The HHS Office for Civil Rights received 397 breach reports covering 500 or more individuals from January 1 to June 30, 2026, according to the HIPAA Journal's H1 2026 Healthcare Data Breach Report, published September 30, 2026. Healthcare providers filed 290 of them, which is 73.0% of the total.
That count is 5.9% below the first half of 2025 and the lowest first-half total since 2023. The reports cover 33.77 million individuals, a 22.6% drop from the first half of 2025. The pace works out to more than 2.2 large breaches per day. For all of 2025, the HIPAA Journal counted 804 breaches on the OCR portal and more than 140 million affected individuals. The HIPAA Journal pulled the OCR data on September 10, 2026.
Who reported the breaches
Providers filed the most reports in the first half of 2026. Business associates filed 59 and health plans filed 48. No clearinghouse filed a report.
| Entity type | Breaches | Share of 397 | Individuals affected |
|---|---|---|---|
| Healthcare providers | 290 | 73.0% | 19,701,297 |
| Business associates | 59 | 14.9% | 12,505,090 |
| Health plans | 48 | 12.1% | 1,559,474 |
| Clearinghouses | 0 | 0.0% | 0 |
Source: HIPAA Journal, H1 2026 Healthcare Data Breach Report, September 30, 2026. Shares are calculated from the HIPAA Journal counts.
The raw counts understate vendor-related incidents. A business associate often reports a breach under the name of the practice it serves. The HIPAA Journal estimates that about 100 more breaches occurred at business associates than the 59 they filed themselves. After that adjustment, the average breach size was 87,629 individuals for providers, 87,643 for business associates and 41,042 for health plans. The adjusted medians were 6,323, 3,086 and 2,871. For a typical provider breach, the median is far below the average, so a few very large events pull the average up. Billing companies and other vendors that handle patient data sit in the business associate group.
What caused them
Hacking and IT incidents caused 343 of the 397 breaches, or 86.4%. That is 2.1% more than in the first half of 2025, and the HIPAA Journal reports that hacking has risen for three consecutive years. The average hacking breach affected 94,167 individuals. The median was 4,800 individuals, which falls in the 1,000 to 9,999 size band. The number of individuals affected by hacking fell 14.7% from the first half of 2025.
Unauthorized access or disclosure caused 51 breaches, or 12.8%. That is 3.8% fewer than a year earlier. The average was 28,710 individuals and the median was 2,315. Individuals affected by this cause dropped 74.2%. Loss or theft caused 2 breaches, one loss and one theft, which is 75% fewer than the first half of 2025. One further breach came from improper disposal and affected about 1,000 individuals.
The HIPAA Journal names network servers as the most common location of breached records. It reports that email incidents remain common because of phishing, that paper incidents are falling, and that cloud and other locations are rising. It gives no counts for those locations. The same source puts the 2024 total at 741 breaches affecting more than 289 million individuals, and the 2023 total at 745 breaches.
How large the breaches were
Most reports involved fewer than 10,000 individuals. The HIPAA Journal's size table shows 175 breaches in the 1,000 to 9,999 range and 90 breaches under 1,000. Together those 265 breaches are 66.8% of the 397.
| Individuals affected | Breaches | Share of 397 |
|---|---|---|
| Over 1,000,000 | 9 | 2.3% |
| 100,000 to 999,999 | 21 | 5.3% |
| 10,000 to 99,999 | 102 | 25.7% |
| 1,000 to 9,999 | 175 | 44.1% |
| Under 1,000 | 90 | 22.7% |
Source: HIPAA Journal, H1 2026 Healthcare Data Breach Report, September 30, 2026. Shares are calculated from the HIPAA Journal counts.
Breaches of 100,000 or more individuals totaled 30, which is 7.6%. The largest first-half breach affected more than 5.8 million individuals. The HIPAA Journal also notes that 37 reports list exactly 500 or 501 individuals. Those are placeholder figures, and the final counts will likely be higher.
Where the breaches were reported
California led with 38 reports, followed by Texas with 36, Florida with 24, New York with 20 and Illinois with 16. Michigan reported 15, North Carolina 14, and Pennsylvania and Washington 13 each. Massachusetts reported 12. The top five states together filed 134 reports, which is 33.8% of the 397.
Reports came from 44 states, the District of Columbia and Puerto Rico. Hawaii, Montana, New Mexico, North Dakota, South Dakota and Wyoming reported none. By individuals affected, North Carolina ranked first at 6,358,110, followed by Tennessee at 4,635,531 and Missouri at 3,468,743. Those totals come from a small number of very large reports.
What OCR enforcement looked like
OCR announced seven settlements in the first half of 2026. All seven included a penalty for risk analysis failures. Two also included breach notification fines. The amounts ranged from $10,000 to $450,000 and totaled $1,728,000, an average of $246,857 per settlement.
OCR launched its risk analysis enforcement initiative in October 2024. The HIPAA Journal reports 14 penalties under that initiative, which OCR has expanded to cover risk management. Five of the 14 penalties issued in 2025 included breach notification failures. The Right of Access initiative has produced more than 55 financial penalties since late 2019.
The HIPAA Journal reports that OCR issued no HIPAA rule updates in the first half of 2026. The target date for the Security Rule final rule moved from May 2026 to July 2027. The Notice of Privacy Practices compliance date was February 16, 2026.
Sources
- The HIPAA Journal, H1 2026 Healthcare Data Breach Report, September 30, 2026
- The HIPAA Journal, Healthcare Data Breach Statistics, updated October 15, 2026
Talk to us
Fifteen minutes about your practice and the systems you run.