HIPAA breach statistics for 2025 show 804 large healthcare breaches reported to HHS, the highest yearly count in HIPAA Journal’s series since 2018, affecting about 138.5 million people. Most began with hacking or another IT incident, and a large share came through email accounts and vendors. This guide walks through the latest published numbers, what they say for a practice with a handful of staff, and six safeguards to put in place first.
Last reviewed: October 6, 2026. This is general information, not legal or compliance advice.
Key takeaways
- HIPAA Journal’s analysis of the HHS breach portal counts 804 large breaches (500 or more people) reported for 2025, up from 738 in 2024.
- Those breaches exposed the health information of about 138.5 million people, roughly 379,000 people per day.
- Hacking and other IT incidents made up more than 80% of large breaches.
- In the February 2026 count, 24.9% of breaches involved compromised email accounts and 128 were reported by business associates.
- The median breach affected 4,011 people, so the typical case looks like a practice, not a headline.
What the 2025 healthcare data breach statistics show
HIPAA Journal’s breach statistics page, updated in September 2026 with data through June 30, counts 804 large breaches for 2025. That is the highest yearly figure in the 2018 to 2025 series, which starts at 369. The count has climbed in most years since, with a slight dip in 2024.
A note on the numbers, because you will see different totals online. HIPAA Journal’s 2025 healthcare data breach report, published in February 2026, listed 710 breaches and about 61.6 million people. It warned that more 2025 breaches were still being added to the HHS portal, in part because a 43-day federal shutdown late in the year paused portal updates. The later figures of 804 breaches and 138.5 million people reflect those additions. Counts can keep changing as late reports arrive, so treat them as a close picture, not a final tally.
The size of individual events varies a great deal. In the February report, the largest 2025 breach was Aflac, at about 13.9 million people, followed by Yale New Haven Health System at about 5.6 million and Episource at about 5.4 million. HIPAA Journal’s statistics page also lists Conduent Business Services at about 62.2 million records, which shows how one vendor incident can dwarf a single hospital. For comparison, the 2024 Change Healthcare attack is listed at 192.7 million people.
Where HIPAA data breaches start
The cause is concentrated. HIPAA Journal’s analysis found that hacking and other IT incidents accounted for more than 80% of large healthcare data breaches in 2025, a share that has grown since 2019, when hacking was 49% of reports. In the February report, 61.5% of the year’s breaches involved health information stored on network servers, and 24.9% involved compromised email accounts. Those two groups overlap, so the percentages do not add up to a total.
Email deserves attention for a small practice because it is where staff spend the day. Two of the 20 largest breaches in that report began with compromised email accounts, at Numotion and Onsite Mammography. A single phished mailbox can expose appointment details, insurance information and attachments that were never meant to sit in an inbox.
The other pattern is the vendor. Business associates reported 128 of the breaches in the February count, and 139 in the updated count. Figure 2 shows the split by who filed the report in the February snapshot. A practice may run its own systems carefully and still have its patients’ records exposed by a billing company, a transcription service or a cloud tool.
What these HIPAA breach statistics mean for a small practice
It is easy to read the biggest numbers and decide they describe someone else. The median figure says otherwise. At 4,011 people, the typical 2025 breach is about the size of a family practice’s patient list. Some of the larger breaches in the top 10 hit mid-size providers: Anne Arundel Dermatology at about 1.9 million people, Radiology Associates of Richmond at about 1.4 million, and Community Health Center, Inc. at about 1.1 million.
Two other facts matter. A breach of 500 or more people must be reported to HHS and to the affected individuals within 60 days of discovery, and the public breach portal lists the practice by name. The HHS breach notification rule sets those requirements. For a small practice, the reporting and the loss of patient trust often cost more than the technical cleanup.
Six safeguards to start with
None of these is new, and that is the point. The statistics keep pointing at the same few gaps. The table below matches each common breach pattern with a first safeguard.
| Breach pattern | What it looks like | Safeguard to start with |
|---|---|---|
| Hacking and IT incidents | Ransomware, stolen credentials, a compromised server | Multi-factor authentication, patching, tested backups |
| Compromised email accounts | A phished mailbox that exposes patient messages | Multi-factor authentication, HIPAA-compliant email, phishing training |
| Vendor and business associate breaches | A billing or software vendor loses patient records | Signed business associate agreements, a vendor checklist |
| Unauthorized access by staff | A former employee or curious insider opens records | Access reviews, prompt offboarding, audit logs |
1. Turn on multi-factor authentication for every account that touches patient data
Start with email, the practice management system, the patient portal and remote access. Stolen credentials are one of the most common routes in, and a second factor stops most of them.
2. Move patient communication to HIPAA-compliant email
Standard consumer and business email plans were not built for protected health information, and a compromised mailbox is a recurring cause of breaches. A HIPAA-compliant email service with a signed business associate agreement, encryption and access controls limits what an attacker or a mistaken send can expose.
3. Get a signed business associate agreement from every vendor
List each vendor that stores, sends or processes patient data, from billing to cloud storage. Confirm a business associate agreement is on file for each one, and ask how they would notify you of an incident. Our HIPAA email vendor checklist covers the questions to ask.
4. Patch systems and keep tested backups
Apply security updates to servers, workstations and any website or portal software on a schedule. Keep backups offline or in a separate account, and restore one to a test machine at least once a year. A backup that has never been restored is an assumption.
5. Review who has access, and remove people quickly
Unauthorized access and disclosure is its own breach category, and it rose 17.4% in the February 2026 count. Give each person only the access their role needs, turn on audit logs where the system offers them, and disable accounts the day someone leaves.
6. Complete a risk analysis and write down an incident plan
A documented risk analysis shows what you protect and where the gaps are. Pair it with a one-page incident plan that names who decides, who calls the vendor and the insurer, and who handles the notification timeline.
Frequently asked questions about HIPAA breach statistics
What counts as a large breach under HIPAA?
A large breach is one that affects 500 or more people. Covered entities and business associates must report these to HHS and notify the affected individuals without unreasonable delay, and no later than 60 days after discovery. Smaller breaches are reported to HHS once a year.
What causes most HIPAA data breaches?
Hacking and other IT incidents cause most of them. HIPAA Journal’s analysis of the HHS breach portal found that these incidents accounted for more than 80% of large healthcare data breaches in 2025. Unauthorized access and disclosure, such as an insider opening records they should not, is a separate category and rose 17.4% in the February 2026 count.
Are small practices really at risk from healthcare data breaches?
Yes. HIPAA Journal’s February 2026 report put the median 2025 breach at 4,011 individuals, which is the size of a typical practice or clinic, not a national insurer. Several of the largest 2025 breaches also involved mid-size providers, such as a dermatology group and a radiology practice.
Who is responsible when a vendor causes the breach?
The practice stays responsible for notifying patients, even when the vendor’s system was the one compromised. A business associate agreement sets out what the vendor must do and report, so every vendor that handles patient data should have one signed before any data is shared.
Is email a common source of HIPAA data breaches?
It is a large share. In HIPAA Journal’s February 2026 report, 24.9% of the year’s breaches involved compromised email accounts. Multi-factor authentication, a HIPAA-compliant email service under a business associate agreement, and staff training on phishing address the most common routes.