Medicaid and Health Agency Data Breaches: What Agencies Reported to HHS
Original analysis of 246 records from HHS Office for Civil Rights, October 2009 – September 2026 (submission dates). Published October 22, 2026.
We went through every breach report affecting 500 or more people on the HHS breach portal and counted those filed by federal and state health, Medicaid and human-services agencies, by agency, state and year.
What the HHS Breach Register Shows for Health Agencies
Federal and state health, Medicaid and human-services agencies filed 246 breach reports with the HHS Office for Civil Rights from October 2009 through September 2026, covering 22,744,455 individuals affected as reported. Two agencies account for 42.6% of that total: the Centers for Medicare & Medicaid Services (5,582,302) and Colorado's Medicaid agency (4,112,385). The totals add up the figures in each report; a person named in several reports is counted each time.
- 22.7MIndividuals affected, health agency reports since 2009
- 246Breach reports filed, Oct 2009 – Sep 2026
- 78%Share of individuals in hacking/IT incidents
Two agencies lead
The Centers for Medicare & Medicaid Services reported 5,582,302 individuals affected in 5 reports, and the Colorado Department of Health Care Policy and Financing 4,112,385 in 4 reports. Virginia's Medicaid agency follows with 2,357,791.
Concentrated in a few reports
The ten largest reports account for 67.4% of all individuals affected. Only 4 agencies reached 1,000,000 or more individuals affected over the whole period.
State agencies carry most of the total
State-level agencies in 42 states, the District of Columbia and Puerto Rico combined reported 16,604,719 individuals affected (73.0%); federal agencies reported 6,139,736.
2023 stands out
Reports submitted in 2023 covered 9,357,884 individuals, more than any other full year; 2023 and 2024 together account for 58.5% of the total since 2009.
Hacking and contractors
Hacking/IT incidents account for 77.8% of individuals affected but 26.4% of reports. Reports in which the agency said a business associate (an outside contractor handling the data) was involved cover 70.8% of individuals affected.
The VA files the most reports
The Veterans Health Administration and its medical centers filed 57 reports, more than any other agency, but 54 of them involved fewer than 10,000 people each; together they cover 210,247 individuals.
Which Health Agencies Reported the Largest Data Breaches
The Centers for Medicare & Medicaid Services and Colorado's Medicaid agency reported the most individuals affected.
CMS (5,582,302) and the Colorado Department of Health Care Policy and Financing (4,112,385) lead the 76 agencies.
The ranking adds up, for each of the 76 federal and state agencies, the number of individuals affected that the agency gave the HHS Office for Civil Rights in each breach report. The Centers for Medicare & Medicaid Services filed 5 reports with 5,582,302 individuals affected; its largest single report, submitted in 2024, lists 3,112,815. Among the agencies counted in this study, the largest single report came from the Colorado Department of Health Care Policy and Financing in 2023, with 4,091,794 individuals affected. Larger reports exist elsewhere in the register, for example from hospital systems of state universities, which are outside this study's scope, and the 2011 TRICARE backup-tape breach of the Military Health System, which is listed under the name of the contractor Science Applications International Corporation and is therefore not counted here.
The ranking reflects the size of each agency's programs as much as anything else: an agency that holds records for millions of Medicaid or Medicare enrollees can report far larger breaches than a small state office. Counts are not adjusted for enrollment or population. Agencies marked "(Medicaid)" are stand-alone state Medicaid agencies; in many other states, such as Texas, Minnesota, Missouri and Pennsylvania, the Medicaid program is run by a broader health or human-services department that is not marked; this label is ours, not the register's.
Individuals affected in breaches reported to HHS, by agency, Oct 2009 – Sep 2026
- Centers for Medicare & Medicaid Services (CMS)5.6 million5 reports · largest 3,112,815
- Colorado Department of Health Care Policy and Financing (Medicaid)4.1 million4 reports · largest 4,091,794
- Virginia Department of Medical Assistance Services (Medicaid)2.4 million5 reports · largest 1,229,333
- Montana Department of Public Health and Human Services1.1 million1 report · largest 1,062,509
- Georgia Department of Community Health (Medicaid)912,9062 reports · largest 557,779
- Missouri Department of Social Services741,2412 reports · largest 739,884
- Florida Department of Health736,1065 reports · largest 729,699
- Illinois Department of Human Services705,0171 report · largest 705,017
- Oregon Department of Human Services625,0001 report · largest 625,000
- California Department of Developmental Services583,4862 reports · largest 582,174
- Illinois HFS and Department of Human Services (joint reports)533,2343 reports · largest 480,435
- Alaska Department of Health and Social Services501,5034 reports · largest 500,000
All 76 agencies
- Georgia Department of Human Services500,4925 reports · largest 435,339
- Puerto Rico Department of Health475,5002 reports · largest 475,000
- District of Columbia Department of Health Care Finance (Medicaid)399,0861 report · largest 399,086
- Minnesota Department of Human Services343,6645 reports · largest 303,965
- Iowa Department of Health and Human Services (incl. former DHS, Iowa Medicaid)284,09011 reports · largest 233,834
- Indian Health Service228,6735 reports · largest 214,000
- South Carolina Department of Health and Human Services (Medicaid)228,4351 report · largest 228,435
- Veterans Health Administration (VA)210,24757 reports · largest 46,677
- Wyoming Department of Health187,1224 reports · largest 164,010
- Texas Health and Human Services Commission136,7006 reports · largest 68,066
- Oklahoma State Department of Health132,9401 report · largest 132,940
- Illinois Department of Public Health126,0001 report · largest 126,000
- Military Health System (Defense Health Agency)118,5149 reports · largest 96,271
- Connecticut Department of Social Services100,4153 reports · largest 41,000
- Washington State Health Care Authority (Medicaid)91,1871 report · largest 91,187
- North Carolina Department of Health and Human Services68,3746 reports · largest 48,752
- Florida Agency for Persons with Disabilities65,5782 reports · largest 63,627
- Ohio Department of Mental Health and Addiction Services59,0001 report · largest 59,000
- New Mexico Department of Health49,5612 reports · largest 49,000
- Oklahoma Department of Human Services47,8132 reports · largest 47,000
- Wisconsin Department of Health Services46,2917 reports · largest 19,150
- Mississippi State Department of Health30,7991 report · largest 30,799
- Florida Agency for Health Care Administration (Medicaid)30,0001 report · largest 30,000
- Colorado Department of Human Services27,1334 reports · largest 12,230
- Arkansas Department of Human Services26,9252 reports · largest 26,000
- New York State Office of Mental Health22,4432 reports · largest 21,880
- Illinois Department of Healthcare and Family Services (Medicaid)19,9813 reports · largest 8,848
- New Jersey Department of Human Services18,6476 reports · largest 9,825
- Delaware Department of Health and Social Services16,9302 reports · largest 9,930
- Washington Department of Social and Health Services16,8175 reports · largest 8,600
- Missouri Department of Mental Health16,2224 reports · largest 9,000
- New Hampshire Department of Health and Human Services14,9471 report · largest 14,947
- Pennsylvania Department of Human Services14,3343 reports · largest 11,687
- Kansas Department for Aging and Disability Services11,0001 report · largest 11,000
- California Department of Health Care Services (Medi-Cal)9,1032 reports · largest 6,460
- Arizona Health Care Cost Containment System (Medicaid)8,9553 reports · largest 3,177
- Rhode Island Department of Health8,8001 report · largest 8,800
- Oklahoma Health Care Authority (Medicaid)8,6291 report · largest 8,629
- Tennessee Bureau of TennCare (Medicaid)7,8943 reports · largest 3,900
- Kansas Department on Aging7,7571 report · largest 7,757
- Virginia Department of Behavioral Health and Developmental Services6,8604 reports · largest 4,037
- California Department of State Hospitals6,7522 reports · largest 5,014
- Rhode Island Executive Office of Health and Human Services6,7002 reports · largest 5,600
- Texas Department of Aging and Disability Services6,6001 report · largest 6,600
- Utah Department of Health and Human Services (Medicaid)5,8331 report · largest 5,833
- Kentucky Cabinet for Health and Family Services5,4193 reports · largest 2,500
- Mississippi Division of Medicaid5,2201 report · largest 5,220
- Massachusetts Department of Developmental Services4,3002 reports · largest 3,800
- North Dakota Department of Health and Human Services (incl. former DHS)4,2022 reports · largest 2,452
- Georgia Department of Behavioral Health and Developmental Disabilities3,3971 report · largest 3,397
- South Carolina Department of Health and Environmental Control2,8501 report · largest 2,850
- Michigan Department of Community Health2,5951 report · largest 2,595
- Idaho Department of Health and Welfare2,5011 report · largest 2,501
- Arizona Department of Health Services2,5001 report · largest 2,500
- Alabama Department of Public Health1,2001 report · largest 1,200
- Massachusetts Department of Public Health1,1761 report · largest 1,176
- Massachusetts Department of Mental Health9591 report · largest 959
- Alabama Department of Rehabilitation Services9341 report · largest 934
- Arizona Department of Economic Security (Developmental Disabilities)8571 report · largest 857
- New Jersey Department of Health8501 report · largest 850
- Hawaii Department of Health6741 report · largest 674
- Oregon Health Authority5501 report · largest 550
- Georgia Department of Public Health5321 report · largest 532
- Nebraska Department of Health and Human Services5161 report · largest 516
Which States' Health Agencies Reported the Most Breaches
Colorado and Virginia lead because of large breaches at their Medicaid agencies.
Colorado (4,139,518), Virginia (2,364,651) and Georgia (1,417,327) rank first to third.
This table combines all state-level health, Medicaid and human-services agencies of each state. Federal agencies are not assigned to a state. County and city health departments are not included. State totals are not adjusted for population or Medicaid enrollment. In Colorado and Virginia, nearly all of the total comes from the Medicaid agency.
States that do not appear had no report in the register filed under the name of a state health agency for this period; reports filed in the name of a whole state government, such as the State of Maine in 2023, are not included. That does not mean no breach occurred: breaches affecting fewer than 500 people are not in this register, and a breach at a contractor can be listed under the contractor's name rather than the agency's.
State health agency breaches reported to HHS, by state, Oct 2009 – Sep 2026
| State | Reports | Affected | Largest |
|---|---|---|---|
| Colorado | 8 | 4.14M | 4.09M |
| Virginia | 9 | 2.36M | 1.23M |
| Georgia | 9 | 1.42M | 558K |
| Illinois | 8 | 1.38M | 705K |
| Montana | 1 | 1.06M | 1.06M |
| Florida | 8 | 832K | 730K |
| Missouri | 6 | 757K | 740K |
| Oregon | 2 | 626K | 625K |
| California | 6 | 599K | 582K |
| Alaska | 4 | 502K | 500K |
| Puerto Rico | 2 | 476K | 475K |
| District of Columbia | 1 | 399K | 399K |
All 42 states plus DC and Puerto Rico
| State | Reports | Affected | Largest |
|---|---|---|---|
| Minnesota | 5 | 344K | 304K |
| Iowa | 11 | 284K | 234K |
| South Carolina | 2 | 231K | 228K |
| Oklahoma | 4 | 189K | 133K |
| Wyoming | 4 | 187K | 164K |
| Texas | 7 | 143K | 68.1K |
| Washington | 6 | 108K | 91.2K |
| Connecticut | 3 | 100K | 41K |
| North Carolina | 6 | 68.4K | 48.8K |
| Ohio | 1 | 59K | 59K |
| New Mexico | 2 | 49.6K | 49K |
| Wisconsin | 7 | 46.3K | 19.2K |
| Mississippi | 2 | 36K | 30.8K |
| Arkansas | 2 | 26.9K | 26K |
| New York | 2 | 22.4K | 21.9K |
| New Jersey | 7 | 19.5K | 9.83K |
| Kansas | 2 | 18.8K | 11K |
| Delaware | 2 | 16.9K | 9.93K |
| Rhode Island | 3 | 15.5K | 8.8K |
| New Hampshire | 1 | 14.9K | 14.9K |
| Pennsylvania | 3 | 14.3K | 11.7K |
| Arizona | 5 | 12.3K | 3.18K |
| Tennessee | 3 | 7.89K | 3.9K |
| Massachusetts | 4 | 6.44K | 3.8K |
| Utah | 1 | 5.83K | 5.83K |
| Kentucky | 3 | 5.42K | 2.5K |
| North Dakota | 2 | 4.2K | 2.45K |
| Michigan | 1 | 2.6K | 2.6K |
| Idaho | 1 | 2.5K | 2.5K |
| Alabama | 2 | 2.13K | 1.2K |
| Hawaii | 1 | 674 | 674 |
| Nebraska | 1 | 516 | 516 |
How Health Agency Breaches Changed Over Time
A few very large reports in 2023 and 2024 dominate the time series.
2023 (9,357,884) and 2024 (3,937,779) together account for 58.5% of individuals affected.
Years follow the date the agency submitted its report to HHS, not the date of the breach. In 2023, CMS and several state Medicaid and human-services agencies each filed reports covering hundreds of thousands of people or more, led by Colorado's Medicaid agency. In 2024, the CMS report alone accounts for most of the year's total.
Single large reports drive the yearly totals, so a year with fewer individuals affected does not necessarily mean fewer breaches. In 2025, agencies reported 178,933 individuals affected. The figure for 2026 (1,684,319 in 19 reports) covers January through September only and may still change as reports are added.
Individuals affected in health agency breaches reported to HHS, by year of submission
- 20091,5012 reports · Oct–Dec (portal start)
- 2010499,4539 reports · full year
- 2011156,81511 reports · full year
- 2012247,5659 reports · full year
- 201349,17212 reports · full year
- 20141.4 million20 reports · full year
- 20151.6 million15 reports · full year
- 2016200,30310 reports · full year
- 2017114,19018 reports · full year
- 20181.2 million23 reports · full year
- 2019666,04713 reports · full year
- 2020172,03014 reports · full year
- 2021708,46613 reports · full year
- 2022534,43613 reports · full year
- 20239.4 million23 reports · full year
All years
- 20243.9 million15 reports · full year
- 2025178,9337 reports · full year
- 20261.7 million19 reports · Jan–Sep (partial)
2009 covers October to December (the portal's first reports); 2026 covers January to September.
What Kind of Breaches Health Agencies Report
Hacking/IT incidents account for most individuals affected, unauthorized access or disclosure for most reports.
Hacking/IT incidents: 77.8% of individuals affected, 26.4% of reports.
The breach type is the category the agency selected when reporting to HHS. Unauthorized access or disclosure, such as mail or records sent to the wrong recipient, is the most common type by number of reports but involves fewer people per report. Hacking/IT incidents are fewer but include the largest reports.
In 51 of the 246 reports the agency stated that a business associate was involved, the HIPAA term for an outside person or organization that handles health information on behalf of the agency; these reports cover 70.8% of individuals affected.
Health agency breaches reported to HHS, by breach type, Oct 2009 – Sep 2026
| Type | Reports | Affected | Share |
|---|---|---|---|
| Hacking/IT Incident | 65 | 17.7M | 77.79% |
| Unauthorized Access/Disclosure | 124 | 4.21M | 18.51% |
| Theft | 28 | 773K | 3.40% |
| Loss | 11 | 24.3K | 0.11% |
| Improper Disposal | 10 | 23.6K | 0.10% |
| More than one type | 5 | 15.1K | 0.07% |
| Other | 3 | 5.7K | 0.03% |
Download the Data and Cite This Study
Every table as a CSV file and in one Excel workbook, a short PDF summary and every chart as an image, free to reuse with attribution (CC BY 4.0).
- Data breaches reported to HHS by federal and state health agencies, by agency, 2009–2026Breach reports affecting 500 or more individuals filed with the HHS Office for Civil Rights by each federal or state health, Medicaid or human-services agency, with the individuals affected as reported, the largest single report and the first and last year; name variants merged, duplicates removed. · 76 rows · CSV, 7 KB
- Data breaches reported to HHS by state health agencies, by state, 2009–2026Reports and individuals affected for the state-level health, Medicaid and human-services agencies of each state, the District of Columbia and Puerto Rico; not adjusted for population or enrollment. · 44 rows · CSV, 2 KB
- Data breaches reported to HHS by federal and state health agencies, by breach type, 2009–2026Reports and individuals affected by the breach type the agency reported to HHS; reports naming several types are grouped as more than one type. · 7 rows · CSV, 1 KB
- Data breaches reported to HHS by federal and state health agencies, by yearReports and individuals affected per year of submission, split into state and federal agencies, with the total number of reports in the whole HHS register; 2009 starts in October and 2026 ends in September. · 18 rows · CSV, 1 KB
- Register names counted and excluded in the health agency breach count, 2009–2026Every covered-entity name in the HHS breach register that is counted, with the agency it is merged into, the reports and individuals counted and duplicate reports dropped, plus the names checked and left out with the reason. · 187 rows · CSV, 20 KB
- All tables in one Excel workbookOne sheet per table plus an About sheet with sources, method and citation · Excel (.xlsx), 30 KB
Charts for your story
Individuals affected in breaches reported to HHS, by agency, Oct 2009 – Sep 2026
Embed this chart
State health agency breaches reported to HHS, by state, Oct 2009 – Sep 2026
Embed this chart
Individuals affected in health agency breaches reported to HHS, by year of submission
Embed this chart
Health agency breaches reported to HHS, by breach type, Oct 2009 – Sep 2026
Embed this chart
How to cite
Goldberg, L. (2026). Government Health Agency Data Breaches — Breaches Reported to HHS by Federal and State Health, Medicaid and Human-Services Agencies (October 2009 – September 2026) [Data set]. Settlement Insight. https://settlementinsight.com/research/government-health-agency-data-breaches
BibTeX
@dataset{goldberg_2026_government_health_agency_data_breaches,
author = {Goldberg, Leonard},
title = {Government Health Agency Data Breaches --- Breaches Reported to HHS by Federal and State Health, Medicaid and Human-Services Agencies (October 2009 -- September 2026)},
year = {2026},
publisher = {Settlement Insight},
url = {https://settlementinsight.com/research/government-health-agency-data-breaches}
}How We Measured
Checked against published figures
- Breach reports affecting 500 or more individuals received by HHS OCR through its breach portal in calendar year 2024 (all entities, by submission date): published 742, our count 741 (0.13% apart).HHS Office for Civil Rights, Annual Report to Congress on Breaches of Unsecured Protected Health Information for Calendar Year 2024 (Internet Archive copy)
Full method and limits of the data
We included government agencies whose mission is health, health coverage or human services. At the federal level these are the Centers for Medicare & Medicaid Services, the Veterans Health Administration with all of its medical centers, health care systems and outpatient clinics (including names abbreviated as "VAMC"), the Military Health System (Defense Health Agency and military treatment facilities) and the Indian Health Service (including reports filed as "IHS"). At the state level they are state departments of health, Medicaid agencies, human or social services, mental health and developmental disabilities in the 50 states, the District of Columbia and Puerto Rico, including their divisions and state-run facilities. Agencies were matched by the exact covered-entity name in the register (the state column of the register is not used; the state follows from the agency name); spelling variants and sub-units were merged into the parent agency, and predecessor agencies in Iowa and North Dakota were merged into today's combined departments. Some agencies appear under several names; Arizona's Medicaid agency, for example, reported as "Arizona Health Care Cost Containment System" and, later, with the suffix "State Medicaid Agency", and both are counted. Every register name we counted, the agency it was merged into, and the borderline names we checked and left out (with the reason) are listed in the name-list CSV, so the count can be rebuilt name by name.
The complete list of register names counted, grouped by the agency each is counted under, is: Centers for Medicare & Medicaid Services (CMS): "Centers for Medicare & Medicaid Services"; "Original Medicare" | Veterans Health Administration (VA): "Veterans Health Administration"; "Aiken Community Based Outpatient Clinic"; "Charles George Department of Veterans Affairs Medical Center"; "Charlie Norwood VA Medical Center"; "Clarksburg - Louis A. Johnson VA Medical Center"; "Fayetteville VAMC"; "Kansas City VAMC"; "Lexington VAMC"; "Louis A. Johnson Veterans' Administration Medical Center"; "John J. Pershing VA Medical Center"; "Lebanon VA Medical Center"; "Mann-Grandstaff VA Medical Center"; "Martinsburg VA Medical Center"; "Memphis VA Medical Center"; "Miami VA Healthcare System"; "Minneapolis VA Health Care System"; "Minneapolis VA Medical Center"; "New Mexico VA Health Care System"; "Oklahoma City VA Medical Center"; "Orlando VA Medical Center"; "Portland VA Medical Center"; "Robley Rex VA Medical Center"; "Rocky Mountain Regional VA Medical Center"; "San Francisco VA Health Care System"; "Sioux Falls VA Health Care System"; "South Texas Veterans Health Care System"; "Spokane VA Medical Center"; "VA Black Hills Health Care System"; "VA Caribbean Healthcare System"; "VA Eastern Colorado Health Care System"; "VA Eastern Colorado Health Care System(ECHCS)"; "VA Gulf Coast Veterans Health Care System"; "VA Illiana Health Care System"; "VA Long Beach Healthcare System"; "VA North Texas Health Care System"; "VA Northern California Health Care System"; "VA Palo Alto Health Care System"; "VA Sierra Nevada Health Care System"; "VA St. Louis Health Care System"; "Walla Walla VA Medical Center"; "Washington DC VA Medical Center"; "Washington VA Medical Center"; "White River Junction VA Medical Center"; "Wm. Jennings Bryan Dorn VA Medical Center"; "Wm. Jennings Bryan Dorn VAMC" | Military Health System (Defense Health Agency): "Defense Health Agency"; "Defense Health Agency (TriWest)"; "Defense Health Headquarters"; "Brooke Army Medical Center"; "Martin Army Community Hospital"; "Andersen Air Force Base, Guam" | Indian Health Service: "IHS"; "Indian Health Service"; "Indian Health Service -Rosebud"; "Indian Health Service Northern Navajo Medical Center"; "Indian Health Service, Aberdeen Area Office" | Alabama Department of Public Health: "Alabama Department of Public Health" | Alabama Department of Rehabilitation Services: "Alabama Department of Rehabilitation Services" | Alaska Department of Health and Social Services: "Alaska Department of Health and Social Services"; "State of Alaska Department of Health & Social Services"; "State of Alaska Department of Health and Social Services" | Arizona Department of Economic Security (Developmental Disabilities): "Arizona Department of Economic Security, Division of Developmental Disabilities" | Arizona Department of Health Services: "Arizona Department of Health Services" | Arizona Health Care Cost Containment System (Medicaid): "Arizona Health Care Cost Containment System"; "Arizona Health Care Cost Containment System- State Medicaid Agency" | Arkansas Department of Human Services: "Arkansas Department of Human Services" | California Department of Developmental Services: "CA Department of Developmental Services"; "California Department of Developmental Services, Privacy Manager Breach" | California Department of Health Care Services (Medi-Cal): "Calif. Dept. of Health Care Services (DHCS)"; "California Department of Health Care Services" | California Department of State Hospitals: "California Department of State Hospitals"; "California Department of State Hospitals - Coalinga" | Colorado Department of Health Care Policy and Financing (Medicaid): "Colorado Department of Health Care Policy & Financing"; "Colorado Department of Health Care Policy and Financing" | Colorado Department of Human Services: "Colorado Department of Human Services"; "Colorado Department of Human Services, Office of Behavioral Health" | Connecticut Department of Social Services: "Connecticut Department of Social Services" | Delaware Department of Health and Social Services: "Delaware Department of Health and Social Services, Division of Developmental Disabilities Services"; "Delaware Department of Health and Social Services, Division of Public Health" | District of Columbia Department of Health Care Finance (Medicaid): "District of Columbia, Department of Health Care Finance" | Florida Agency for Health Care Administration (Medicaid): "Agency for Health Care Administration" | Florida Agency for Persons with Disabilities: "Florida Agency for Persons with Disabilities" | Florida Department of Health: "Florida Department of Health"; "Florida Department of Health, Children's Medical Services" | Georgia Department of Behavioral Health and Developmental Disabilities: "Region Six of the Georgia Department of Behavioral Health and Developmental Disabilities" | Georgia Department of Community Health (Medicaid): "Georgia Department of Community Health" | Georgia Department of Human Services: "Georgia Department of Human Services" | Georgia Department of Public Health: "Georgia Department of Public Health" | Hawaii Department of Health: "Hawaii State Department of Health, Adult Mental Health Division" | Idaho Department of Health and Welfare: "Idaho Department of Health & Welfare" | Illinois Department of Healthcare and Family Services (Medicaid): "Illinois Department of Healthcare and Family Services" | Illinois Department of Human Services: "Illinois Department of Human Services" | Illinois HFS and Department of Human Services (joint reports): "Illinois Department of Healthcare and Family Services, Illinois Department of Human Services"; "Illinois Department of Human Services and Illinois Department of Healthcare and Family Services" | Illinois Department of Public Health: "Illinois Department of Public Health" | Iowa Department of Health and Human Services (incl. former DHS, Iowa Medicaid): "Iowa Department of Health and Human Services"; "Iowa Department of Health and Human Services - Iowa Medicaid"; "Iowa Department of Health and Human Services - Iowa Medicaid Enterprise"; "Iowa Department of Human Services"; "Iowa Dept. of Human Services"; "Iowa Health and Human Services"; "Iowa Medicaid Enterprise" | Kansas Department for Aging and Disability Services: "Kansas Department for Aging and Disability Services" | Kansas Department on Aging: "Kansas Department on Aging" | Kentucky Cabinet for Health and Family Services: "Cabinet for Health and Family Services, Department for Community Based Services"; "KY Cabinet for Health and Family Services (CHFS)"; "Kentucky Cabinet for Health and Family Services" | Massachusetts Department of Developmental Services: "Massachusetts Department of Developmental Services" | Massachusetts Department of Mental Health: "Massachusetts Department of Mental Health" | Massachusetts Department of Public Health: "Massachusetts Department of Public Health - Tewksbury Hospital" | Michigan Department of Community Health: "Michigan Department of Community Health" | Minnesota Department of Human Services: "Minnesota Department of Human Services" | Mississippi Division of Medicaid: "Mississippi Division of Medicaid" | Mississippi State Department of Health: "Mississippi State Department of Health" | Missouri Department of Mental Health: "Missouri Department of Mental Health"; "Missouri Dept. of Mental Health"; "Mo. Dept. of Mental Health" | Missouri Department of Social Services: "Missouri Department of Social Services" | Montana Department of Public Health and Human Services: "Montana Department of Public Health & Human Services" | Nebraska Department of Health and Human Services: "Nebraska Department of Health and Human Services" | New Hampshire Department of Health and Human Services: "State of New Hampshire, Department of Health and Human Services" | New Jersey Department of Health: "The State Psychiatric Hospitals in the New Jersey Department of Health, Division of Behavioral Health Services" | New Jersey Department of Human Services: "New Jersey Department of Human Services"; "State of New Jersey Department of Human Services, Division of Medical Assistance and Health Services"; "NJ Division of Developmental Disabilities - Hunterdon Developmental Center" | New Mexico Department of Health: "New Mexico Department of Health" | New York State Office of Mental Health: "New York State Office of Mental Health" | North Carolina Department of Health and Human Services: "North Carolina Department of Health and Human Services"; "North Carolina Department of Health and Human Services - Division of State Operated Health Care Facilities" | North Dakota Department of Health and Human Services (incl. former DHS): "North Dakota Department of Health and Human Services, Developmental Disabilities Section"; "North Dakota Department of Human Services" | Ohio Department of Mental Health and Addiction Services: "Ohio Department of Mental Health and Addiction Services" | Oklahoma Department of Human Services: "Oklahoma Department of Human Services" | Oklahoma Health Care Authority (Medicaid): "Oklahoma Healthcare Authority (OHCA)" | Oklahoma State Department of Health: "Oklaholma State Dept. of Health" | Oregon Department of Human Services: "Oregon Department of Human Services" | Oregon Health Authority: "Oregon Health Authority" | Pennsylvania Department of Human Services: "Department of Human Services, Commonwealth of Pennsylvania"; "PA Dept. of Human Services"; "Pennsylvania Department of Human Services" | Puerto Rico Department of Health: "Puerto Rico Department of Health - Triple S Management Corp."; "Puerto Rico Department of Heatlh - Medicaid Program" | Rhode Island Department of Health: "Rhode Island Department of Health" | Rhode Island Executive Office of Health and Human Services: "Rhode Island Executive Office of Health and Human Services" | South Carolina Department of Health and Environmental Control: "South Carolina Department of Health and Environmental Control" | South Carolina Department of Health and Human Services (Medicaid): "South Carolina Department of Health and Human Services" | Tennessee Bureau of TennCare (Medicaid): "TennCare"; "State of TN, Bureau of TennCare" | Texas Department of Aging and Disability Services: "The Department of Aging and Disability Services" | Texas Health and Human Services Commission: "Texas Health and Human Services"; "Texas Health and Human Services Commission" | Utah Department of Health and Human Services (Medicaid): "Utah Medicaid, Division of Integrated Healthcare: Utah Department of Health and Human Services" | Virginia Department of Behavioral Health and Developmental Services: "Virginia Department of Behavioral Health & Developmental Services"; "Virginia Department of Behavioral Health and Developmental Services" | Virginia Department of Medical Assistance Services (Medicaid): "Virginia Department of Medical Assistance Services"; "Virginia Department of Medical Assistance Services (VA-DMAS)"; "VA Department of Medical Assistance Services" | Washington Department of Social and Health Services: "WA State Department of Social & Health Services"; "Washington Department of Social and Health Services"; "Washington State Department of Social and Health Services" | Washington State Health Care Authority (Medicaid): "Washington State Health Care Authority (HCA)" | Wisconsin Department of Health Services: "Wisconsin Department of Health Services" | Wyoming Department of Health: "Wyoming Department of Health". Each line is one agency in the agency ranking; the joint Illinois reports filed under both Illinois department names form their own line, the Kansas Department on Aging and the Texas Department of Aging and Disability Services are kept as separate agencies, "Original Medicare" is counted as CMS, and the Puerto Rico report filed jointly with Triple-S Management Corp. is counted because the agency is named in it. No other register name is counted, including names abbreviated in other ways.
We excluded county and city agencies, tribal health programs, state universities, health plans for state employees or retirees, and private companies whose names contain words such as "department of" or "human services". Corrections departments and their health services (11 reports, 734,308 individuals affected) and two state IT agencies that reported under their own name (2 reports, 885,470 individuals affected) are also not included, nor is the VA's Corporate Data Center Operations in Austin, an IT unit outside the Veterans Health Administration (7,029 individuals affected), or statewide filings such as "State of Maine" and "State of North Dakota". 3 reports that repeat an earlier report by the same agency with the same number of individuals within 30 days of an earlier counted report (agency after merging name variants, so a report under a sub-unit can repeat one under the parent name) were treated as duplicates and counted once. Reports are taken in order of submission date; a report is a duplicate if its individuals_affected equals that of the last counted report of the same agency and it was submitted no more than 30 days later (the field submission_date, both lists of the portal, reports submitted through September 30, 2026).
Individuals affected are the numbers each agency reported to HHS, added up across reports. The share of the whole register compares this total with all 1,097,111,487 individuals affected in all 8,044 reports through September 2026; health agencies account for 2.1%.
What this data cannot tell you
- The totals count notifications, not unique people. A person whose records were involved in several breaches, for example at CMS and at a state Medicaid agency, is counted once per report.
- The number of individuals affected is the figure each agency reported to HHS; this analysis does not verify it. HHS says it opened investigations into all reported breaches affecting 500 or more people in 2024, and some investigations close after HHS determines that no violation occurred, so a listing on the portal is not a finding that an agency violated HIPAA.
- The register also lists business associates as reporting entities. When a contractor's breach is listed under the contractor's name, it does not appear under the agency's name and is not counted here. Breaches affecting fewer than 500 people are reported to HHS separately and are not part of this register.
- Reports for recent months may still be added to the portal; the 2026 figures cover January through September only and are not comparable with full years.
- Rankings are raw totals. They are not adjusted for population, Medicaid or Medicare enrollment, or the number of records an agency holds.
Frequently Asked Questions
How many people have been affected by Medicaid and state health agency data breaches?
Federal and state health, Medicaid and human-services agencies reported breaches affecting 22,744,455 individuals to HHS from October 2009 through September 2026, in 246 reports. State-level agencies account for 16,604,719 of them. A person named in several reports is counted each time.
Has CMS had a data breach?
Yes. The Centers for Medicare & Medicaid Services filed 5 breach reports with the HHS Office for Civil Rights, covering 5,582,302 individuals affected in total. The largest, submitted in 2024, lists 3,112,815 individuals.
What was the largest state Medicaid data breach?
Among the federal and state health agencies counted in this study, the largest single report in the HHS register came from the Colorado Department of Health Care Policy and Financing, the state's Medicaid agency, in 2023 with 4,091,794 individuals affected. Breaches at Medicaid contractors that reported under their own company name, and at public health systems outside this study's scope such as state university hospitals, are not included in this comparison.
Which state health departments have had the most data breaches?
By individuals affected, the state-level health agencies of Colorado (4,139,518), Virginia (2,364,651) and Georgia (1,417,327) rank highest. These totals are not adjusted for population or enrollment.
Where can I look up health data breaches reported to HHS?
The HHS Office for Civil Rights posts breaches of unsecured protected health information affecting 500 or more individuals on its breach portal. Our CSV files list the reports filed by federal and state health agencies, grouped by agency, state, year and breach type.
How do most government health agency data breaches happen?
Hacking/IT incidents account for 77.8% of individuals affected in health agency breach reports, while unauthorized access or disclosure is the most common type by number of reports. In reports covering 70.8% of individuals affected, the agency said a business associate, such as a contractor, was involved.
Sources
- Breach Portal: Notice to the Secretary of HHS Breach of Unsecured Protected Health Information — U.S. Department of Health and Human Services, Office for Civil Rights
- Annual Report to Congress on Breaches of Unsecured Protected Health Information for Calendar Year 2024 (Internet Archive copy) — U.S. Department of Health and Human Services, Office for Civil Rights
- Business Associates (HIPAA guidance, Internet Archive copy) — U.S. Department of Health and Human Services, Office for Civil Rights
Independent analysis. Settlement Insight is not a law firm and not affiliated with any agency named here. Analysis by Leonard Goldberg, Editor. How we work: methodology, our data.
More Research and Data
Other studies from our database of public legal records — each with free CSV downloads.
Related research
Latest studies
- Clayton lenders in mobile home complaintsTwo Clayton Homes lenders account for 44.3% of CFPB manufactured home loan complaints
- Credit Card Interest ComplaintsSynchrony: 736 CFPB complaints about credit card interest in 2025, the most of any company
- Earned Wage Access ComplaintsDave leads: 65 of 1,177 CFPB earned wage access and advance complaints
- Gift Card Complaints by CompanyAmerican Express: 50.6% of CFPB gift card complaints in 2024–2025, the most of any company