Repeat Health Data Breach Reporters: Who Has Filed the Most Breach Reports With HHS
Original analysis of 8,021 records from HHS, October 2009–September 2026 (submission dates). Published October 15, 2026.
We counted every breach report affecting 500 or more people that HHS lists on its breach portal from October 2009 through September 2026, and ranked the organizations that filed three or more.
Key findings on repeat health data breach reporters
Humana Inc. has filed 22 reports of breaches affecting 500 or more people with the HHS Office for Civil Rights since 2014, the most of any reporting entity on the federal breach portal, followed by Walgreen Co. with 20 and Blue Shield of California with 17. Of the 6,854 organizations on the portal, 680 have reported more than once, and together they filed 23.0% of all 8,021 reports.
- 22Breach reports by Humana Inc., most of any entity
- 680Organizations with two or more breach reports
- 23%Share of all reports filed by repeat reporters
Three names lead the list
Humana Inc. (22 reports, 2014–2024), Walgreen Co. (20, 2012–2025) and Blue Shield of California (17, 2015–2025) have filed the most breach reports of any reporting entity. Each of Humana's and Walgreen's reports was filed on a different day.
Most organizations report once
Of 6,854 organizations, 6,174 have filed a single report. Only 10 have filed ten or more, accounting for 135 reports.
Health plans repeat most often
Organizations with more than one report filed 40.1% of all reports from health plans, compared with 20.2% of reports from healthcare providers and 22.7% from business associates.
Growth comes from new names
Yearly reports rose from 270 in 2015 to 807 in 2025, but the share filed by organizations that had already reported in the previous five years stayed between 8.2% and 14.7%.
Checked against HHS
Our count of 741 reports submitted in 2024 is within 0.13% of the 742 reports HHS gives in its annual report to Congress.
Which Healthcare Organizations Have Reported the Most Data Breaches
HHS lists every breach of unsecured health information that affects 500 or more people under the name of the organization that filed it.
Humana Inc. ranks first with 22 reports, 2 more than Walgreen Co. with 20. Blue Shield of California follows with 17, Alvaria, Inc. filed 13, all on one day, and Walmart Inc. and Montefiore Medical Center filed 11 and 11.
In total, 209 organizations have filed three or more breach reports. The ranking counts reports, not the number of people affected, and it does not adjust for size: a national insurer or pharmacy chain handles far more patient records than a single clinic. A report means an organization notified HHS of a breach; it does not show who caused the breach or whether HHS found a violation.
We group reports by the organization's name as filed, after removing differences in punctuation, case, trailing legal suffixes such as Inc., LLP or P.A., and case numbers that some filers add (the exact steps are in the methodology). Humana Inc.'s 22 reports appear under 6 spellings of that name. We do not merge related names: "Insurance ACE/Humana Inc." appears on 5 further reports that are counted separately.
Counted by corporate family instead of reporting entity, the order changes. Names beginning with UnitedHealth, United Healthcare or Optum appear on 31 reports under 17 different names, names beginning with Kaiser on 29 reports under 21 names, and Humana names on 27. Other groups also report under several names, for example Aetna, part of CVS Health since 2018. We do not rank these families because the portal does not record corporate ownership.
Organizations with the most HHS breach reports, Oct 2009–Sep 2026
| Organization | Reports | Days | Latest |
|---|---|---|---|
| Humana Inc | 22 | 22 | 2024 |
| Walgreen Co. | 20 | 20 | 2025 |
| Blue Shield of California | 17 | 16 | 2025 |
| Alvaria, Inc. | 13 | 1 | 2023 |
| Walmart Inc. | 11 | 11 | 2024 |
| Montefiore Medical Center | 11 | 10 | 2022 |
| Brightline, Inc. | 11 | 5 | 2023 |
| Aetna ACE | 10 | 10 | 2024 |
| University of Michigan/Michigan Medicine | 10 | 10 | 2026 |
| Aetna | 10 | 9 | 2026 |
| Health Care Service Corporation | 9 | 9 | 2025 |
| Henry Ford Health System | 8 | 8 | 2019 |
| Benefit Plan Administrators, Inc. | 8 | 6 | 2022 |
| BlueCross BlueShield of Tennessee, Inc. | 7 | 7 | 2026 |
| Kaiser Foundation Health Plan, Inc. | 7 | 7 | 2024 |
All organizations with three or more reports
| Organization | Reports | Days | Latest |
|---|---|---|---|
| Roper St. Francis Healthcare | 7 | 7 | 2024 |
| UnitedHealth Group health plan single affiliated covered entity | 7 | 7 | 2020 |
| University of Miami | 7 | 7 | 2026 |
| Wisconsin Department of Health Services | 7 | 7 | 2026 |
| United Healthcare Services, Inc. Single Affiliated Covered Entity | 7 | 6 | 2023 |
| Altos Inc | 7 | 1 | 2025 |
| Advocate Aurora Health | 6 | 6 | 2022 |
| Anthem, Inc. | 6 | 6 | 2021 |
| Community Health Network, Inc. | 6 | 6 | 2025 |
| CVS Pharmacy | 6 | 6 | 2024 |
| North Carolina Department of Health and Human Services | 6 | 6 | 2025 |
| NYC Health + Hospitals | 6 | 6 | 2026 |
| Trinity Health | 6 | 6 | 2026 |
| UT Southwestern Medical Center | 6 | 6 | 2024 |
| Veterans Health Administration | 6 | 6 | 2025 |
| Washington University School of Medicine | 6 | 6 | 2022 |
| WellCare Health Plans, Inc. | 6 | 6 | 2020 |
| Highmark Inc | 6 | 5 | 2024 |
| StayWell Health Management, LLC | 6 | 4 | 2014 |
| Allina Health | 5 | 5 | 2023 |
| AltaMed Health Services Corporation | 5 | 5 | 2026 |
| Baylor College of Medicine | 5 | 5 | 2024 |
| Brigham and Women's Hospital | 5 | 5 | 2023 |
| California Correctional Health Care Services | 5 | 5 | 2025 |
| County of Los Angeles Department of Mental Health | 5 | 5 | 2024 |
| Georgia Department of Human Services | 5 | 5 | 2021 |
| Insurance ACE/Humana Inc. | 5 | 5 | 2026 |
| L.A. Care Health Plan | 5 | 5 | 2026 |
| Lake County Health Department and Community Health Center | 5 | 5 | 2026 |
| Mayo Clinic | 5 | 5 | 2025 |
| Memorial Sloan Kettering Cancer Center | 5 | 5 | 2024 |
| Minnesota Department of Human Services | 5 | 5 | 2026 |
| Molina Healthcare | 5 | 5 | 2023 |
| Sentara Healthcare | 5 | 5 | 2023 |
| Triple S Salud Inc. | 5 | 5 | 2014 |
| University Medical Center of Southern Nevada | 5 | 5 | 2026 |
| University of California, San Francisco | 5 | 5 | 2023 |
| University of Missouri Health Care | 5 | 5 | 2023 |
| Wyoming Department of Health | 5 | 5 | 2021 |
| Fieldtex Products, Inc. | 5 | 3 | 2025 |
| Philips Respironics | 5 | 3 | 2024 |
| AFLAC | 4 | 4 | 2019 |
| Artesia General Hospital | 4 | 4 | 2024 |
| Aultman Hospital | 4 | 4 | 2024 |
| Aventura Hospital and Medical Center | 4 | 4 | 2015 |
| Bayhealth Medical Center, Inc. | 4 | 4 | 2024 |
| Beaumont Health | 4 | 4 | 2021 |
| BioReference Laboratories Inc | 4 | 4 | 2019 |
| Centers for Medicare & Medicaid Services | 4 | 4 | 2025 |
| Children's Mercy Hospital | 4 | 4 | 2018 |
| Cook County Health & Hospitals System | 4 | 4 | 2017 |
| County of Los Angeles | 4 | 4 | 2016 |
| Dallas County Mental Health Mental Retardation Center dba Metrocare Services | 4 | 4 | 2025 |
| Emory Healthcare | 4 | 4 | 2022 |
| Erlanger Health | 4 | 4 | 2026 |
| Florida Department of Health | 4 | 4 | 2024 |
| Florida Healthy Kids Corporation | 4 | 4 | 2021 |
| HealthEquity, Inc. | 4 | 4 | 2024 |
| Houston Methodist Hospital | 4 | 4 | 2020 |
| Indiana University Health | 4 | 4 | 2023 |
| Inova Health System | 4 | 4 | 2021 |
| Insulet Corporation | 4 | 4 | 2025 |
| Iowa Department of Human Services | 4 | 4 | 2020 |
| Jackson Health System | 4 | 4 | 2025 |
| Massachusetts General Hospital | 4 | 4 | 2019 |
| Medical Mutual of Ohio | 4 | 4 | 2022 |
| Memorial Healthcare System | 4 | 4 | 2014 |
| Memorial Hermann Health System | 4 | 4 | 2021 |
| National Imaging Associates | 4 | 4 | 2022 |
| Oregon Health & Science University | 4 | 4 | 2013 |
| Rady Children's Hospital - San Diego | 4 | 4 | 2020 |
| Rite Aid Corporation | 4 | 4 | 2023 |
| Roswell Park Comprehensive Cancer Center | 4 | 4 | 2025 |
| Texas Health and Human Services Commission | 4 | 4 | 2026 |
| The University of Texas MD Anderson Cancer Center | 4 | 4 | 2018 |
| University of Florida | 4 | 4 | 2020 |
| UW Medicine | 4 | 4 | 2022 |
| Clearpoint Design, Inc. | 4 | 3 | 2013 |
| HealthFitness | 4 | 3 | 2019 |
| Managed Health Services | 4 | 3 | 2019 |
| Northwood, Inc. | 4 | 3 | 2019 |
| Quantum Health Consulting | 4 | 2 | 2012 |
| Bansley and Kiener, LLP | 4 | 1 | 2021 |
| Affinity Health Plan, Inc. | 3 | 3 | 2015 |
| Alive Hospice | 3 | 3 | 2019 |
| Ann & Robert H. Lurie Children's Hospital of Chicago | 3 | 3 | 2024 |
| Arkansas Blue Cross and Blue Shield | 3 | 3 | 2024 |
| Atrium Health | 3 | 3 | 2024 |
| AU Medical Center, Inc. | 3 | 3 | 2018 |
| Aveanna Healthcare | 3 | 3 | 2024 |
| Beacon Health System | 3 | 3 | 2023 |
| Buckeye Health Plan | 3 | 3 | 2023 |
| Cancer Treatment Centers of America (CTCA) at Southeastern Regional Medical Center | 3 | 3 | 2019 |
| CareOregon | 3 | 3 | 2025 |
| CareSource | 3 | 3 | 2023 |
| Central Utah Clinic, P.C. dba Revere Health | 3 | 3 | 2025 |
| Centura Health | 3 | 3 | 2021 |
| Children's Hope Alliance | 3 | 3 | 2020 |
| Children's National Medical Center | 3 | 3 | 2018 |
| Cigna | 3 | 3 | 2019 |
| City of Hope | 3 | 3 | 2023 |
| City of Philadelphia | 3 | 3 | 2023 |
| Clinical Reference Laboratory, Inc. | 3 | 3 | 2015 |
| Colorado Department of Human Services | 3 | 3 | 2022 |
| CompuNet Clinical Laboratories | 3 | 3 | 2024 |
| Connecticut Department of Social Services | 3 | 3 | 2026 |
| CVS Caremark | 3 | 3 | 2025 |
| CVS Health | 3 | 3 | 2017 |
| DaVita Inc. | 3 | 3 | 2025 |
| Defense Health Agency | 3 | 3 | 2026 |
| Delta Dental of Illinois | 3 | 3 | 2019 |
| DentaQuest | 3 | 3 | 2026 |
| Duke University Health System | 3 | 3 | 2014 |
| Elara Caring | 3 | 3 | 2026 |
| Florida Blue | 3 | 3 | 2022 |
| Florida Digestive Health Specialists, LLP | 3 | 3 | 2024 |
| Florida Hospital | 3 | 3 | 2018 |
| Fred Hutchinson Cancer Center | 3 | 3 | 2023 |
| Harbor | 3 | 3 | 2025 |
| Harvard Pilgrim Health Care, Inc. | 3 | 3 | 2026 |
| Health Plan of San Mateo | 3 | 3 | 2023 |
| Healthfirst | 3 | 3 | 2024 |
| Horizon Healthcare Services, Inc., doing business as Horizon Blue Cross Blue Shield of New Jersey, and its affiliates | 3 | 3 | 2016 |
| Hospice of the Bluegrass, Inc. dba Bluegrass Care Navigators | 3 | 3 | 2024 |
| Illinois Department of Healthcare and Family Services | 3 | 3 | 2021 |
| Independence Blue Cross | 3 | 3 | 2022 |
| Jersey City Medical Center | 3 | 3 | 2022 |
| Kmart Corporation | 3 | 3 | 2014 |
| Lawrence General Hospital | 3 | 3 | 2023 |
| Legacy Community Health Services | 3 | 3 | 2020 |
| Lincoln National Corporation d/b/a Lincoln Financial | 3 | 3 | 2026 |
| Louisiana State University Health Care Services Division | 3 | 3 | 2020 |
| McLaren Health Care | 3 | 3 | 2025 |
| MedStar Health, Inc. | 3 | 3 | 2025 |
| MetroPlus Health Plan, Inc. | 3 | 3 | 2017 |
| Monongalia Health System, Inc. | 3 | 3 | 2025 |
| Mount Sinai Medical Center | 3 | 3 | 2015 |
| New Jersey Department of Human Services | 3 | 3 | 2020 |
| NewYork-Presbyterian Hospital | 3 | 3 | 2026 |
| Northwestern Memorial HealthCare | 3 | 3 | 2021 |
| Option Care Health, Inc. | 3 | 3 | 2026 |
| Orlando Health | 3 | 3 | 2022 |
| Peachtree Orthopaedic Clinic | 3 | 3 | 2023 |
| Phoebe Putney Memorial Hospital | 3 | 3 | 2014 |
| Presbyterian Healthcare Services | 3 | 3 | 2022 |
| Prestera Center for Mental Health Services, Inc. | 3 | 3 | 2021 |
| PRIME THERAPEUTICS LLC | 3 | 3 | 2025 |
| Priority Health | 3 | 3 | 2022 |
| Providence Health Plan | 3 | 3 | 2021 |
| Rocky Mountain Health Care Services | 3 | 3 | 2019 |
| Rush University Medical Center | 3 | 3 | 2019 |
| Self Regional Healthcare | 3 | 3 | 2025 |
| Seneca Family of Agencies | 3 | 3 | 2022 |
| Sentara Health | 3 | 3 | 2025 |
| Seven Counties Services, Inc. | 3 | 3 | 2024 |
| Starling Physicians | 3 | 3 | 2021 |
| Summit Medical Group, PLLC | 3 | 3 | 2024 |
| SUNSHINE STATE HEALTH PLAN, INC. | 3 | 3 | 2020 |
| Superior HealthPlan | 3 | 3 | 2021 |
| Texas Children's Hospital | 3 | 3 | 2020 |
| Texas Tech University Health Sciences Center | 3 | 3 | 2024 |
| The Kroger Company | 3 | 3 | 2021 |
| The MetroHealth System | 3 | 3 | 2023 |
| The Union Labor Life Insurance Company | 3 | 3 | 2019 |
| Thomas Jefferson University Hospitals, Inc. | 3 | 3 | 2012 |
| UNC Hospitals | 3 | 3 | 2025 |
| Union Security Insurance Company | 3 | 3 | 2013 |
| United Seating and Mobility, L.L.C., d/b/a Numotion | 3 | 3 | 2025 |
| University of Arkansas for Medical Sciences | 3 | 3 | 2022 |
| University of California, Los Angeles Health | 3 | 3 | 2026 |
| University of Rochester Medical Center and Affiliates | 3 | 3 | 2015 |
| University of Utah | 3 | 3 | 2020 |
| University of Utah Health | 3 | 3 | 2023 |
| University of Wisconsin Hospitals and Clinics Authority | 3 | 3 | 2024 |
| UPMC | 3 | 3 | 2026 |
| Valley Mountain Regional Center | 3 | 3 | 2025 |
| Vanderbilt University Medical Center | 3 | 3 | 2026 |
| Virginia Department of Behavioral Health and Developmental Services | 3 | 3 | 2026 |
| Virginia Department of Medical Assistance Services | 3 | 3 | 2023 |
| Virginia Mason Medical Center | 3 | 3 | 2022 |
| Washington State Department of Social and Health Services | 3 | 3 | 2020 |
| WellDyneRx, LLC | 3 | 3 | 2026 |
| Wirt County Health Services Association d/b/a Coplin Health Systems | 3 | 3 | 2021 |
| Wisconsin Department of Corrections | 3 | 3 | 2025 |
| Yale University | 3 | 3 | 2022 |
| ZDI | 3 | 3 | 2013 |
| Gainwell Technologies, LLC | 3 | 2 | 2025 |
| Miracle - Ear | 3 | 2 | 2021 |
| Summa Health | 3 | 2 | 2025 |
| The Kroger Co., for itself and its affiliates and subsidiaries | 3 | 2 | 2019 |
| Canon Business Process Services Inc | 3 | 1 | 2022 |
| Community Psychiatric Clinic | 3 | 1 | 2019 |
| HealthPartners Administrators, Inc. | 3 | 1 | 2014 |
| McEwen & Associates | 3 | 1 | 2025 |
Days = number of different dates on which the organization filed. A business associate may file one report per client on the same day.
How Many Organizations Report More Than One Data Breach
Most organizations on the HHS portal appear only once.
Of 6,854 organizations, 680 (9.9%) have filed two or more reports, and 56 have filed five or more. Repeat reporters account for 1,847 of the 8,021 reports.
A report is not always a separate incident. When a vendor that handles health data for many clients is breached, the vendor (a business associate) can file on behalf of its clients. Alvaria, Inc., a business associate, filed 13 reports on a single day, and 29 of the 680 repeat reporters filed all of their reports on one date. Across the portal, 80 reports were filed by an organization that had already filed on the same day.
The same vendor breach can also be reported separately by each client under the client's own name, so one incident can appear many times on the portal under different organizations.
Share of all HHS breach reports by number of reports per organization
- 1 report77.0%6,174 organizations · 6,174 reports
- 2 reports11.7%471 organizations · 942 reports
- 3 to 4 reports6.3%153 organizations · 501 reports
- 5 to 9 reports3.4%46 organizations · 269 reports
- 10 or more reports1.7%10 organizations · 135 reports
Are the Same Organizations Reporting Data Breaches Again
The number of large health data breach reports has risen sharply since 2015, while the share from returning reporters has not risen.
In every full year from 2015 through 2025, between 8.2% and 14.7% of reports came from organizations that had already reported in the previous five calendar years. In 2025 that was 78 of 807 reports (9.7%).
We use a fixed five-year look-back so that years can be compared: an organization counts as a returning reporter in a given year if it filed at least one report in the five preceding calendar years. Counting any earlier report since 2009 instead, the share for 2025 is 13.9%. The highest five-year share in the series was 14.7% in 2019.
The 2026 figures run through September 30 and are not comparable to full years. Organizations notify HHS at the same time as the affected people, which can be up to 60 days after they discover a breach, so reports about 2026 breaches will keep arriving.
Share of HHS breach reports from organizations that reported in the prior five years
- 201510.7%29 of 270 reports · full year
- 20168.2%27 of 328 reports · full year
- 201712.6%45 of 358 reports · full year
- 20189.5%35 of 369 reports · full year
- 201914.7%75 of 511 reports · full year
- 202010.7%71 of 663 reports · full year
- 202110.9%78 of 715 reports · full year
- 202210.6%76 of 718 reports · full year
- 202310.3%77 of 745 reports · full year
- 202410.8%80 of 741 reports · full year
- 20259.7%78 of 807 reports · full year
- 20269.7%55 of 570 reports · partial (through Sep 30)
Calendar years by submission date. 2026 covers January through September only.
Do Health Plans or Hospitals Report Repeated Data Breaches More Often
HHS records whether the filer is a healthcare provider, a health plan, a clearinghouse or a business associate.
Repeat reporters filed 40.1% of the 969 health plan reports, compared with 20.2% of the 5,798 reports from healthcare providers and 22.7% of the 1,232 reports from business associates.
Health plans filed fewer reports than providers, but a larger share of them came from organizations that report again. The comparison does not account for the number of members or patients each organization serves. An organization can appear under more than one entity type over the years; the table counts each report under the type given in that report.
HHS breach reports filed by repeat reporters, by entity type
| Entity type | Reports | By repeaters | Share |
|---|---|---|---|
| Healthcare Provider | 5,798 | 1,171 | 20.2% |
| Business Associate | 1,232 | 280 | 22.7% |
| Health Plan | 969 | 389 | 40.1% |
| Healthcare Clearing House | 17 | 4 | 23.5% |
| Not specified | 5 | 3 | 60.0% |
Download the Data and Cite This Study
Every table as a CSV file and in one Excel workbook, a short PDF summary and every chart as an image, free to reuse with attribution (CC BY 4.0).
- HHS breach reporters by number of reportsHow many organizations filed one, two, three to four, five to nine, or ten or more breach reports with HHS OCR, and the share of all reports they account for. · 5 rows · CSV, 1 KB
- Organizations with three or more HHS breach reportsEvery organization (reported name after light cleanup, plus state) that filed three or more breach reports affecting 500+ individuals with HHS OCR from October 2009 through September 2026, ranked by number of reports. · 209 rows · CSV, 16 KB
- Share of HHS breach reports filed by returning reporters, by yearFor each submission year from 2015 (2026 partial, through Sep 30), the number of breach reports and the share filed by organizations that had already reported in the previous five calendar years or at any earlier date. · 12 rows · CSV, 1 KB
- Repeat HHS breach reporters by entity typeBreach reports by HHS entity type and the share filed by organizations with two or more reports. · 5 rows · CSV, 1 KB
- All tables in one Excel workbookOne sheet per table plus an About sheet with sources, method and citation · Excel (.xlsx), 24 KB
- Summary to print or forward (3 pages)Short answer, key figures, main chart, findings, method and citation · PDF, 224 KB
Charts for your story
Organizations with the most HHS breach reports, Oct 2009–Sep 2026
Embed this chart
Share of all HHS breach reports by number of reports per organization
Embed this chart
Share of HHS breach reports from organizations that reported in the prior five years
Embed this chart
HHS breach reports filed by repeat reporters, by entity type
Embed this chart
How to cite
Goldberg, L. (2026). Repeat Health Data Breach Reporters — HHS breach reports by organization (October 2009–September 2026) [Data set]. Settlement Insight. https://settlementinsight.com/research/repeat-health-data-breach-reporters
BibTeX
@dataset{goldberg_2026_repeat_health_data_breach_reporters,
author = {Goldberg, Leonard},
title = {Repeat Health Data Breach Reporters --- HHS breach reports by organization (October 2009--September 2026)},
year = {2026},
publisher = {Settlement Insight},
url = {https://settlementinsight.com/research/repeat-health-data-breach-reporters}
}How We Measured
Checked against published figures
- All breach reports affecting 500+ individuals submitted to the HHS OCR breach portal in calendar year 2024 (by submission date): published 742, our count 741 (0.13% apart).HHS Office for Civil Rights, Annual Report to Congress on Breaches of Unsecured Protected Health Information for Calendar Year 2024 (archived copy)
Full method and limits of the data
An organization is the reported name of the covered entity, together with its state as listed (rows without a state form their own group). Names are matched after these steps, in order: Unicode NFKC normalization and lower case; text in square brackets (case numbers) removed; periods and apostrophes deleted, so "P.A." becomes "pa" and "d.b.a." becomes "dba"; where the name contains "d/b/a", "dba" or "doing business as", only the trade name after it is kept; every other character that is not a letter a–z or a digit (commas, hyphens, slashes, ampersands, parentheses, accented letters) replaced by a space; and, repeatedly, a final word Inc, Incorporated, Co, Company, Corp, Corporation, LLC, LLP, LP, LC, Ltd, Limited, PC, PA, PLLC or PLC removed. We do not merge parent companies, subsidiaries, regional plans or affiliated covered entities that file under different names, and no other spelling variants are matched by hand. A repeat reporter is an organization with two or more reports in the whole period; every listed row counts as a report, including the few rows that repeat another row.
For the yearly series, a report counts as coming from a returning reporter if the same organization filed at least one report in the five calendar years before the year of submission. The series starts in 2015, the first year with five full prior years of data. Years are calendar years by submission date.
To check completeness, we counted reports submitted in calendar year 2024: our table has 741, HHS reports 742 in its annual report to Congress for 2024, a difference of 0.13%.
What this data cannot tell you
- The ranking is by reporting entity, not by corporate family. Large groups such as UnitedHealth Group or Kaiser Permanente report under many names, and a different grouping would change the order.
- A report is not the same as a separate incident. A business associate can file one report per client on the same day, and one vendor breach can be reported separately by many covered entities under their own names. Each report also counts the same whether it affected 500 people or millions.
- Rankings by number of reports do not account for organization size. Larger insurers, pharmacy chains and health systems handle more records and may have more reportable incidents. A report does not mean the organization caused the breach or that HHS found a violation.
- The portal covers only breaches affecting 500 or more people; smaller breaches may be reported to HHS once a year and are not listed on the portal. Our copy of the portal has 6 rows that repeat the name, state, date and count of another row; we keep them as listed. HHS itself describes a few other entries as duplicates of an earlier report, in at least one case filed on a different date; because we keep every row, such duplicates can make an organization count as a repeat reporter.
- Reports about recent breaches keep arriving, because organizations notify HHS together with the affected people, up to 60 days after discovering a breach. The 2026 figures run through September 30 and will rise as more reports are posted, so they are not comparable with full years.
Frequently Asked Questions
Which healthcare organization has reported the most data breaches to HHS?
Humana Inc. has filed 22 breach reports affecting 500 or more people with the HHS Office for Civil Rights, more than any other reporting entity on the federal breach portal. Walgreen Co. follows with 20 and Blue Shield of California with 17.
How many data breaches has Walgreens reported?
Walgreen Co. has filed 20 breach reports affecting 500 or more people with HHS, from 2012 through 2025, each on a different day. That ranks second among all reporting entities on the HHS breach portal.
How many data breaches has Blue Shield of California reported?
Blue Shield of California, including filings as California Physicians' Service doing business as Blue Shield of California, has filed 17 breach reports with HHS from 2015 through 2025. It ranks third among all reporting entities on the HHS breach portal.
Which hospitals have had repeated data breaches?
Montefiore Medical Center in New York has filed 11 breach reports with HHS on 10 different days between 2010 and 2022. The full list of 209 organizations with three or more reports is in the CSV.
How many healthcare data breaches were reported to HHS in 2024?
HHS received 742 reports of breaches affecting 500 or more people in 2024, according to its annual report to Congress. Our copy of the HHS breach portal lists 741 reports submitted that year.
What share of health data breaches come from repeat reporters?
Organizations with two or more reports filed 23.0% of all 8,021 breach reports on the HHS portal since 2009. In 2025, 9.7% of reports came from organizations that had already reported in the previous five years.
Sources
- Breach Portal: Notice to the Secretary of HHS of Breach of Unsecured Protected Health Information — U.S. Department of Health and Human Services, Office for Civil Rights
- Annual Report to Congress on Breaches of Unsecured Protected Health Information for Calendar Year 2024 (archived copy) — U.S. Department of Health and Human Services, Office for Civil Rights
- Submitting Notice of a Breach to the Secretary (archived copy) — U.S. Department of Health and Human Services, Office for Civil Rights
- Independent analysis. Settlement Insight is not a law firm and not affiliated with any agency named here. Analysis by Leonard Goldberg, Editor. How we work: methodology, our data.
More Research and Data
Other studies from our database of public legal records — each with free CSV downloads.
Related research
- Mental Health Provider Data BreachesBreaches reported to HHS by mental and behavioral health providers.
- Medical Malpractice SettlementsWhat malpractice payments look like in federal data.
- COPPA PenaltiesFTC penalties for collecting children's data online.
- Our DataThe government datasets behind our research.
Latest studies
- Bank complaints closed with moneyBank of America, N.A. closed 36.0% of 2025 checking/savings complaints with money, top of firms with 500+
- Dental Data Breaches276 dental breach reports to HHS, 45.7 million individuals affected (sum of reports)
- Disputed NY Workers' Comp InjuriesNY workers' comp: 47% of hearing-loss claims disputed, 4% of contusions (2022–2024)
- OFAC penalties by companyTen companies account for 75.2% of all OFAC penalty dollars since 2003