Mental Health and Addiction Treatment Data Breaches Reported to HHS
Original analysis of 8,016 records from the HHS Office for Civil Rights, October 2009 – September 2026 (submission dates). Published October 15, 2026.
We counted every breach report on the HHS Office for Civil Rights portal filed by an organization whose name identifies it as a mental health, counseling or addiction treatment provider, from October 2009 through September 2026.
What the HHS breach reports show
Mental health and addiction treatment organizations filed 210 breach reports with the HHS Office for Civil Rights between October 2009 and September 2026, covering 10.3 million affected individuals. That is 2.6% of all 8,016 reports on the federal breach portal in the same period. The count is a lower bound: it includes only organizations whose reported name identifies them as a behavioral health provider.
- 210Reports from MH and addiction providers (lower bound)
- 10.3MIndividuals affected (sum of reports)
- 83%Reports classed as hacking, 2021–2025
Reports tripled
Mental health and addiction organizations filed 119 reports in 2021–2025, against 38 in 2015–2019 (3.1×). Their share of all HHS reports rose from 1.4% in 2010–2014 to 3.2% in 2021–2025.
From stolen laptops to hacking
In 2010–2014, 82% of these reports were thefts and 6% were hacking. In 2021–2025, hacking/IT incidents accounted for 83%.
One report is nearly a third of the total
The largest single report, filed by Cerebral, Inc. in 2023, lists 3.2 million individuals, 31% of the total. Reports of 100,000 or more individuals (19 of them) account for 76%.
Business associates behind half the exposure
Organizations filing as HIPAA business associates submitted only 20 of the reports but 52% of the affected individuals. Brightline alone filed 11 separate reports covering 1,013,686 individuals.
California and Texas lead the count
California organizations filed 26 reports, the most among the organizations our name filter matches, although the filter misses several Texas community mental health centers named "MHMR"; reporting organizations came from 42 states. Counts are not adjusted for population or number of providers.
How Many Mental Health Data Breaches Are Reported Each Year
Reports from mental health and addiction organizations rose from a handful a year to dozens.
The busiest year was 2023, with 35 reports and 5.7 million affected individuals; 34 followed in 2024 and 20 in 2025.
Across the full calendar years 2010–2025, mental health and addiction organizations filed 191 reports. The yearly count was in single digits through 2017 and reached 35 in 2023. Because the overall number of reports on the portal also grew, the share is the fairer comparison: it rose from 1.4% of all reports in 2010–2014 to 3.2% in 2021–2025.
The 2023 total of 5.7 million individuals is driven by the Cerebral report and eleven Brightline reports filed that spring. In the first nine months of 2026, 19 reports were filed; that year is incomplete and is not compared with full years.
Mental health and addiction breach reports by submission year
- 200900.0% of all HHS reports
- 201010.5% of all HHS reports
- 201110.5% of all HHS reports
- 201252.3% of all HHS reports
- 201372.5% of all HHS reports
- 201431.0% of all HHS reports
- 201541.5% of all HHS reports
- 201651.5% of all HHS reports
- 201741.1% of all HHS reports
- 2018102.7% of all HHS reports
- 2019152.9% of all HHS reports
- 2020172.6% of all HHS reports
- 2021101.4% of all HHS reports
- 2022202.8% of all HHS reports
- 2023354.7% of all HHS reports
All years
- 2024344.6% of all HHS reports
- 2025202.5% of all HHS reports
- 2026193.3% of all HHS reports
Years are calendar years of submission to HHS. 2009 covers October to December only and 2026 covers January to September.
How Mental Health Records Are Breached
Hacking/IT incidents dominate, by number of reports and by number of people.
Across the whole period, 70% of the reports were hacking/IT incidents, covering 66% of affected individuals.
Early reports from this group were mostly stolen laptops, computers and paper files. Since 2021, nearly all large reports have been hacking/IT incidents, in line with the HHS observation for all reports that hacking/IT incidents were the largest category in 2023, comprising 81% of such reported breaches.
Unauthorized access or disclosure is the second category. It includes the Cerebral report, which is why this category covers a large share of affected individuals despite fewer reports.
Reports by breach type
- Hacking/IT Incident1476.8 million individuals
- Unauthorized Access/Disclosure373.5 million individuals
- Theft2060,610 individuals
- Improper Disposal26,212 individuals
- Loss21,522 individuals
- Other11,683 individuals
- Theft, Unauthorized Access/Disclosure12,828 individuals
The Largest Mental Health Data Breaches
A small number of reports, many filed by organizations registered as HIPAA business associates, account for most affected individuals.
Reports of 100,000 or more individuals (19) account for 76% of the 10.3 million total; without the Cerebral report, the total is 7.1 million.
Several organizations appear more than once. The Harris Center for Mental Health and IDD filed two large reports, in 2023 and 2024, American Addiction Centers filed in 2024 and again in 2026, and Brightline filed eleven separate reports in spring 2023. Each report is a separate row on the HHS portal, so the sum of affected individuals can count the same person more than once.
Of the 210 reports, 185 were filed as healthcare providers, 20 as business associates and 5 as health plans (county or regional behavioral health agencies).
Largest single breach reports
| Organization | State | Affected |
|---|---|---|
| Cerebral, Inc | DE | 3.18M |
| The Harris Center for Mental Health and IDD | TX | 599K |
| The Harris Center for Mental Health and IDD | TX | 545K |
| Brightline, Inc. | CA | 473K |
| American Addiction Centers, Inc. | TN | 411K |
| American Addiction Centers | TN | 328K |
| North Texas Behavioral Health Authority | TX | 285K |
| South Florida Behavioral Health Network dba Thriving Mind South Florida | FL | 258K |
| Brightline, Inc. | CA | 200K |
| BHG Holdings, LLC dba Behavioral Health Group | TX | 198K |
All largest reports
| Organization | State | Affected |
|---|---|---|
| Community Psychiatry Management, LLC, dba Mindpath Health | NC | 194K |
| Brightline, Inc. | CA | 181K |
| Deer Oaks Behavioral Health | TX | 172K |
| Cummins Behavioral Health Systems | IN | 154K |
| Carolina Behavioral Health Alliance, LLC | NC | 131K |
| Behavioral Health Network, Inc. | MA | 130K |
| North Oklahoma County Mental Health Center d/b/a NorthCare | OK | 129K |
| Dallas County Mental Health Mental Retardation Center dba Metrocare Services | TX | 120K |
| Richmond Behavioral Health Authority | VA | 113K |
| Meridian Behavioral Healthcare, Inc. | FL | 98.8K |
| National Association on Drug Abuse Problems | NY | 90K |
| Western Montana Mental Health Center | MT | 86.8K |
| Counseling Center of Wayne & Holmes Counties | OH | 83.4K |
| Central Kansas Mental Health Center | KS | 80.9K |
| Mental Health Center of North Central Alabama, Inc. | AL | 75.7K |
Which States Report the Most Mental Health Data Breaches
Reports come from 42 states; the largest states lead the count.
Among the organizations our name filter matches, California's filed 26 reports, followed by Texas (undercounted, because many Texas community mental health centers are named "MHMR"), which has the second-most affected individuals after Delaware, the home state of Cerebral, Inc.
The three states with the most reports account for 27% of the total. The state is the one HHS lists for the reporting organization, which for vendors and national companies is the headquarters, not where patients live. Counts are not adjusted for population or the number of behavioral health providers in each state.
Breach reports by state of the reporting organization
| State | Reports | Affected | Share |
|---|---|---|---|
| CA | 26 | 1.1M | 12.4% |
| TX | 19 | 2.14M | 9.0% |
| NY | 11 | 182K | 5.2% |
| PA | 10 | 47K | 4.8% |
| OH | 9 | 313K | 4.3% |
| VA | 9 | 226K | 4.3% |
| WA | 9 | 188K | 4.3% |
| MO | 9 | 129K | 4.3% |
| FL | 8 | 373K | 3.8% |
| MA | 8 | 227K | 3.8% |
| KS | 6 | 131K | 2.9% |
| CO | 6 | 36.5K | 2.9% |
All states
| State | Reports | Affected | Share |
|---|---|---|---|
| NJ | 6 | 17.2K | 2.9% |
| TN | 5 | 833K | 2.4% |
| MI | 5 | 67.5K | 2.4% |
| GA | 5 | 12.9K | 2.4% |
| NC | 4 | 328K | 1.9% |
| AL | 4 | 122K | 1.9% |
| MN | 4 | 47.6K | 1.9% |
| ME | 4 | 23.3K | 1.9% |
| DE | 3 | 3.2M | 1.4% |
| IL | 3 | 30.1K | 1.4% |
| AZ | 3 | 7.45K | 1.4% |
| WV | 3 | 6.53K | 1.4% |
| IA | 3 | 6.43K | 1.4% |
| WI | 3 | 5.08K | 1.4% |
| NH | 3 | 3.35K | 1.4% |
| IN | 2 | 155K | 1.0% |
| OK | 2 | 132K | 1.0% |
| UT | 2 | 17.8K | 1.0% |
| OR | 2 | 11.2K | 1.0% |
| SC | 2 | 10.5K | 1.0% |
| NE | 2 | 2.08K | 1.0% |
| MT | 1 | 86.8K | 0.5% |
| CT | 1 | 25.1K | 0.5% |
| KY | 1 | 16.4K | 0.5% |
| MD | 1 | 14K | 0.5% |
| RI | 1 | 9.59K | 0.5% |
| SD | 1 | 8.5K | 0.5% |
| not reported | 1 | 4.25K | 0.5% |
| AK | 1 | 2.74K | 0.5% |
| HI | 1 | 674 | 0.5% |
| NM | 1 | 500 | 0.5% |
Download the Data and Cite This Study
Every table as a CSV file and in one Excel workbook, a short PDF summary and every chart as an image, free to reuse with attribution (CC BY 4.0).
- The 25 largest mental health and addiction breach reportsThe 25 single breach reports with the most individuals affected, as listed by HHS OCR. · 25 rows · CSV, 3 KB
- Mental health and addiction breach reports by breach typeBreach reports and individuals affected by the breach type HHS OCR lists for each report. · 7 rows · CSV, 1 KB
- Mental health and addiction breach reports by HIPAA entity typeBreach reports and individuals affected by whether the reporting organization filed as a healthcare provider, business associate or health plan. · 3 rows · CSV, 1 KB
- Mental health and addiction breach reports by stateBreach reports and individuals affected by the state of the reporting organization, October 2009 to September 2026. · 43 rows · CSV, 1 KB
- Mental health and addiction breach reports by yearBreach reports (500+ individuals) from mental health and addiction treatment organizations per submission year, with all HHS reports and the share; 2009 and 2026 are partial years. · 18 rows · CSV, 1 KB
- All tables in one Excel workbookOne sheet per table plus an About sheet with sources, method and citation · Excel (.xlsx), 15 KB
- Summary to print or forward (3 pages)Short answer, key figures, main chart, findings, method and citation · PDF, 182 KB
Charts for your story
Mental health and addiction breach reports by submission year
Embed this chart
Reports by breach type
Embed this chart
Largest single breach reports
Embed this chart
Breach reports by state of the reporting organization
Embed this chart
How to cite
Goldberg, L. (2026). Mental Health and Addiction Treatment Data Breaches — HHS OCR Breach Reports by Year, State and Type (2009–2026) [Data set]. Settlement Insight. https://settlementinsight.com/research/mental-health-provider-data-breaches
BibTeX
@dataset{goldberg_2026_mental_health_provider_data_breaches,
author = {Goldberg, Leonard},
title = {Mental Health and Addiction Treatment Data Breaches --- HHS OCR Breach Reports by Year, State and Type (2009--2026)},
year = {2026},
publisher = {Settlement Insight},
url = {https://settlementinsight.com/research/mental-health-provider-data-breaches}
}How We Measured
Checked against published figures
- All breach reports affecting 500+ individuals submitted to the HHS OCR breach portal in calendar year 2023: published 746, our count 745 (0.13% apart).Annual Report to Congress on Breaches of Unsecured Protected Health Information for Calendar Year 2023
Full method and limits of the data
A report is counted as mental health or addiction treatment when the reporting organization's name contains one of these terms: behavioral, behavioural, mental health, psych, counseling, counselling, addiction, substance, alcohol, drug abuse, detox, recovery center, or the company names Brightline and Cerebral. We removed names that pair the term with general medical care (a general hospital, a combined county health and mental health department, mixed medical practices) and names referring to cerebral palsy. Every match was reviewed by hand.
Counts are reports, not distinct incidents or organizations: the 210 reports were filed under 176 differently named entities. Affected individuals are the sum of the counts HHS lists for each report. Years are calendar years of the submission date. Breach types are the categories HHS lists in the breach_type field; a report counts as theft or as hacking/IT incident when that category appears in the field, alone or combined with others (for example "Theft, Unauthorized Access/Disclosure"), so category shares can overlap. To check the extraction, we counted all reports submitted in 2023: 745, against the 746 HHS reported to Congress (0.13% difference).
What this data cannot tell you
- The name filter misses mental health and addiction providers whose names carry none of the terms (for example Texas community centers named "MHMR", Centerstone, or Gateway Rehabilitation Center), and all behavioral health units inside general hospitals and health systems. The totals are therefore a lower bound.
- The sum of affected individuals counts notifications, not unique people: one person can appear in several reports, and HHS figures are the organization's own estimate at the time of reporting, sometimes revised later.
- HHS posts reports after review, so reports submitted in recent months, including in 2025 and 2026, may still be added. The partial year 2026 is shown separately and not compared with full years.
- A report on the portal is not a finding of a HIPAA violation, and the data do not say whether the breach involved therapy notes, substance use disorder records or only billing and contact data.
Frequently Asked Questions
How many mental health providers have had data breaches?
From October 2009 through September 2026, mental health and addiction treatment organizations filed 210 breach reports affecting 500 or more individuals with HHS. These came from 176 differently named organizations. The count includes only organizations whose name identifies them as behavioral health providers.
How many patients were affected by mental health data breaches?
The reports list 10.3 million affected individuals in total. The same person can be counted in more than one report, and the Cerebral report alone accounts for 31% of the total.
What was the Cerebral data breach?
Cerebral, Inc. reported a breach affecting 3.2 million individuals to HHS in 2023, classed as unauthorized access or disclosure. It is the largest single report among the 210 mental health and addiction reports identified in this analysis.
Are mental health data breaches increasing?
Reports from this group rose from 38 in 2015–2019 to 119 in 2021–2025. Their share of all HHS breach reports also rose, from 1.4% in 2010–2014 to 3.2% in 2021–2025.
How do most behavioral health data breaches happen?
In 2021–2025, 83% of reports from mental health and addiction organizations were hacking/IT incidents. A decade earlier, most were thefts of devices or paper records.
Where can I see the list of healthcare data breaches?
The HHS Office for Civil Rights publishes all reported breaches affecting 500 or more individuals on its breach portal. Our CSV files summarize the mental health and addiction subset by year, state, breach type and largest report.
Sources
- Breach Portal: Notice to the Secretary of HHS Breach of Unsecured Protected Health Information — U.S. Department of Health and Human Services, Office for Civil Rights
- Annual Report to Congress on Breaches of Unsecured Protected Health Information for Calendar Year 2023 (archived copy) — U.S. Department of Health and Human Services, Office for Civil Rights
- Independent analysis. Settlement Insight is not a law firm and not affiliated with any agency named here. Analysis by Leonard Goldberg, Editor. How we work: methodology, our data.
More Research and Data
Other studies from our database of public legal records — each with free CSV downloads.
Related research
Latest studies
- Bank complaints closed with moneyBank of America, N.A. closed 36.0% of 2025 checking/savings complaints with money, top of firms with 500+
- Dental Data Breaches276 dental breach reports to HHS, 45.7 million individuals affected (sum of reports)
- Disputed NY Workers' Comp InjuriesNY workers' comp: 47% of hearing-loss claims disputed, 4% of contusions (2022–2024)
- OFAC penalties by companyTen companies account for 75.2% of all OFAC penalty dollars since 2003