors need their own. Plans start at $229 a month with no long-term contract, as listed on our pricing page. We sell managed hosting, so weigh that as a disclosure. The numbers on this page are sourced independently of us either way. For what the hosting side of prevention costs, see HIPAA hosting cost.

Citing this page

These healthcare data breach statistics are compiled from the HHS OCR breach portal, HHS enforcement records, the Federal Register, and IBM's annual report. We update the page as new totals publish. Portal counts are our own tally on the date shown, so they can differ from counts published elsewhere. Journalists, researchers, and bloggers are welcome to cite any statistic here with attribution and a link.

Frequently asked questions

How many healthcare data breaches were there in 2026?

OCR's breach portal lists 592 breaches of 500 or more records reported from January through September 2026, affecting about 78.6 million people. That is our count of the OCR portal on October 20, 2026. HHS has not published an official 2026 total, and no October reports had been posted by that date.

How many healthcare data breaches were there in 2024?

The OCR portal lists 741 breaches of 500 or more records reported in 2024, affecting about 290 million people (our count, October 20, 2026). It was the worst year on record for exposed healthcare records and the fourth straight year above 700 large breaches.

What is the largest healthcare data breach in history?

The February 2024 ransomware attack on Change Healthcare, which exposed the protected health information of about 192.7 million people. It surpassed the 2015 Anthem breach of 78.8 million, which had held the record for nine years.

How much does a healthcare data breach cost?

An average of $6.64 million per incident in 2026, per IBM's Cost of a Data Breach Report. Healthcare has been the most expensive industry for breaches for 15 consecutive years. In IBM's 2025 study, healthcare breaches took an average of 279 days to identify and contain.

How many HIPAA fines were issued in 2025?

OCR announced 21 enforcement actions in 2025: 19 settlements and 2 civil money penalties. So far in 2026 (through October 20), OCR has announced 11 HIPAA settlements totaling $3,170,250 and no civil money penalties.

Did healthcare breaches get better in 2025?

Partly. Exposures fell by about half, to roughly 141 million people, mostly because nothing matched Change Healthcare's scale. But the number of reports rose to 804, the most of any year on the OCR portal. Conduent Business Services alone reported about 62.2 million people, and 16 breaches each topped one million records.

Recap: healthcare data breach statistics

To recap, the healthcare data breach statistics for 2026 tell a consistent story. 2024 set the all-time record at about 290 million exposed records across 741 large breaches, driven by Change Healthcare's 192.7 million. 2025 fell to about 141 million people but set a new high of 804 reports. Through September 2026, the portal lists 592 more. Breaches cost healthcare more than any other industry, $6.64 million on average in IBM's 2026 report. OCR announced 21 enforcement actions in 2025 and 11 settlements so far in 2026, with penalties reaching $2,190,294 per provision per year. The exposure lives where data concentrates, which makes infrastructure the first line of defense. To see what encrypted, isolated hosting would cost, request a quote for your practice.

Figures are compiled from the sources below as reported through October 20, 2026, and rounded where noted. Portal counts are our tally of both OCR portal lists on October 20, 2026, by submission date. Totals on the portal change as breaches are reported and updated. This page is general information, not legal advice.

Sources

• HHS OCR breach portal (all reported breaches of 500+ records; Under Investigation and Archive lists read October 20, 2026): ocrportal.hhs.gov

• HIPAA Journal breach statistics page (trade press; its summary gives 772 reports for 2025; updated October 15, 2026): hipaajournal.com

• HHS OCR resolution agreements and enforcement: hhs.gov

• HHS OCR newsroom (2025 and 2026 HIPAA enforcement announcements): hhs.gov

• IBM Cost of a Data Breach Report 2026: ibm.com

• IBM, "What is a data breach?" (2026 healthcare average and 247-day lifecycle): ibm.com

• IBM 2026 report press release, July 29, 2026 (encryption finding): newsroom.ibm.com

• IBM 2025 report press release, July 30, 2025 (healthcare $7.42 million and 279 days): newsroom.ibm.com

• 45 CFR § 102.3 civil penalty amounts (Federal Register, January 28, 2026): ecfr.gov

• Annual Civil Monetary Penalties Inflation Adjustment, 91 FR 3665 (January 28, 2026): federalregister.gov

• Notification of Enforcement Discretion Regarding HIPAA Civil Money Penalties, 84 FR 18151 (April 30, 2019): federalregister.gov

• 45 CFR 164.308 (risk analysis and risk management): law.cornell.edu