Flagship service

Risk MethodologyOne workshop, ready in less than a week. Puts risk in business terms your leadership can act on. Instant price estimateRisk assessment scope and price range in about 3 minutes.

Assess

Risk Assessment Gap Assessment Strategy & Maturity Skills & Capability Vulnerability Scanning

Build

Data Governance & Classification M365 Security Implementation Control Standards Policy Development BCP/DR Plans

Maintain

Vulnerability Management M365 Policy Management IR Tabletop Exercises

Lead

Fractional CISO Strategy & Planning Board Presentations
IndustryHigher EducationGLBA risk assessments, FERPA, research security and HECVAT. Incident reporting deadlines → Briefings and resources →
IndustryFinancial ServicesGLBA, FFIEC guidance and the move to NIST CSF 2.0. NYDFS Part 500 → NYDFS risk assessment brief → Briefings and resources →
IndustryTechnologySOC 2 readiness and real security, including Microsoft 365, Azure and AWS hardening. Briefings and resources →
IndustryHealthcareHIPAA risk analysis, HICP and HITRUST readiness. HIPAA Security Rule rewrite (2027) → HIPAA breaches and enforcement, Q3 2026 → Briefings and resources →
More industries
  • Nonprofits
  • Manufacturing
  • Government
  • Legal
Every other industry →
Briefing · November 2026Fewer HIPAA breach reports, far more people affected. What changed in the last 12 months?HIPAA breaches and OCR enforcement in the last 12 months. Briefing · November 2026The HIPAA Security Rule rewrite is projected for July 2027. What should you change before then?What to change before the HIPAA Security Rule rewrite lands. November 2026 · LatestAI agents just became an identity problemNIST, CISA and Australia's ASD: what it means for your risk. September 2026Good risk decisions start with good dataNYDFS, CISA and NIST guidance, and what it means for your risk.
In each update

New security guidance in plain language: what changed, what it means for your risk, and the questions to ask your team.

See the archive →Resources: briefs and guides →Roundup →Free guide: security for a business of one →
ApproachTeamUpdatesAll servicesInstant price estimate

Updates

Monthly2 editions November 2026 (latest) September 2026 Archive: all editions Resources: briefs and guides Roundup Free guide: cybersecurity for consultants and solo business owners
Briefings2 topics HIPAA breaches and enforcement, Q3 2026 The HIPAA Security Rule rewrite

Industries

Industry4 industries Higher Education Incident reporting deadlines Financial Services NYDFS Part 500 NYDFS risk assessment brief Technology Healthcare HIPAA Security Rule rewrite (2027) HIPAA breaches and enforcement, Q3 2026

Also nonprofits, manufacturing, government and legal. Every other industry

Services

Flagship serviceRisk Methodology Risk Methodology
Assess5 services Risk Assessment Gap Assessment Strategy & Maturity Skills & Capability Vulnerability Scanning
Build5 services Data Governance & Classification M365 Security Implementation Control Standards Policy Development BCP/DR Plans
Maintain3 services Vulnerability Management M365 Policy Management IR Tabletop Exercises
Lead3 services Fractional CISO Strategy & Planning Board Presentations
Book a consultation

Briefing

HIPAA breaches and enforcement, Q3 2026

Share
Security updates by email

Get each update the day it's out.

A monthly digest of the stories that matter most, plus special reports when something needs a closer look. Every story ends with the questions to ask your team. Unsubscribe in one click.

We send a confirmation link first, so only you can add this address. Privacy

Fewer HIPAA breach reports, far more people affected. What changed in the last 12 months?

We analyzed every large breach report on HHS's breach portal and every HIPAA enforcement action OCR has announced, downloaded and checked in November 2026. In the 12 months to September 2026, organizations reported 778 breaches of 500 or more people, 5 percent fewer than the year before. The people affected, as first reported and added across reports, rose 60 percent, to about 147 million. Hacking incidents account for almost all of those people, and reports involving a vendor, including the largest, covered two thirds of them. OCR announced half as many enforcement actions as the year before, and three in four still cite the risk analysis. Part five explains what the data cannot tell us yet. The people affected have concentrated in hacking incidents and vendor breaches, and the risk analysis is still the requirement OCR cites most often when it settles a case.

Talk it through with usRead the briefing
Briefing one topic, six partsPublished November 2026Short answer 2 minutesFull detail when you need it

The short answer

Fewer reports, a few very large breaches. Hacking and vendors drive the numbers.

Compared with the year before, the last 12 months had slightly fewer large breach reports, far more people affected, and almost all of them in hacking incidents. Reports that involved a vendor stayed at about a third of the total but covered two thirds of the people. On enforcement, OCR announced fewer actions, more of them followed ransomware, and the risk analysis remained the finding OCR cites most. For covered entities and vendors alike, the practical response is a current risk analysis that covers every system and vendor handling patient data, evidence that the risks found were reduced, and a tested recovery and notification process. The notes page has every table, the method and the sources.

Read this first. OCR writes its description of a breach only when it closes the case. As of November 2026, 62 percent of 2025 reports and 32 percent of 2026 reports have one, so the attack method, root cause and OCR's findings for most recent breaches are not public yet. The numbers in this briefing come from the fields every report has, and part five explains what the gap hides and how it skews recent figures.

  1. 01Fewer reports, far more people778 reports and about 147 million people in 12 monthsDiscussBreach trends
  2. 02Hacking is almost everyone affected98.5 percent of people affected; theft and loss nearly goneDiscussAttack trends
  3. 03Vendors behind the biggest breachesA third of reports, two thirds of the peopleDiscussVendor risk
  4. 04What OCR enforced in the last 12 monthsHalf as many actions; the risk analysis still comes firstAct nowEnforcement
  5. 05What the data cannot tell us yetMost recent breaches have no OCR descriptionWatchReading the data
  6. 06What to do with thisFour things to check before the next quarterDiscussRisk management
  7. ?The three questions a skeptical CISO will askShort answers, ready before they come upBefore you are asked

Breach trends

Fewer reports, far more people.

The count of large breaches dipped. The number of people affected rose sharply, because of a handful of very large breaches.

What it is

HIPAA requires covered entities to report breaches affecting 500 or more people to HHS, which lists them on its breach portal. In the 12 months from October 2025 to September 2026, the portal lists 778 such reports, against 820 in the 12 months before, a drop of 5 percent. The people affected rose from 91.9 million to 146.8 million, up 60 percent, as first reported. A few reports drive that: Conduent Business Services, a vendor, reported 62.2 million people in October 2025, followed by DentaQuest (15.0 million), Aesto (9.5 million), Lumexa Imaging (5.8 million) and AdaptHealth (4.1 million). Meanwhile breaches of 100,000 or more people fell from 113 to 68, and the median breach dropped from 5,226 to 4,576 people. Breaches of a million or more people fell slightly, from 18 to 16. The calendar year points the same way, less sharply. January to September 2026 had 600 reports, against 633 in the same months of 2025, and 79.2 million people, up about 7 percent from 74.1 million. Most of the difference is Conduent, reported in October 2025. In the third quarter alone, 194 reports covered 45.2 million people, the largest quarter of 2026 by people affected.

What's the risk

A falling count does not mean falling risk. The people affected, and the cost that follows for the organizations involved, depend on a few very large breaches, and those tend to involve systems that hold or process data for many organizations at once. The portal lists only the date a report reached OCR, not when the breach happened, and OCR posts reports with a delay. The newest report in our November 7 download was submitted on October 15, so later downloads may add reports to the third quarter. The "people affected" figure is the one first reported and is not always updated.

What's the impact

  • Plan for the large breach. The median breach shrank, while a handful of breaches covered most of the people affected. Recovery and notification plans need to work at that scale.
  • Know which of your systems hold data for many patients. The largest breaches involve systems that pool records, such as claims, billing and imaging platforms, run by you or for you.
  • Treat a quiet quarter with caution. Recent counts rise as OCR posts more reports, so a quarter that just closed will look smaller than it ends up. Compare it only with quarters measured at the same point.

Questions to ask your team

  • Which of our systems, or our vendors' systems, hold records for the largest number of patients?
  • If one of them were breached, how many people would we have to notify, and how long would that take?
  • Has our notification process been tested at that scale?

Go deeper: the last 12 months, measure by measure and the third quarter in detail.

How we help

Risk Assessment → BCP / DR Plans → IR Tabletop Exercises →

Attack trends

Hacking incidents cover almost everyone affected.

Stolen and lost devices have nearly disappeared from the list. Large breaches are now network intrusions.

What it is

Each portal report names the type of breach and where the data was. In the last 12 months, "Hacking/IT Incident" was the type in 83.7 percent of reports and covered 98.5 percent of the people affected, up from 82.3 and 92.5 percent the year before. For January to September 2026, the hacking share of reports, 85.7 percent, is the highest of any year in the portal's history for those months. Theft and loss have almost gone: two thefts and two losses in 12 months, against nine thefts the year before. The data sat on a network server in 546 of the 778 reports, up from 515, and in email in 159, down from 215. Paper and films fell from 41 to 33.

What's the risk

"Hacking/IT Incident" covers ransomware, phishing, stolen passwords and exploited flaws alike, and the portal does not say which. The descriptions that would say are not yet written for most recent cases (part five). What the portal does show is that the exposure sits on servers and in email accounts, the places that multifactor authentication, network segmentation, encryption and log review protect. The drop in email reports may reflect better email controls, a shift by attackers or simply how reports were categorized; the data available today cannot tell those apart.

What's the impact

  • Give identity and server protection more weight than device rules. Lost and stolen devices are now a small share of large breaches, while hacking or IT incidents covered almost all of the people affected.
  • Check that multifactor authentication covers servers and remote access. Email-only coverage leaves the systems where most breached data sat.
  • Make someone responsible for reviewing logs. OCR's latest settlement cites the failure to regularly review system activity (part four).

Questions to ask your team

  • Where do we still allow access to systems holding patient data with only a password?
  • Which servers hold the most patient data, and who reviews their access logs, and how often?
  • If an attacker were inside our network today, what would alert someone who can act?

Go deeper: breach types and locations, both years and what closed cases say about attack methods.

How we help

Vulnerability Management → M365 Security Implementation → Vulnerability Scanning →

Vendor risk

Vendors behind the biggest breaches.

Vendor-involved breaches are a steady third of reports. In the last 12 months they covered two thirds of the people affected.

What it is

Each portal report says whether a business associate, a vendor handling patient data for a covered entity, was present. In the last 12 months, a vendor was flagged in 34.3 percent of reports, about the same as the 33.5 percent the year before. Those reports covered 66.8 percent of the people affected, up from 33.3 percent. Conduent's 62.2 million people account for much of the jump; without it, vendor-flagged reports still cover about 42 percent of the people. The eight largest vendor-flagged reports were all filed by the vendors themselves: Conduent, Aesto, Unlimited Technology Systems, CareCloud, TriZetto Provider Solutions, Navia Benefit Solutions, Insightin Health and Xsolis. Vendors filed 118 reports in all, against 142 the year before. You may also see a figure of 43 percent for the first half of 2026: Insurance Business reported it from HIPAA Journal's analysis, which assigns breaches by where they happened. By the portal's own flag, the figure for the same months is about 39 percent.

What's the risk

A covered entity's patients can be affected by a breach at a vendor it does not run and may not monitor, and one vendor breach can reach the patients of many covered entities at once. Under the current rule, a business associate must notify the covered entity of a breach without unreasonable delay and no later than 60 days after discovery, and the covered entity still has its own notification duties to its patients. OCR enforces against vendors directly: in March 2026 it settled with MMG Fusion, a dental software company, which had not notified its customers. The proposed HIPAA Security Rule would require covered entities to get written verification, at least once every 12 months, that each business associate has put the required technical safeguards in place.

What's the impact

  • Rank vendors by how many of your patients' records they hold. The largest breaches come from platforms that pool data, so review those vendors first and most deeply.
  • Know what each critical vendor will tell you and how fast. Agree on breach notice terms and named contacts before an incident.
  • Plan your own notifications for a vendor's breach. When a vendor is breached, your patients still hear from you, so rehearse it.

Questions to ask your team

  • Which of our vendors hold records for the most patients, and when did we last review their security evidence?
  • How quickly do our contracts require each of them to tell us about a breach?
  • Have we ever run a tabletop where the breach happens at a vendor?

Go deeper: vendor-flagged reports and the 43 percent figure.

How we help

Risk Assessment → Control Standards → IR Tabletop Exercises →

Enforcement

What OCR enforced in the last 12 months.

OCR announced half as many actions as the year before. What it cites has not changed.

What it is

From November 2025 to early November 2026, OCR announced 13 HIPAA enforcement actions, totaling $4.08 million, against 25 actions and $10.34 million in the 12 months before. Ten of the 13 cite a failure to conduct an accurate and thorough risk analysis, about the same share as the year before (19 of 25). Seven followed ransomware attacks, a larger share than the 8 of 25 the year before. Four cite late or missing breach notification. Two were against vendors, MMG Fusion and Consociate Health, down from six. Eleven of the 13 came with a corrective action plan, two or three years of OCR monitoring. The most recent, announced October 29, 2026, is Lehigh Valley Health Network: $800,000 after a 2023 ransomware attack affecting 248,359 people, in which patient information, including sensitive photographs of cancer patients, was posted on the dark web. OCR cited the risk analysis, the failure to regularly review records of system activity such as audit logs, the impermissible disclosure, and late notice to patients and to HHS. OCR's director said the best defense against cyberattacks is full implementation of the HIPAA Security Rule.

What's the risk

Enforcement actions are few next to breach reports: OCR announced 13 in the last 12 months, while about 780 large breaches were reported, and the actions mostly resolve breaches and complaints from earlier years. But enforcement arrives years after the breach (MMG Fusion's incident was in 2020, Lehigh Valley's in 2023), it usually comes with two or three years of OCR monitoring and a public record, and most actions cite the same requirement, the risk analysis. The settlement amounts are only part of the cost, since recovery and notification after a breach add to it. OCR can also take an organization's financial condition into account, as it did for MMG Fusion. The current rule already requires everything OCR cited in these cases; none of it depends on the proposed rewrite.

What's the impact

  • Expect OCR to ask for the risk analysis. It was cited in 10 of the 13 actions. It needs a date, a full scope including vendors, and evidence that the risks found were addressed.
  • Log review is on OCR's list too. Lehigh Valley's settlement cites the failure to regularly review system activity. Assign it, schedule it and keep the record.
  • Breach notice timing is a finding in its own right. Four of the 13 actions cite late or missing notice, on top of whatever caused the breach.

Questions to ask your team

  • When was our risk analysis last updated, and does it cover every system and vendor that handles patient data today?
  • Who reviews our system activity and audit logs, how often, and where is that recorded?
  • From discovery of a breach, how many days would it take us to notify patients and HHS?

Go deeper: every action in the last two years and what OCR cited, by year.

How we help

Risk Methodology → Risk Assessment → Policy Development →

Reading the data

What the data cannot tell us yet.

For most recent breaches, OCR's account of what happened is not public yet. That limits what anyone can say about recent causes.

What it is

When OCR closes a breach investigation, it adds a written description to the portal: how the breach happened, whether a vendor was involved, what the organization fixed and what OCR required. Open cases have no description. This is how the portal is designed, and older years show the gap closes: 98 to 100 percent of reports from 2018 to 2022 now have one. But large investigations take years. As of November 7, 2026, 97 percent of 2023 reports have a description, 87 percent of 2024 reports, 62 percent of 2025 reports and 32 percent of 2026 reports. The cases described so far are not typical of the rest. Among 2026 reports, the described ones have a median of 2,896 people against 5,385 for the rest, 66 percent are hacking against 94 percent, and 65 percent are vendor-flagged against 22 percent. The 2025 reports show the same pattern: a median of 4,000 against 7,787, and hacking at 76 against 88 percent.

What's the risk

For 2025 and 2026, the public data cannot tell us the attack method behind most "Hacking/IT Incident" reports (ransomware, phishing, a stolen password or an exploited flaw), the root causes, whether an incident happened at a vendor beyond the portal's own flag, what OCR found or required, or what the organizations fixed. Any recent share calculated from the descriptions leans toward smaller cases that are less often hacking, so recent attack-type shares can be off in either direction, and comparing them with older years is not like for like. OCR's descriptions have also become less specific: in 2018, 81 percent of hacking descriptions named the method, and in 2023, 52 percent did. The more dependable recent figures are the ones every report carries, allowing for late postings and first-reported counts: the count, the people affected, the type of breach, where the data was and the vendor flag. That is what this briefing uses.

What's the impact

  • Be careful with claims about recent attack causes. A headline saying ransomware or phishing rose or fell in 2026 cannot rest on the portal's descriptions yet. Ask where the number came from.
  • Use your own incident data for causes. Your incident records, your vendors' reports and sector threat intelligence say more about current attack methods than the public breach list can today.
  • Expect these numbers to move. We refresh this analysis every quarter, and recent figures will change as OCR closes cases and posts late reports.

Questions to ask your team

  • When we brief the board on breach trends, do we say which numbers are settled and which are early?
  • What do our own incident records say about how attackers got in over the last two years?
  • Where do we get current threat information for health care, beyond the public breach list?

Go deeper: the description gap, year by year and how we built and checked the data.

How we help

Board Presentations → Fractional CISO → IR Tabletop Exercises →

Risk management

What to do with this.

Together, the breach reports (where large breaches happen) and OCR's enforcement record (what it cites afterward) point to the same short list.

What it is

OCR's own recommendations in its 2026 settlements include identifying where electronic patient data is and how it flows, conducting and updating a risk analysis with a risk management plan, keeping audit controls in place and reviewing system activity regularly, authenticating users, encrypting data in transit and at rest where appropriate, and giving staff regular role-specific training. These all rest on the current HIPAA Security Rule. Some, such as encryption, are "addressable" today, which means an organization must implement them where reasonable and appropriate or document why not and what it does instead. The proposed rewrite, which the 2026 Unified Agenda projects for final action in July 2027, would make several of them more specific, such as yearly written verification of business associates' safeguards and restoring critical systems and data within 72 hours. Our briefing on the HIPAA Security Rule rewrite covers that proposal.

What's the risk

The two risks compound. Hacking incidents, at covered entities or their vendors, make up most of the breach list, and if one leads to an investigation, a missing risk analysis or unreviewed logs can become findings of their own. Organizations that have the documents but cannot show the risks were reduced are in a weaker position than those that can show the work.

What's the impact

  • Date and scope the risk analysis this quarter. Cover every system and vendor that handles patient data, and keep the risk management plan with owners and closures next to it.
  • Review your largest vendors first. Start with the ones that hold the most patient records, and confirm their breach notice terms and contacts.
  • Prove that logs get reviewed and systems can be recovered. A record of which logs were reviewed, by whom and what followed, and a timed restore of a critical system, show that the controls are working.
  • Test breach notification end to end, from discovery to notice to patients and HHS, including a breach that happened at a vendor.

Questions to ask your team

  • If OCR asked tomorrow, could we show our risk analysis, the risks it found and what we did about each one?
  • Which five vendors hold the most of our patients' data, and what have they shown us this year?
  • When did we last restore a critical system from backup, and how long did it take?

Go deeper: the enforcement record and the longer view, 2018 to 2026.

How we help

Gap Assessment → Risk Assessment → BCP / DR Plans → Fractional CISO →

Before you are asked

The three questions a skeptical CISO will ask.

The short answers are here. The tables, the method and the sources are in the Go deeper panels below, and on their own notes page.

  1. Breach reports went down. Why should our risk picture change?

    Because the people affected went up 60 percent, and almost all of them were in hacking incidents, many at vendors. The count of large breach reports fell 5 percent in the last 12 months, but the size of the largest breaches grew, and the median breach got smaller. In these reports, most of the people affected were in a few breaches of systems that hold many patients' records, run by the organization or by a vendor. That is where the review effort should go.

  2. OCR brought only 13 actions in a year. Why invest in compliance evidence?

    Because when a breach or complaint leads to an investigation, OCR looks at what the organization can show it did. Ten of the 13 actions cite the risk analysis, and the cases arrive years after the breach, with two or three years of monitoring attached. The same work (a current risk analysis, a risk management plan with closures, log review and tested recovery) can also reduce how likely a breach is and how much damage it does. It is required today, whatever happens to the proposed rule.

  3. Can we trust these numbers for what is happening right now?

    For counts, sizes, breach types, locations and vendor involvement, yes, with the caveat that the latest quarter can grow as OCR posts late reports. For attack methods, root causes and OCR's findings on recent breaches, the data is not there yet. Only 32 percent of 2026 reports and 62 percent of 2025 reports have OCR's description, and those described so far are smaller and less often hacking than the rest. We state that limit wherever it applies and refresh the figures every quarter.

Go deeper

The notes behind this page.

Open any section. The same material is on the notes page when you want to share or print it.

The last 12 months, measure by measure

Large breach reports (500 or more people) on the HHS breach portal, counted by the date the report reached OCR. People affected are the counts shown on the portal in our November 7, 2026 download.

MeasureOctober 2025 to September 2026October 2024 to September 2025
Large breach reports778820
People affected (sum of reports)146.8 million91.9 million
Median breach size4,5765,226
Breaches of 100,000 or more people68113
Breaches of 1 million or more people1618
Hacking/IT incident, share of reports83.7%82.3%
Hacking/IT incident, share of people98.5%92.5%
Unauthorized access or disclosure, reports121132
Theft, reports29
Loss, reports22
Data on a network server, reports546515
Data in email, reports159215
Electronic medical record, reports4635
Paper or films, reports3341
Reports filed by health care providers572622
Reports filed by health plans8853
Reports filed by business associates118142
Business associate flagged, share of reports34.3%33.5%
Business associate flagged, share of people66.8%33.3%

A report can list more than one breach type and location. The largest reports in the last 12 months were Conduent Business Services (business associate, 62.2 million, October 2025), DentaQuest (15.0 million), Aesto (9.5 million), Lumexa Imaging (5.8 million) and AdaptHealth (4.1 million). The largest in the 12 months before were Aflac (13.9 million), Episource (6.7 million), Yale New Haven Health System (5.6 million), Blue Shield of California (4.7 million) and PIH Health (2.9 million).

From January to September (same dates each year), 2026 had 600 reports and 79.2 million people, and 2025 had 633 and 74.1 million. Hacking was 85.7% of reports from January to September 2026 (82.0% in the same months of 2025), the highest share for those months in any year on the portal.

The third quarter in detail
MeasureQ3 2026Q2 2026Q3 2025
Large breach reports194187210
People affected45,159,90913,072,17429,876,836
Median breach size4,1584,0603,581
Breaches of 100,000 or more231323
Breaches of 1 million or more636
Hacking/IT incident, share of reports84.5%83.4%86.7%
Business associate flagged, share of reports27.8%30.5%33.3%
Business associate flagged, share of people44.5%27.4%14.7%
Reports filed by business associates302842
Largest Q3 2026 reportsTypePeopleSubmittedBusiness associate flagged
DentaQuest, LLCHealth plan15,000,000July 16, 2026No
Aesto, LLCBusiness associate9,540,683July 31, 2026Yes
AdaptHealth, LLCHealth care provider4,115,802August 14, 2026No
Unlimited Technology Systems, LLCBusiness associate3,803,750July 21, 2026Yes
CareCloud, Inc.Business associate3,756,469July 24, 2026Yes
Baylor GeneticsHealth care provider2,810,878August 14, 2026No
Paradigm Healthcare ServicesBusiness associate970,403September 14, 2026Yes

All seven were reported as hacking/IT incidents involving a network server. OCR posts reports with a delay. The newest report in this download was submitted October 15, 2026, so Q3 totals may still rise as late reports appear.

Vendor-flagged reports and the 43 percent figure

The portal's "Business Associate Present" flag is set when a business associate was involved, whoever filed the report. In the last 12 months the eight largest vendor-flagged reports were all filed by the vendors themselves. They were Conduent Business Services (62.2 million), Aesto (9.5 million), Unlimited Technology Systems (3.8 million), CareCloud (3.8 million), TriZetto Provider Solutions (3.4 million), Navia Benefit Solutions (2.2 million), Insightin Health (1.9 million) and Xsolis (1.4 million). Without Conduent, vendor-flagged reports cover about 42% of the people affected in the last 12 months.

For January to June 2026, our download has 406 reports and 34.0 million people, and the portal flags a business associate in 39.2% of them. HIPAA Journal counted 397 reports at mid-year and assigns breaches by where they happened; Insurance Business, citing its analysis, reported business associate involvement in 43% of large breaches. The two figures measure different things, so each should be cited with its own source.

Every OCR settlement and penalty in the last two years

HIPAA resolution agreements and civil money penalties announced from November 8, 2024 to November 7, 2026, newest first. The finding categories are our grouping of what OCR cited; each organization's name links to the HHS source. An action resolves a breach or complaint from earlier years.

AnnouncedOrganizationRoleAmountWhat happenedWhat OCR cited
October 29, 2026Lehigh Valley Health NetworkCovered entity$800,000ransomware with data theft (posted on dark web)Risk analysis; Activity review and audit controls; Breach notification (late or missing); Impermissible use or disclosure
October 8, 2026Dr. Linda L. Shen d/b/a Shen Smiles, P.C.Covered entity$140,000right of access delay; records stolen by workforce memberRight of access; Policies, procedures and training; Safeguards (general)
September 17, 2026Ambry Genetics CorporationCovered entity$700,000phishing (email account)Risk analysis; Access controls and termination
August 27, 2026Azul Vision, Inc.Covered entity$50,000right of access delayRight of access
July 29, 2026OSF Healthcare SystemCovered entity$552,250ransomware (Nephilim) with data theftRisk analysis; Breach notification (late or missing); Impermissible use or disclosure
June 18, 2026Spencer Gifts LLC Flexible Benefits and Welfare Benefit PlansCovered entity$450,000ransomwareRisk analysis; Policies, procedures and training
April 23, 2026Star Group, L.P. Health Benefits Plan (SG Health Plan)Covered entity$245,000ransomware with exfiltrationRisk analysis; Impermissible use or disclosure
April 23, 2026Consociate, Inc. d/b/a Consociate HealthVendor$225,000ransomware after phishingRisk analysis
April 23, 2026Assured Imaging Affiliated Covered EntitiesCovered entity$375,000ransomware (PYSA) with exfiltrationRisk analysis; Breach notification (late or missing); Impermissible use or disclosure
April 23, 2026Regional Women's Health Group, LLC d/b/a Axia Women's HealthCovered entity$320,000ransomware / network intrusionRisk analysis
March 5, 2026MMG Fusion, LLCVendor$10,000hacking (unauthorized access; PHI posted on dark web)Risk analysis; Breach notification (late or missing); Impermissible use or disclosure
February 19, 2026Top of the World Ranch Treatment Center, LLCCovered entity$103,000phishing (email account)Risk analysis
December 16, 2025Concentra, Inc.Covered entity$112,500right of access delayRight of access
September 30, 2025Cadia Healthcare Facilities (five facilities)Covered entity$182,000marketing disclosure (patient success stories online without authorization)Breach notification (late or missing); Impermissible use or disclosure; Safeguards (general)
August 18, 2025BST & Co. CPAs, LLPVendor$175,000ransomwareRisk analysis
July 23, 2025Syracuse ASC, LLC d/b/a Specialty Surgery Center of Central New YorkCovered entity$250,000ransomware (PYSA)Risk analysis; Breach notification (late or missing)
July 7, 2025Deer Oaks - The Behavioral Health SolutionCovered entity$225,000web exposure (portal coding error) plus compromised account and extortionRisk analysis; Impermissible use or disclosure
May 30, 2025Comstar, LLCVendor$75,000ransomwareRisk analysis
May 28, 2025BayCare Health SystemCovered entity$800,000insider misuse (former staff credentials at affiliated practice)Risk management; Activity review and audit controls; Access controls and termination; Policies, procedures and training
May 15, 2025Vision Upright MRICovered entity$5,000unsecured PACS serverRisk analysis; Breach notification (late or missing)
April 25, 2025Comprehensive Neurology, PCCovered entity$25,000ransomwareRisk analysis
April 23, 2025PIH Health, Inc.Covered entity$600,000phishing (45 email accounts)Risk analysis; Breach notification (late or missing); Impermissible use or disclosure
April 17, 2025Guam Memorial Hospital AuthorityCovered entity$25,000ransomware plus later hackingRisk analysis
April 10, 2025Northeast Radiology, P.C.Covered entity$350,000unauthorized access to PACS serverRisk analysis
March 21, 2025Health Fitness CorporationVendor$227,816web exposure (server misconfiguration indexed by crawlers)Risk analysis
March 6, 2025Oregon Health & Science UniversityCovered entity$200,000right of access delayRight of access
February 20, 2025Warby Parker, Inc.Covered entity$1,500,000credential stuffingRisk analysis; Risk management; Activity review and audit controls
January 15, 2025Northeast Surgical Group, P.C.Covered entity$10,000ransomware with exfiltrationRisk analysis
January 15, 2025South Broward Hospital District d/b/a Memorial Healthcare SystemCovered entity$60,000right of access delayRight of access
January 14, 2025Solara Medical Supplies, LLCCovered entity$3,000,000phishing (8 email accounts) plus misaddressed notice lettersRisk analysis; Risk management; Breach notification (late or missing)
January 8, 2025USR Holdings, LLCVendor$337,750database intrusion with deletion of ePHIRisk analysis; Activity review and audit controls; Contingency and backup
January 7, 2025Virtual Private Network Solutions, LLCVendor$90,000ransomwareRisk analysis
January 7, 2025Elgon Information SystemsVendor$80,000ransomware via open firewall portsRisk analysis
December 10, 2024Inmediata Health Group, LLCCovered entity$250,000web exposure (PHI indexed by search engines)Risk analysis; Activity review and audit controls; Impermissible use or disclosure
December 5, 2024Children's Hospital ColoradoCovered entity$548,265phishing (MFA disabled; users granted mailbox access)Risk analysis; Policies, procedures and training
December 3, 2024Gulf Coast Pain Consultants, LLC d/b/a Clearway Pain Solutions InstituteCovered entity$1,190,000insider (former contractor access)Risk analysis; Activity review and audit controls; Access controls and termination
November 26, 2024Holy Redeemer Family MedicineCovered entity$35,581impermissible disclosure to employer (reproductive health)Impermissible use or disclosure
November 19, 2024Rio Hondo Community Mental Health CenterCovered entity$100,000right of access delayRight of access
MeasureNovember 8, 2025 to November 7, 2026November 8, 2024 to November 7, 2025
Actions announced1325
Total amounts$4,082,750$10,341,412
Median amount$245,000$200,000
Against business associates26
Cite a risk analysis failure1019
Followed ransomware78
Right of access cases33
Started from a breach report915
What OCR cited, by year

Counted by announcement year. An action can cite several findings. Safeguards (general), cited once in 2025 and once in 2026, is not shown.

Finding2026 (to November 7)20252024
Actions122115
Risk analysis10169
Impermissible use or disclosure533
Breach notice late or missing450
Right of access234
Policies, procedures and training211
Activity review and audit controls136
Access controls and termination113
Risk management032
No business associate agreement002
Contingency and backup011
The description gap, year by year

OCR's written description of a breach appears only once the case is closed. All 746 open reports in our download have none, and 7,146 of the 7,331 closed reports have one. Share of each year's reports with a description, and how the described reports differ from the rest, as of November 7, 2026.

Reported inShare with a descriptionMedian people, describedMedian people, not yetHacking, describedHacking, not yetVendor flagged, describedVendor flagged, not yet
202397.0%7,45711,52781.5%81.8%37.5%27.3%
202486.9%6,70118,18280.9%93.8%29.8%30.9%
202561.8%4,0007,78776.2%88.4%41.7%24.5%
202631.5%2,8965,38566.3%94.4%64.8%21.8%

As of November 7, 2026, reports from 2018 to 2022 are 98 to 100% described, which suggests the gap narrows as OCR closes older cases. Until it does, recent figures drawn from the descriptions lean toward smaller cases (a lower median every year shown) and, from 2024 on, toward fewer hacking incidents. This page uses them only for the closed-case figures below, which describe mostly 2018 to 2024.

What OCR's closed-case descriptions say

We labeled OCR's descriptions of closed cases with keyword rules and checked them by hand against 260 cases, a 200-case sample used to tune the rules plus a 60-case holdout scored before the final fixes. On the holdout, the rules matched the hand labels exactly in 85% of cases for attack type, 97% for vendor involvement and 98% for OCR's outcome. These figures describe mostly 2018 to 2024; see the gap above.

  • Hacking appears in 46% of described cases from 2018 and 82% from 2023.
  • Ransomware is named in 26 to 32% of described cases each year from 2020 to 2024.
  • OCR's write-ups name the attack method less often than they used to, in 81% of hacking descriptions in 2018 and 52% in 2023. Recent shares for specific attack types are likely undercounts, because many descriptions say only "cyberattack" or "hacking incident."
  • From 2018 to 2023, the descriptions place the incident at a business associate or vendor, or say one caused it, in about a third of described cases (32.7%), covering about half of the people affected (52.9%).
  • In the 867 described phishing or email compromise cases from 2018 to 2023, the write-ups name training or retraining in 69% and multifactor authentication in 3%. That is what OCR wrote down, not a full list of what organizations did.
  • Only 0.7% of described closed cases from 2018 to 2026 (35 of 5,014) mention a resolution agreement, corrective action plan or civil money penalty, and 86.5% say the organization took corrective actions before OCR closed the case. The portal text is not a full enforcement record, because a settlement can be announced years after a case is described.
The longer view, 2018 to 2026

Context for the last two years, with OCR enforcement actions counted by announcement year.

YearActionsTotalMedianAgainst vendorsCite risk analysisFollowed ransomwareRight of access
201810$25.7 million$442,0002300
201911$15.3 million$1.6 million1702
202019$13.6 million$70,00016011
202114$6.0 million$67,50002012
202222$2.2 million$40,00001017
202313$4.2 million$100,0003614
202415$9.1 million$240,0000964
202521$8.3 million$182,00061683
2026 (to November 7)12$4.0 million$282,50021072

From 2020 to 2022 most actions were small right of access cases; since 2024 most cite the risk analysis and many follow ransomware. 2018 includes Anthem's $16 million. Large breach reports by full year were 369 in 2018, 663 in 2020, 718 in 2022, 741 in 2024 and 811 in 2025, with hacking rising from 45% of reports in 2018 to 81% in 2025.

How we built and checked the data
  • Breaches. The official CSV and Excel exports of both portal tabs, Under Investigation (746 reports) and Archive (7,331 reports), downloaded November 7, 2026, and compared row by row with an independent scripted download: every row matched.
  • Enforcement. 137 HIPAA resolution agreements and civil money penalties announced from January 2018 to October 2026, from OCR's enforcement list. Amounts and dates for 2024 to 2026 were checked on the live HHS pages or HHS's official archive, and the findings against the HHS release text; 2018 to 2023 were checked against archived copies of the HHS pages and the live list.
  • Counting. Breaches by the date the report reached OCR (the only date the portal gives); enforcement by announcement date. "People affected" is the count the portal showed on November 7, 2026. The portal covers breaches of 500 or more people.
  • Refresh. We repeat this every quarter, and recent figures will change as OCR posts late reports and closes cases.
Sources
Share this update

Security updates by email

Get each update the day it's out.

A monthly digest of the stories that matter most, plus special reports when something needs a closer look: what changed, what it means for your risk, and the questions to ask your team. Unsubscribe in one click.

We send a confirmation link first, so only you can add this address. Privacy

More from us

Briefings summarize public sources in our own words and link to the originals. They are for awareness and are not legal or compliance advice. The figures reflect the HHS breach portal and OCR's enforcement list as downloaded and checked on November 7, 2026; recent figures change as OCR posts reports and closes cases. If you want to know how any of this applies to your organization, ask us.

Where to start

Not sure what OCR would ask you for?

Start with a dated risk analysis covering every system and vendor that handles patient data, the risk management plan that shows what was done about it, and the records of your last restore and log review. If any of them is missing or out of date, that is where to begin, and it is work we do.

Talk it through with usNotes, tables and sources

Want to know what this means for you?

Tell us where your organization stands with AI agents and what worries you most. We'll tell you whether it moves your risk, and what we would do first.

No obligation. We reply within one business day.

© 2026 CyberRisk One · Resources · Privacy