Healthcare
853 organizations, 1,211 confirmed incidents.
Healthcare covers hospitals, clinics, insurers and the vendors and business associates that process patient records on their behalf, and the data at risk is protected health information: diagnoses, treatment history, insurance and billing detail. A HIPAA covered entity must notify affected individuals of a breach of unsecured protected health information, and where the breach affects 500 or more individuals must notify the HHS Office for Civil Rights at the same time, within 60 days of discovery, under the HIPAA Breach Notification Rule (45 CFR 164.404-164.408). A healthcare vendor that is not itself a covered entity or business associate falls back on general state breach law instead.
Incidents by year
| Year | Confirmed incidents |
|---|---|
| 2026 | 599 |
| 2025 | 480 |
| 2024 | 79 |
| 2023 | 15 |
| 2022 | 6 |
| 2021 | 9 |
| 2020 | 8 |
| 2019 | 6 |
| 2018 | 2 |
| 2017 | 1 |
| 2016 | 1 |
| 2015 | 1 |
| 2014 | 4 |
Top organizations by confirmed incidents
Median days from occurrence to disclosure
| Jurisdiction | Year | Incidents (n) | Median days |
|---|---|---|---|
| US-CA | 2024 | 19 | 237 |
| US-CA | 2025 | 29 | 147 |
| US-CA | 2026 | 12 | 88 |
| US-TX | 2025 | 31 | 200 |
| US-WA | 2024 | 21 | 294 |
| US-WA | 2025 | 14 | 170 |
Questions and answers
How many confirmed incidents involve Healthcare organizations on Breach Census?
1,211 confirmed incidents across 853 organizations in the Healthcare sector are recorded on Breach Census.
Which year had the most confirmed Healthcare incidents?
2026, with 599 confirmed incidents, the most of any year on record for this sector.
Which attack types are most common in the Healthcare sector?
Among Healthcare sector incidents that carry an attack-type classification, the most common are Hacking/IT Incident, Unauthorized Access/Disclosure, Ransomware Attack.
What counts as a confirmed incident for the Healthcare sector?
An incident counts here once its primary organization carries the Healthcare sector label and the incident itself has reached the confirmed status described on the Methodology page; a bare claim or press report is not enough.