Healthcare Data Breach Statistics Guide: Volumes, Costs and Causes

Healthcare remains the most expensive sector for data breaches in IBM's Cost of a Data Breach research, yet many of the healthcare breach numbers quoted in board papers mix up reporting years, provisional counts and figures that were later revised. This page collects healthcare breach figures we could trace to the HHS Office for Civil Rights (OCR), the Verizon 2026 Data Breach Investigations Report (DBIR) healthcare snapshot, the IBM Cost of a Data Breach Report 2026 and OCR's own enforcement announcements. Where a figure comes from a secondary analysis of OCR data, such as the HIPAA Journal's compilation of the OCR breach portal, we say so in the same row. The scope is mainly the United States, because the OCR portal is the only large public, case-level healthcare breach dataset. It is written for healthcare CISOs, privacy officers, compliance teams and risk owners who need numbers that will survive scrutiny. Last reviewed: November 2026.

Key takeaways

• Large breach reports keep rising. A HIPAA Journal analysis of OCR portal data (as of October 2026) counts 805 breaches of 500 or more records reported in 2025, up from 741 in 2024 and 511 in 2019.
• One incident can dominate a year. Change Healthcare notified OCR on 31 July 2025 that approximately 192.7 million individuals were affected by its 2024 ransomware attack, the largest healthcare breach on record.
• Attackers, not accidents, drive volume. In the Verizon 2026 DBIR healthcare snapshot, external actors account for 81% of breaches and financial motive for 99%.
• Healthcare breaches cost the most. IBM's 2026 report puts the average healthcare breach at $6.64 million, down from $7.42 million, but still the costliest industry in that report.
• Business associates are a recurring weak point. Business associates reported 139 large breaches in 2025 (HIPAA Journal analysis of OCR data), and Verizon's 2026 data shows third parties involved in about a third of healthcare breaches.

Headline statistics

A warning about counts: in January 2026 the HIPAA Journal's provisional figure for 2025 was 697 breaches affecting 60,976,942 individuals. By October 2026 the same publisher's figure for 2025 was 805 breaches and about 138.5 million individuals, because late reports and revised totals (for example the Conduent Business Services breach, listed at 62,224,658 individuals) were added. Any healthcare breach count for the most recent year is provisional, so always quote the as-of date.

Statistics by theme

Breach volume over time

The OCR portal lists every breach of unsecured protected health information (PHI) affecting 500 or more individuals that covered entities and business associates report under the HIPAA Breach Notification Rule. The yearly totals below come from the HIPAA Journal's compilation of that portal (data obtained 10 October 2026), grouped by the year of the report.

Source for every row: HIPAA Journal, Healthcare Data Breach Statistics, last updated 15 October 2026, based on OCR breach portal data. The 2026 partial count was 529 to 25 August 2026. Note that the table records who reported the breach. When a business associate is breached, each affected covered entity may report separately, so the business associate column understates how often a vendor was the point of failure. In the HIPAA Journal's January 2026 monthly report, 21 of 46 large breaches occurred at business associates, although only six were reported by them.

Largest healthcare breaches

Three of the five largest breaches were at service providers rather than hospitals or insurers. The Change Healthcare Breach 2024 page shows how a single remote access login without MFA at a clearinghouse disrupted claims and pharmacy processing across the US and exposed data for more than half the population.

How breaches happen

Two points stand out. First, errors are still material in healthcare: misdelivery, lost devices and misconfiguration feed the Miscellaneous Errors pattern, so this sector cannot treat breaches purely as an external threat problem. Second, stolen credentials appear both as an initial access vector and in the data taken: credentials were compromised in 25% of healthcare breaches in the DBIR snapshot, which then fuels the next intrusion.

What data is taken

• Internal data: 65% of healthcare breaches in the Verizon 2026 DBIR snapshot.
• Personal data: 37%.
• Credentials: 25%.
• Other: 19%.

Verizon's categories overlap and do not map directly to HIPAA's definition of PHI, so do not present the 37% as "share of breaches exposing PHI". Under OCR rules, every breach on the portal by definition involves unsecured PHI.

Cost and enforcement

• Breach cost: IBM's 2026 Cost of a Data Breach Report puts the healthcare average at $6.64 million, down 10.5% from $7.42 million. Healthcare remained the costliest industry in the report.
• Lifecycle: IBM reports a mean of 247 days to identify and contain a breach across all sectors in 2026, reversing five years of decline. IBM's public summaries do not give a healthcare-specific figure, so do not quote one.
• OCR enforcement focus: on 19 February 2026 OCR announced a $103,000 settlement following a phishing attack that affected 1,980 patients, describing it as the 11th enforcement action in its Risk Analysis Initiative. The message is consistent: a missing or out-of-date HIPAA risk analysis (45 CFR 164.308(a)(1)(ii)(A)) is the finding OCR pursues most often after a breach.
• Rulemaking: HHS published a notice of proposed rulemaking to update the HIPAA Security Rule on 6 January 2025, with comments closing on 7 March 2025. It is a proposal, not a final rule, as of the page we checked. See the HHS HIPAA Security Rule Update (2025 NPRM) Guide.

What the numbers mean for defenders

• Plan for intrusion, not just compliance: with roughly four in five large breaches recorded as hacking or IT incidents, a HIPAA programme that stops at policies and training misses the main loss driver. Prioritise MFA on all remote access, patching of internet-facing systems and EDR coverage. See the Healthcare Identity Security Guide.
• Treat business associates as part of your estate: three of the five largest breaches were at service providers. Tier vendors by PHI volume and connectivity, and write security and notification duties into business associate agreements. See the HIPAA Business Associate Agreements Guide.
• Keep the risk analysis current: OCR's enforcement pattern means an up-to-date, enterprise-wide risk analysis is the cheapest way to reduce regulatory exposure after a breach. Use the HIPAA Security Risk Assessment Template.
• Prepare for ransomware disruption, not only data loss: Change Healthcare showed that clinical and financial operations can stop for weeks. Test downtime procedures and restore from immutable backups. See the Healthcare Incident Response Guide.
• Reduce error-driven breaches: misdelivery and misconfiguration are a steady share of incidents. Data loss prevention on email, cloud storage configuration checks and secure mail for PHI address them.

Where identity fits

Healthcare intrusions often start with an identity: a remote access account without MFA, a phished clinician mailbox or a vendor support login. Service accounts and API credentials used by integration engines, clearinghouse connections and EHR interfaces are rarely rotated and often over-privileged, and credentials appear in a quarter of healthcare breaches in the DBIR snapshot. Inventory these non-human identities with an owner and expiry, and remove standing vendor access. The Non-Human Identity and Secrets Statistics Guide gives the cross-sector numbers.

Framework mapping

Common failure patterns when using healthcare breach statistics

• Quoting a provisional year as final: the 2025 total moved from 697 to 805 breaches and from about 61 million to about 138.5 million individuals within nine months. Always give the as-of date.
• Treating individual counts as unique people: one person can appear in several breaches, and the 289 million affected in 2024 is close to the whole US population. Say "records" or "notifications", not "Americans".
• Ignoring outliers: a single event (Change Healthcare in 2024, Conduent in 2025) can swing the individuals total by tens of millions. Use breach counts or medians for trend arguments.
• Mixing DBIR categories with HIPAA terms: Verizon's "Personal" data category is not the same as PHI, and its patterns are not OCR breach types.
• Citing the business associate column as vendor risk: the OCR field shows who reported, not where the breach occurred. The share of breaches occurring at vendors is higher.
• Presenting the Security Rule NPRM as law: it is a proposal until HHS publishes a final rule.

Methodology notes and caveats

All of these sources recur: the OCR portal updates continuously, Verizon publishes in spring, IBM in late July and HIPAA Journal monthly. Recheck each figure when you refresh a board paper rather than assuming last year's trend continued.

Metrics to track in your own programme

• Remote access MFA coverage: share of remote access and vendor accounts protected by phishing-resistant MFA.
• Risk analysis currency: days since the last enterprise-wide HIPAA risk analysis and share of systems holding ePHI included.
• Business associate coverage: share of high-tier business associates with a current security review and notification clause.
• Time to contain: median days from detection to containment for your incidents (compare with IBM's 247-day all-sector figure).
• Misdirected PHI events: monthly count of misdelivered emails, letters and files.
• Restore test success: share of critical clinical systems restored within target in the last test.

Practitioner checklist

• Quote every healthcare breach figure with its publisher, report name and as-of date.
• Label recent-year OCR counts as provisional and say whether a figure comes from OCR directly or from a secondary compilation.
• Use breach counts, not individuals affected, for trend statements, and call out outliers.
• Enforce MFA on all remote access, including vendor and support accounts.
• Keep an enterprise-wide HIPAA risk analysis current and evidence it.
• Tier business associates and review the highest-risk ones annually.
• Inventory service accounts and API credentials used by integration engines and clearinghouse links.
• Rehearse ransomware downtime procedures with clinical teams.
• Track the HIPAA Security Rule rulemaking and update your plan when a final rule is published.

Standards and references

• HHS Office for Civil Rights: Breach Portal
• HHS: Change Healthcare Cybersecurity Incident Frequently Asked Questions
• HHS: OCR Risk Analysis Initiative settlement announcement
• Federal Register: HIPAA Security Rule To Strengthen the Cybersecurity of Electronic Protected Health Information (proposed rule)
• Verizon: 2026 DBIR Healthcare Snapshot
• HIPAA Journal: Healthcare Data Breach Statistics
• HIPAA Journal: IBM 2026 Cost of a Data Breach Study

Related NHI Mgmt Group resources: Data Breach Statistics Guide · Ransomware Statistics Guide · Healthcare Cyber Regulation Map · HIPAA Breach Notification Rule Guide · Top 10 Healthcare Cyber Threats