Supporting material
The tables, method and sources behind the briefing.
This page carries the supporting material for the briefing. It covers the last 12 months measure by measure, the third quarter, vendor involvement, every OCR enforcement action in the last two years, what OCR cited, the description gap, what closed cases say, the longer view and how we built and checked the data. Figures reflect the HHS breach portal and OCR's enforcement list as downloaded and checked on November 7, 2026.
The last 12 months, measure by measure
Large breach reports (500 or more people) on the HHS breach portal, counted by the date the report reached OCR. People affected are the counts shown on the portal in our November 7, 2026 download.
| Measure | October 2025 to September 2026 | October 2024 to September 2025 |
|---|---|---|
| Large breach reports | 778 | 820 |
| People affected (sum of reports) | 146.8 million | 91.9 million |
| Median breach size | 4,576 | 5,226 |
| Breaches of 100,000 or more people | 68 | 113 |
| Breaches of 1 million or more people | 16 | 18 |
| Hacking/IT incident, share of reports | 83.7% | 82.3% |
| Hacking/IT incident, share of people | 98.5% | 92.5% |
| Unauthorized access or disclosure, reports | 121 | 132 |
| Theft, reports | 2 | 9 |
| Loss, reports | 2 | 2 |
| Data on a network server, reports | 546 | 515 |
| Data in email, reports | 159 | 215 |
| Electronic medical record, reports | 46 | 35 |
| Paper or films, reports | 33 | 41 |
| Reports filed by health care providers | 572 | 622 |
| Reports filed by health plans | 88 | 53 |
| Reports filed by business associates | 118 | 142 |
| Business associate flagged, share of reports | 34.3% | 33.5% |
| Business associate flagged, share of people | 66.8% | 33.3% |
A report can list more than one breach type and location. The largest reports in the last 12 months were Conduent Business Services (business associate, 62.2 million, October 2025), DentaQuest (15.0 million), Aesto (9.5 million), Lumexa Imaging (5.8 million) and AdaptHealth (4.1 million). The largest in the 12 months before were Aflac (13.9 million), Episource (6.7 million), Yale New Haven Health System (5.6 million), Blue Shield of California (4.7 million) and PIH Health (2.9 million).
From January to September (same dates each year), 2026 had 600 reports and 79.2 million people, and 2025 had 633 and 74.1 million. Hacking was 85.7% of reports from January to September 2026 (82.0% in the same months of 2025), the highest share for those months in any year on the portal.
The third quarter in detail
| Measure | Q3 2026 | Q2 2026 | Q3 2025 |
|---|---|---|---|
| Large breach reports | 194 | 187 | 210 |
| People affected | 45,159,909 | 13,072,174 | 29,876,836 |
| Median breach size | 4,158 | 4,060 | 3,581 |
| Breaches of 100,000 or more | 23 | 13 | 23 |
| Breaches of 1 million or more | 6 | 3 | 6 |
| Hacking/IT incident, share of reports | 84.5% | 83.4% | 86.7% |
| Business associate flagged, share of reports | 27.8% | 30.5% | 33.3% |
| Business associate flagged, share of people | 44.5% | 27.4% | 14.7% |
| Reports filed by business associates | 30 | 28 | 42 |
| Largest Q3 2026 reports | Type | People | Submitted | Business associate flagged |
|---|---|---|---|---|
| DentaQuest, LLC | Health plan | 15,000,000 | July 16, 2026 | No |
| Aesto, LLC | Business associate | 9,540,683 | July 31, 2026 | Yes |
| AdaptHealth, LLC | Health care provider | 4,115,802 | August 14, 2026 | No |
| Unlimited Technology Systems, LLC | Business associate | 3,803,750 | July 21, 2026 | Yes |
| CareCloud, Inc. | Business associate | 3,756,469 | July 24, 2026 | Yes |
| Baylor Genetics | Health care provider | 2,810,878 | August 14, 2026 | No |
| Paradigm Healthcare Services | Business associate | 970,403 | September 14, 2026 | Yes |
All seven were reported as hacking/IT incidents involving a network server. OCR posts reports with a delay. The newest report in this download was submitted October 15, 2026, so Q3 totals may still rise as late reports appear.
Vendor-flagged reports and the 43 percent figure
The portal's "Business Associate Present" flag is set when a business associate was involved, whoever filed the report. In the last 12 months the eight largest vendor-flagged reports were all filed by the vendors themselves. They were Conduent Business Services (62.2 million), Aesto (9.5 million), Unlimited Technology Systems (3.8 million), CareCloud (3.8 million), TriZetto Provider Solutions (3.4 million), Navia Benefit Solutions (2.2 million), Insightin Health (1.9 million) and Xsolis (1.4 million). Without Conduent, vendor-flagged reports cover about 42% of the people affected in the last 12 months.
For January to June 2026, our download has 406 reports and 34.0 million people, and the portal flags a business associate in 39.2% of them. HIPAA Journal counted 397 reports at mid-year and assigns breaches by where they happened; Insurance Business, citing its analysis, reported business associate involvement in 43% of large breaches. The two figures measure different things, so each should be cited with its own source.
Every OCR settlement and penalty in the last two years
HIPAA resolution agreements and civil money penalties announced from November 8, 2024 to November 7, 2026, newest first. The finding categories are our grouping of what OCR cited; each organization's name links to the HHS source. An action resolves a breach or complaint from earlier years.
| Announced | Organization | Role | Amount | What happened | What OCR cited |
|---|---|---|---|---|---|
| October 29, 2026 | Lehigh Valley Health Network | Covered entity | $800,000 | ransomware with data theft (posted on dark web) | Risk analysis; Activity review and audit controls; Breach notification (late or missing); Impermissible use or disclosure |
| October 8, 2026 | Dr. Linda L. Shen d/b/a Shen Smiles, P.C. | Covered entity | $140,000 | right of access delay; records stolen by workforce member | Right of access; Policies, procedures and training; Safeguards (general) |
| September 17, 2026 | Ambry Genetics Corporation | Covered entity | $700,000 | phishing (email account) | Risk analysis; Access controls and termination |
| August 27, 2026 | Azul Vision, Inc. | Covered entity | $50,000 | right of access delay | Right of access |
| July 29, 2026 | OSF Healthcare System | Covered entity | $552,250 | ransomware (Nephilim) with data theft | Risk analysis; Breach notification (late or missing); Impermissible use or disclosure |
| June 18, 2026 | Spencer Gifts LLC Flexible Benefits and Welfare Benefit Plans | Covered entity | $450,000 | ransomware | Risk analysis; Policies, procedures and training |
| April 23, 2026 | Star Group, L.P. Health Benefits Plan (SG Health Plan) | Covered entity | $245,000 | ransomware with exfiltration | Risk analysis; Impermissible use or disclosure |
| April 23, 2026 | Consociate, Inc. d/b/a Consociate Health | Vendor | $225,000 | ransomware after phishing | Risk analysis |
| April 23, 2026 | Assured Imaging Affiliated Covered Entities | Covered entity | $375,000 | ransomware (PYSA) with exfiltration | Risk analysis; Breach notification (late or missing); Impermissible use or disclosure |
| April 23, 2026 | Regional Women's Health Group, LLC d/b/a Axia Women's Health | Covered entity | $320,000 | ransomware / network intrusion | Risk analysis |
| March 5, 2026 | MMG Fusion, LLC | Vendor | $10,000 | hacking (unauthorized access; PHI posted on dark web) | Risk analysis; Breach notification (late or missing); Impermissible use or disclosure |
| February 19, 2026 | Top of the World Ranch Treatment Center, LLC | Covered entity | $103,000 | phishing (email account) | Risk analysis |
| December 16, 2025 | Concentra, Inc. | Covered entity | $112,500 | right of access delay | Right of access |
| September 30, 2025 | Cadia Healthcare Facilities (five facilities) | Covered entity | $182,000 | marketing disclosure (patient success stories online without authorization) | Breach notification (late or missing); Impermissible use or disclosure; Safeguards (general) |
| August 18, 2025 | BST & Co. CPAs, LLP | Vendor | $175,000 | ransomware | Risk analysis |
| July 23, 2025 | Syracuse ASC, LLC d/b/a Specialty Surgery Center of Central New York | Covered entity | $250,000 | ransomware (PYSA) | Risk analysis; Breach notification (late or missing) |
| July 7, 2025 | Deer Oaks - The Behavioral Health Solution | Covered entity | $225,000 | web exposure (portal coding error) plus compromised account and extortion | Risk analysis; Impermissible use or disclosure |
| May 30, 2025 | Comstar, LLC | Vendor | $75,000 | ransomware | Risk analysis |
| May 28, 2025 | BayCare Health System | Covered entity | $800,000 | insider misuse (former staff credentials at affiliated practice) | Risk management; Activity review and audit controls; Access controls and termination; Policies, procedures and training |
| May 15, 2025 | Vision Upright MRI | Covered entity | $5,000 | unsecured PACS server | Risk analysis; Breach notification (late or missing) |
| April 25, 2025 | Comprehensive Neurology, PC | Covered entity | $25,000 | ransomware | Risk analysis |
| April 23, 2025 | PIH Health, Inc. | Covered entity | $600,000 | phishing (45 email accounts) | Risk analysis; Breach notification (late or missing); Impermissible use or disclosure |
| April 17, 2025 | Guam Memorial Hospital Authority | Covered entity | $25,000 | ransomware plus later hacking | Risk analysis |
| April 10, 2025 | Northeast Radiology, P.C. | Covered entity | $350,000 | unauthorized access to PACS server | Risk analysis |
| March 21, 2025 | Health Fitness Corporation | Vendor | $227,816 | web exposure (server misconfiguration indexed by crawlers) | Risk analysis |
| March 6, 2025 | Oregon Health & Science University | Covered entity | $200,000 | right of access delay | Right of access |
| February 20, 2025 | Warby Parker, Inc. | Covered entity | $1,500,000 | credential stuffing | Risk analysis; Risk management; Activity review and audit controls |
| January 15, 2025 | Northeast Surgical Group, P.C. | Covered entity | $10,000 | ransomware with exfiltration | Risk analysis |
| January 15, 2025 | South Broward Hospital District d/b/a Memorial Healthcare System | Covered entity | $60,000 | right of access delay | Right of access |
| January 14, 2025 | Solara Medical Supplies, LLC | Covered entity | $3,000,000 | phishing (8 email accounts) plus misaddressed notice letters | Risk analysis; Risk management; Breach notification (late or missing) |
| January 8, 2025 | USR Holdings, LLC | Vendor | $337,750 | database intrusion with deletion of ePHI | Risk analysis; Activity review and audit controls; Contingency and backup |
| January 7, 2025 | Virtual Private Network Solutions, LLC | Vendor | $90,000 | ransomware | Risk analysis |
| January 7, 2025 | Elgon Information Systems | Vendor | $80,000 | ransomware via open firewall ports | Risk analysis |
| December 10, 2024 | Inmediata Health Group, LLC | Covered entity | $250,000 | web exposure (PHI indexed by search engines) | Risk analysis; Activity review and audit controls; Impermissible use or disclosure |
| December 5, 2024 | Children's Hospital Colorado | Covered entity | $548,265 | phishing (MFA disabled; users granted mailbox access) | Risk analysis; Policies, procedures and training |
| December 3, 2024 | Gulf Coast Pain Consultants, LLC d/b/a Clearway Pain Solutions Institute | Covered entity | $1,190,000 | insider (former contractor access) | Risk analysis; Activity review and audit controls; Access controls and termination |
| November 26, 2024 | Holy Redeemer Family Medicine | Covered entity | $35,581 | impermissible disclosure to employer (reproductive health) | Impermissible use or disclosure |
| November 19, 2024 | Rio Hondo Community Mental Health Center | Covered entity | $100,000 | right of access delay | Right of access |
| Measure | November 8, 2025 to November 7, 2026 | November 8, 2024 to November 7, 2025 |
|---|---|---|
| Actions announced | 13 | 25 |
| Total amounts | $4,082,750 | $10,341,412 |
| Median amount | $245,000 | $200,000 |
| Against business associates | 2 | 6 |
| Cite a risk analysis failure | 10 | 19 |
| Followed ransomware | 7 | 8 |
| Right of access cases | 3 | 3 |
| Started from a breach report | 9 | 15 |
What OCR cited, by year
Counted by announcement year. An action can cite several findings. Safeguards (general), cited once in 2025 and once in 2026, is not shown.
| Finding | 2026 (to November 7) | 2025 | 2024 |
|---|---|---|---|
| Actions | 12 | 21 | 15 |
| Risk analysis | 10 | 16 | 9 |
| Impermissible use or disclosure | 5 | 3 | 3 |
| Breach notice late or missing | 4 | 5 | 0 |
| Right of access | 2 | 3 | 4 |
| Policies, procedures and training | 2 | 1 | 1 |
| Activity review and audit controls | 1 | 3 | 6 |
| Access controls and termination | 1 | 1 | 3 |
| Risk management | 0 | 3 | 2 |
| No business associate agreement | 0 | 0 | 2 |
| Contingency and backup | 0 | 1 | 1 |
The description gap, year by year
OCR's written description of a breach appears only once the case is closed. All 746 open reports in our download have none, and 7,146 of the 7,331 closed reports have one. Share of each year's reports with a description, and how the described reports differ from the rest, as of November 7, 2026.
| Reported in | Share with a description | Median people, described | Median people, not yet | Hacking, described | Hacking, not yet | Vendor flagged, described | Vendor flagged, not yet |
|---|---|---|---|---|---|---|---|
| 2023 | 97.0% | 7,457 | 11,527 | 81.5% | 81.8% | 37.5% | 27.3% |
| 2024 | 86.9% | 6,701 | 18,182 | 80.9% | 93.8% | 29.8% | 30.9% |
| 2025 | 61.8% | 4,000 | 7,787 | 76.2% | 88.4% | 41.7% | 24.5% |
| 2026 | 31.5% | 2,896 | 5,385 | 66.3% | 94.4% | 64.8% | 21.8% |
As of November 7, 2026, reports from 2018 to 2022 are 98 to 100% described, which suggests the gap narrows as OCR closes older cases. Until it does, recent figures drawn from the descriptions lean toward smaller cases (a lower median every year shown) and, from 2024 on, toward fewer hacking incidents. This page uses them only for the closed-case figures below, which describe mostly 2018 to 2024.
What OCR's closed-case descriptions say
We labeled OCR's descriptions of closed cases with keyword rules and checked them by hand against 260 cases, a 200-case sample used to tune the rules plus a 60-case holdout scored before the final fixes. On the holdout, the rules matched the hand labels exactly in 85% of cases for attack type, 97% for vendor involvement and 98% for OCR's outcome. These figures describe mostly 2018 to 2024; see the gap above.
- Hacking appears in 46% of described cases from 2018 and 82% from 2023.
- Ransomware is named in 26 to 32% of described cases each year from 2020 to 2024.
- OCR's write-ups name the attack method less often than they used to, in 81% of hacking descriptions in 2018 and 52% in 2023. Recent shares for specific attack types are likely undercounts, because many descriptions say only "cyberattack" or "hacking incident."
- From 2018 to 2023, the descriptions place the incident at a business associate or vendor, or say one caused it, in about a third of described cases (32.7%), covering about half of the people affected (52.9%).
- In the 867 described phishing or email compromise cases from 2018 to 2023, the write-ups name training or retraining in 69% and multifactor authentication in 3%. That is what OCR wrote down, not a full list of what organizations did.
- Only 0.7% of described closed cases from 2018 to 2026 (35 of 5,014) mention a resolution agreement, corrective action plan or civil money penalty, and 86.5% say the organization took corrective actions before OCR closed the case. The portal text is not a full enforcement record, because a settlement can be announced years after a case is described.
The longer view, 2018 to 2026
Context for the last two years, with OCR enforcement actions counted by announcement year.
| Year | Actions | Total | Median | Against vendors | Cite risk analysis | Followed ransomware | Right of access |
|---|---|---|---|---|---|---|---|
| 2018 | 10 | $25.7 million | $442,000 | 2 | 3 | 0 | 0 |
| 2019 | 11 | $15.3 million | $1.6 million | 1 | 7 | 0 | 2 |
| 2020 | 19 | $13.6 million | $70,000 | 1 | 6 | 0 | 11 |
| 2021 | 14 | $6.0 million | $67,500 | 0 | 2 | 0 | 12 |
| 2022 | 22 | $2.2 million | $40,000 | 0 | 1 | 0 | 17 |
| 2023 | 13 | $4.2 million | $100,000 | 3 | 6 | 1 | 4 |
| 2024 | 15 | $9.1 million | $240,000 | 0 | 9 | 6 | 4 |
| 2025 | 21 | $8.3 million | $182,000 | 6 | 16 | 8 | 3 |
| 2026 (to November 7) | 12 | $4.0 million | $282,500 | 2 | 10 | 7 | 2 |
From 2020 to 2022 most actions were small right of access cases; since 2024 most cite the risk analysis and many follow ransomware. 2018 includes Anthem's $16 million. Large breach reports by full year were 369 in 2018, 663 in 2020, 718 in 2022, 741 in 2024 and 811 in 2025, with hacking rising from 45% of reports in 2018 to 81% in 2025.
How we built and checked the data
- Breaches. The official CSV and Excel exports of both portal tabs, Under Investigation (746 reports) and Archive (7,331 reports), downloaded November 7, 2026, and compared row by row with an independent scripted download: every row matched.
- Enforcement. 137 HIPAA resolution agreements and civil money penalties announced from January 2018 to October 2026, from OCR's enforcement list. Amounts and dates for 2024 to 2026 were checked on the live HHS pages or HHS's official archive, and the findings against the HHS release text; 2018 to 2023 were checked against archived copies of the HHS pages and the live list.
- Counting. Breaches by the date the report reached OCR (the only date the portal gives); enforcement by announcement date. "People affected" is the count the portal showed on November 7, 2026. The portal covers breaches of 500 or more people.
- Refresh. We repeat this every quarter, and recent figures will change as OCR posts late reports and closes cases.
Sources
- HHS OCR, Breach Portal: Notice to the Secretary of HHS Breach of Unsecured Protected Health Information, exports downloaded November 7, 2026
- HHS OCR, Resolution Agreements and Civil Money Penalties, read November 7, 2026
- HHS, OCR settles ransomware investigation of Lehigh Valley Health Network, October 29, 2026
- HHS, OCR settles HIPAA investigation of MMG Fusion, March 5, 2026
- HHS, OCR settles four ransomware investigations, April 23, 2026
- HIPAA Journal, H1 2026 health care data breach report
- Insurance Business, reporting HIPAA Journal's 43 percent figure, October 23, 2026
- HHS OCR, proposed HIPAA Security Rule, 90 FR 898, January 6, 2025
Briefings summarize public sources in our own words and link to the originals. They are for awareness and are not legal or compliance advice. If you want to know how any of this applies to your organization, ask us.