Our searchable tally of HIPAA breaches since 2009 shows an industry still unprepared to keep data safe
More than 41 million people have had their protected health information compromised in HIPAA privacy and security breaches. Using data from the Department of Health and Human Services, which includes HIPAA breaches involving more than 500 individuals, reported by 1,149 covered entities and business associates, we've compiled a sortable, searchable list for our readers. Simply click on the small gray arrow in the column heading you'd like to sort by. To search the list, just enter your term into the search box at the top right.
| Covered entity | State | People affected | Date | Type | Info location |
|---|---|---|---|---|---|
| Covered entity | State | People affected | Date | Type | Info location |
| Science Applications International Corp., SAIC | Virginia | 4,900,000 | 11/4/11 | Loss | Other |
| Community Health Systems Professional Services Corp. | Tennessee | 4,500,000 | 8/20/14 | Theft | Network Server |
| Advocate Health and Hospitals Corp., Advocate Medical Group | Illinois | 4,029,530 | 8/23/13 | Theft | Desktop Computer |
| Xerox State Healthcare | Texas | 2,000,000 | 9/10/14 | Unauthorized Access/Disclosure | Desktop Computer, Email, Laptop, Network Server, Other, Other Portable Electronic Device |
| IBM | New York | 1,900,000 | 4/14/11 | Unknown | Other |
| GRM Information Management Services | New Jersey | 1,700,000 | 2/11/11 | Theft | Electronic Medical Record, Other |
| AvMed | Florida | 1,220,000 | 6/3/10 | Theft | Laptop |
| Montana Department of Public Health and Human Services | Montana | 1,062,509 | 7/7/14 | Hacking/IT Incident | Network Server |
| The Nemours Foundation | Florida | 1,055,489 | 10/7/11 | Loss | Other |
| BlueCross BlueShield of Tennessee | Tennessee | 1,023,209 | 11/1/10 | Theft | Other |
| Sutter Medical Foundation | Alabama | 943,434 | 11/17/11 | Theft | Desktop Computer |
| Horizon Healthcare Services, as Horizon Blue Cross Blue Shield of New Jersey & affiliates | New Jersey | 839,711 | 1/3/14 | Theft | Laptop |
| Iron Mountain Data Products | Pennsylvania | 800,000 | 7/19/10 | Loss | Electronic Medical Record, Other, Other Portable Electronic Device |
| Utah Department of Technology Services | Utah | 780,000 | 4/11/12 | Hacking/IT Incident | Network Server |
| AHMC Healthcare Inc. & affiliated Hospitals | California | 729,000 | 10/25/13 | Theft | Laptop |
| Eisenhower Medical Center | California | 514,330 | 3/30/11 | Theft | Desktop Computer |
| Triple-S Management Corp., Triple-S Salud | Puerto Rico | 475,000 | 11/4/10 | Hacking/IT Incident, Unauthorized Access/Disclosure | Network Server |
| St. Joseph Health System | Texas | 405,000 | 2/5/14 | Hacking/IT Incident | Network Server |
| Triple-C, 3rd party admin for Triple-S | Puerto Rico | 398,000 | 1/24/14 | Theft | Network Server |
| Affinity Health Plan | New York | 344,579 | 4/14/10 | Theft | Other |
| Sutherland Healthcare Solutions | New Jersey | 342,197 | 5/22/14 | Theft | Email, Laptop |
| Emory Healthcare | Georgia | 315,000 | 4/18/12 | Other, Unknown | Other |
| Touchstone Medical Imaging | Tennessee | 307,528 | 10/3/14 | Unauthorized Access/Disclosure | Network Server |
| Shred-it International Inc. | Texas | 277,014 | 7/11/13 | Improper Disposal | Other |
| Seacoast Radiology, PA | New Hampshire | 231,400 | 1/10/11 | Hacking/IT Incident | Network Server |
| South Carolina Department of Health and Human Services | South Carolina | 228,435 | 4/24/12 | Unauthorized Access/Disclosure | |
| Indian Health Service | Maryland | 214,000 | 4/1/14 | Unauthorized Access/Disclosure | Laptop |
| Digital Archive Management | Texas | 189,489 | 5/7/13 | Improper Disposal | Paper/Films |
| RCR Technology Corporation | Indiana | 187,533 | 7/1/13 | Other | Paper/Films |
| Millennium Medical Management Resources | Illinois | 180,111 | 4/29/10 | Theft | Other, Other Portable Electronic Device |
| Walgreen Co. | Illinois | 160,000 | 12/15/14 | Other | Paper/Films |
| Ankle + Foot Center of Tampa Bay | Florida | 156,000 | 1/3/11 | Theft | Network Server |
| Oklaholma State Dept. of Health | Oklahoma | 132,940 | 4/11/11 | Theft | Laptop, Paper/Films |
| Siemens Medical Solutions, USA | Pennsylvania | 130,495 | 6/4/10 | Theft | Other |
| Alere Home Monitoring | California | 116,506 | 10/18/12 | Theft | Laptop |
| Medical Card System/MCS-HMO/MCS Advantage/MCS Life | Puerto Rico | 115,000 | 11/9/10 | Unauthorized Access/Disclosure | Other, Other Portable Electronic Device |
| Crescent Health Inc., a Walgreens Company | California | 109,000 | 2/22/13 | Theft | Desktop Computer |
| Memorial Healthcare System | Florida | 105,646 | 8/16/12 | Theft | Electronic Medical Record |
| Governor's Office of Information Technology | Colorado | 105,470 | 7/9/10 | Theft | Desktop Computer |
| NRAD Medical Associates, PC | New York | 97,000 | 6/20/14 | Hacking/IT Incident, Unauthorized Access/Disclosure | Desktop Computer, Other Portable Electronic Device |
| Hartford Hospital | Connecticut | 93,500 | 4/5/11 | Theft | Other |
| Patient Care Services at Saint Francis | Oklahoma | 84,000 | 4/6/11 | Theft | Network Server |
| Providence Hospital | Michigan | 83,945 | 4/5/10 | Other | Other |
| Democracy Data & Communications | Virginia | 83,000 | 12/8/09 | Other | Paper/Films |
| Valesco Ventures | Florida | 82,601 | 9/9/14 | Theft, Unauthorized Access/Disclosure | Electronic Medical Record |
| Tennessee Rural Health Improvement Association | Tennessee | 79,000 | 1/13/15 | Unauthorized Access/Disclosure | Other |
| Area Agency on Aging, Ohio District 5 | Ohio | 78,042 | 6/27/11 | Theft | Laptop |
| Central Dermatology Center, PA | North Carolina | 76,258 | 11/7/14 | Theft | Network Server |
| UW Medicine | Washington | 76,183 | 11/27/13 | Hacking/IT Incident | Desktop Computer |
| Amerigroup Texas | Virginia | 75,026 | 4/10/14 | Theft | Paper/Films |
| Visionworks Inc. | Texas | 74,944 | 11/10/14 | Loss | Network Server |
| Siemens Medical Solutions | Pennsylvania | 66,601 | 8/10/12 | Theft | Laptop |
| Apria Healthcare | California | 65,700 | 10/10/12 | Theft | Laptop |
| University of Miami | Florida | 64,846 | 9/7/12 | Other, Unauthorized Access/Disclosure | Paper/Films |
| Neurological Institute of Savannah & Center for Spine | Georgia | 63,425 | 8/15/11 | Theft | Other, Other Portable Electronic Device |
| St. Vincent Hospital and Health Care Center | Indiana | 63,325 | 7/9/14 | Unauthorized Access/Disclosure | Paper/Films |
| St. Vincent Hospital and Health Care Center | Indiana | 63,325 | 2/27/15 | Unauthorized Access/Disclosure | Paper/Films |
| Cincinnati Children's Hospital Medical Center | Ohio | 60,998 | 6/1/10 | Theft | Laptop |
| Onsite Health Diagnostics | Texas | 60,582 | 8/8/14 | Hacking/IT Incident | Network Server |
| L.A. Gay & Lesbian Center | California | 59,000 | 12/10/13 | Hacking/IT Incident | Network Server |
| Triple-S Salud Inc. | Puerto Rico | 56,853 | 5/29/14 | Unauthorized Access/Disclosure | Paper/Films |
| Omnicell | California | 56,820 | 12/31/12 | Theft | Laptop |
| Boston Baskin Cancer Foundation | Tennessee | 56,694 | 2/2/15 | Theft | Other Portable Electronic Device |
| Banner Health | Arizona | 55,207 | 3/5/14 | Other | Other |
| Cancer Care Group, PC | Indiana | 55,000 | 8/28/12 | Theft | Other Portable Electronic Device |
| Lebanon Internal Medicine Associates | Pennsylvania | 55,000 | 11/2/11 | Improper Disposal | Network Server |
| Praxair Healthcare Services (Home Care Supply) | Connecticut | 54,165 | 4/19/10 | Theft | Laptop |
| InSync Computer Solutions | Alabama | 50,918 | 7/11/14 | Other | Network Server |
| Alamance Caswell Local Management Entity | North Carolina | 50,000 | 1/10/12 | Other, Unauthorized Access/Disclosure | Email, Network Server |
| Iron Mountain | California | 49,714 | 8/15/14 | Improper Disposal, Loss, Theft | Paper/Films |
| Kaiser Foundation Hospital-Orange County | California | 49,000 | 11/22/13 | Loss | Other Portable Electronic Device |
| North Carolina Department of Health and Human Services | North Carolina | 48,752 | 1/6/14 | Unauthorized Access/Disclosure | Other |
| Visionworks Inc. | Texas | 47,683 | 11/21/14 | Theft | Network Server |
| Methodist Dallas Medical Center, Methodist Health System | Texas | 44,000 | 12/6/13 | Unauthorized Access/Disclosure | Other |
| Aspire Indiana | Indiana | 43,890 | 1/7/15 | Theft | Laptop |
| Froedtert Health | Wisconsin | 43,549 | 2/12/13 | Unauthorized Access/Disclosure | Other |
| The Union Labor Life Insurance Company | Maryland | 42,713 | 6/27/14 | Theft | Laptop |
| Safe Ride Services | Arizona | 42,000 | 5/1/12 | Hacking/IT Incident, Unauthorized Access/Disclosure | Network Server |
| University of Wisconsin Madison School of Pharmacy | Wisconsin | 41,437 | 1/30/14 | Loss | Other Portable Electronic Device |
| Silicon Valley Eyecare Optometry and Contact Lenses | California | 40,000 | 5/13/10 | Theft | Network Server |
| Self Regional Healthcare | South Carolina | 38,906 | 7/25/14 | Theft | Laptop |
| Ortho Montana, PSC | Montana | 37,000 | 2/8/11 | Theft | Laptop |
| Professional Transcription Services | New York | 37,000 | 10/25/13 | Unauthorized Access/Disclosure | Network Server |
| Jersey City Medical Center - Barnabas Health | New Jersey | 36,400 | 8/7/14 | Loss | Other |
| Center for Orthopedic Research and Education | Arizona | 35,488 | 12/21/12 | Theft | Paper/Films |
| MD Manage (Vcarve) | New Jersey | 35,357 | 10/22/14 | Unauthorized Access/Disclosure | Network Server |
| Santa Rosa Memorial Hospital | California | 33,702 | 6/13/14 | Loss, Theft | Other Portable Electronic Device |
| Cedars-Sinai Health System | California | 33,136 | 9/10/14 | Theft | Laptop |
| County of Los Angeles | California | 33,000 | 9/17/10 | Theft | Paper/Films |
| MMM Healthcare | Puerto Rico | 32,390 | 5/9/11 | Theft | Desktop Computer |
| M2ComSys Inc. | Nevada | 32,151 | 8/8/13 | Unauthorized Access/Disclosure | Network Server |
| MedAssets | New Jersey | 32,008 | 8/18/11 | Theft | Other, Other Portable Electronic Device |
| Cogent Healthcare | Tennessee | 32,000 | 8/30/13 | Theft | Network Server |
| MetroPlus Health Plan | New York | 31,980 | 11/20/14 | Other | |
| WellPoint | Indiana | 31,700 | 7/30/10 | Hacking/IT Incident | Network Server |
| Central Utah Clinic, PC | Utah | 31,677 | 8/7/14 | Hacking/IT Incident | Network Server |
| Reeve-Woods Eye Center | California | 30,000 | 11/15/14 | Theft | Network Server |
| Sony Pictures Entertainment Health and Welfare Benefits Plan | California | 30,000 | 12/12/14 | Hacking/IT Incident | Desktop Computer, Laptop, Network Server |
| The University of Texas MD Anderson Cancer Center | Texas | 29,021 | 1/24/13 | Theft | Laptop |
| Care 1st Health Plan | California | 29,000 | 7/6/10 | Loss, Other | Other, Other Portable Electronic Device |
| Gibson General Hospital | Indiana | 28,893 | 12/26/12 | Theft | Laptop |
| CareAll Management | Tennessee | 28,300 | 8/12/14 | Improper Disposal | Other |
| Health Plus Amerigroup | New York | 28,187 | 3/1/13 | Theft | Other Portable Electronic Device |
| HealthPlus, Amerigroup | New York | 28,187 | 12/21/12 | Unauthorized Access/Disclosure | Other |
| HealthPartners | Minnesota | 27,839 | 3/21/14 | Loss, Unauthorized Access/Disclosure | Desktop Computer, Laptop, Other Portable Electronic Device |
| Sovereign Medical Group | New Jersey | 27,800 | 12/27/12 | Hacking/IT Incident, Theft | Network Server |
| Blount Memorial Hospital | Tennessee | 27,799 | 10/17/12 | Theft | Laptop |
| The University of Texas at Arlington | Texas | 27,000 | 7/23/10 | Hacking/IT Incident | Network Server |
| Jamaica Hospital Medical Center | New York | 26,162 | 5/23/14 | Unauthorized Access/Disclosure | Desktop Computer |
| Computer Programs and Systems | Alabama | 25,764 | 11/26/14 | Theft | Network Server |
| Virginia Premier Health Plan | Virginia | 25,513 | 1/10/14 | Theft | Paper/Films |
| InfoCrossing | Missouri | 25,461 | 9/20/13 | Unauthorized Access/Disclosure | Paper/Films |
| Assurecare Risk Management | Illinois | 25,330 | 7/21/11 | Unauthorized Access/Disclosure | Network Server |
| Fort Worth Allergy and Asthma Associates | Texas | 25,000 | 8/5/10 | Theft | Network Server |
| Pioneer Valley Pathology | Massachusetts | 24,750 | 8/25/10 | Theft | Paper/Films |
| Our Lady of Peace Hospital | Kentucky | 24,600 | 12/29/10 | Loss, Theft | Other, Other Portable Electronic Device |
| PMC Medicare Choice | Puerto Rico | 24,361 | 5/9/11 | Theft | Desktop Computer |
| Montefiore Medical Center | New York | 23,753 | 7/23/10 | Theft | Desktop Computer |
| Aon Consulting | Pennsylvania | 22,642 | 9/7/10 | Other | Network Server |
| Cook County Health & Hospitals System | Illinois | 22,511 | 1/11/14 | Other | |
| St. Joseph Heritage Healthcare | California | 22,012 | 4/23/10 | Theft | Desktop Computer |
| Reid Hospital & Health Care Services | Indiana | 22,001 | 5/6/11 | Theft | Laptop |
| AssuranceMD f/k/a Harbor Group | Pennsylvania | 22,000 | 5/7/13 | Theft | Other Portable Electronic Device |
| Ernest T. Bice Jr. DDS, PA | Texas | 21,000 | 3/10/10 | Theft | Other, Other Portable Electronic Device |
| Harris County | Texas | 21,000 | 7/16/13 | Unauthorized Access/Disclosure | Desktop Computer |
| Thomas Jefferson University Hospitals | Pennsylvania | 21,000 | 8/9/10 | Theft | Laptop |
| Rape & Brooks Orthodontics, PC | Alabama | 20,744 | 3/28/11 | Theft | Desktop Computer, Network Server, Other, Other Portable Electronic Device |
| Indiana Internal Medicine Consultants | Indiana | 20,000 | 3/9/12 | Theft | Laptop |
| Nisar A. Quraishi, MD | New York | 20,000 | 10/22/14 | Theft | Paper/Films |
| Multi-Speciality Collection Services | California | 19,651 | 8/29/11 | Unauthorized Access/Disclosure | Other |
| Pediatric and Adult Allergy, PC | Iowa | 19,222 | 9/11/10 | Loss | Other Portable Electronic Device |
| University of Oklahoma Tulsa Neurology Clinic | Oklahoma | 19,200 | 9/27/10 | Hacking/IT Incident | Desktop Computer |
| Lee D. Pollan, DMD, PC | New York | 19,178 | 1/11/13 | Theft | Laptop |
| UnitedHealth Group health plan | Minnesota | 19,100 | 5/18/12 | Unauthorized Access/Disclosure | Other |
| South Sunflower County Hospital | Mississippi | 19,000 | 2/4/15 | Improper Disposal | Paper/Films |
| Integranetics | Kentucky | 18,871 | 2/7/11 | Hacking/IT Incident | Network Server |
| North Los Angeles County Regional Center | California | 18,162 | 3/4/13 | Theft | Laptop |
| L.A. Care Health Plan | California | 18,000 | 11/17/12 | Other | Other |
| Terrell County Health Department | Georgia | 18,000 | 2/18/13 | Unauthorized Access/Disclosure | Network Server |
| Central City Concern | Oregon | 17,914 | 5/19/14 | Unauthorized Access/Disclosure | Other |
| American Health Inc. | Puerto Rico | 17,776 | 4/3/14 | Theft | Other |
| Walgreen Co. | Illinois | 17,350 | 12/6/13 | Other | Paper/Films |
| Raleigh Orthopaedic Clinic | North Carolina | 17,300 | 4/30/13 | Improper Disposal, Theft, Unauthorized Access/Disclosure | Paper/Films |
| Lower Umpqua Hospital | Oregon | 17,000 | 6/8/11 | Theft | Other, Other Portable Electronic Device |
| Our Lady of the Lake Regional Medical Center | Louisiana | 17,000 | 5/18/12 | Loss, Theft | Laptop |
| Roberts S. Smith MD Inc. | Georgia | 17,000 | 12/13/11 | Theft | Laptop |
| Kmart Pharmacy #7623 | Louisiana | 16,988 | 1/31/13 | Improper Disposal | Paper/Films |
| Montefiore Medical Center | New York | 16,820 | 7/23/10 | Theft | Desktop Computer |
| Kmart Corporation | Illinois | 16,446 | 2/10/14 | Theft | Electronic Medical Record, Other |
| UnitedHealth Group health plan | Minnesota | 16,291 | 6/4/10 | Other | Paper/Films |
| Travis Software Corp. | Texas | 16,200 | 1/18/11 | Loss | Other, Other Portable Electronic Device |
| HealthCare Partners | California | 15,677 | 6/16/11 | Theft | Desktop Computer |
| Kaiser Permanente Medical Care Program | California | 15,500 | 1/12/10 | Theft | Other, Other Portable Electronic Device |
| Health Services Advisory Group | Arizona | 15,380 | 10/10/14 | Unauthorized Access/Disclosure | Other |
| MDF Transcription Services | Massachusetts | 15,265 | 4/29/14 | Other | Other |
| Community Action partnership of Natrona County | Wyoming | 15,000 | 4/20/11 | Theft | Desktop Computer |
| Data Image | Ohio | 15,000 | 5/22/12 | Unauthorized Access/Disclosure | Other |
| Merkle Direct Marketing | Maryland | 15,000 | 1/11/10 | Theft | Paper/Films |
| ZDI | California | 14,829 | 4/29/13 | Loss | Paper/Films |
| Spectrum Health Systems | Massachusetts | 14,750 | 10/20/11 | Theft | Desktop Computer |
| University of Florida | Florida | 14,519 | 4/3/13 | Other, Theft, Unauthorized Access/Disclosure | Network Server |
| Soundental Associates, PC | Connecticut | 14,511 | 11/21/12 | Theft | Other Portable Electronic Device |
| Rady Children's Hospital - San Diego | California | 14,121 | 6/24/14 | Unauthorized Access/Disclosure | |
| UMass Memorial Medical Group | Massachusetts | 14,100 | 1/30/15 | Theft | Other |
| Women & Infants Hospital of Rhode Island | Rhode Island | 14,004 | 11/5/12 | Loss | Other |
| Accretive Health | Illinois | 14,000 | 2/6/12 | Theft | Laptop |
| Augusta Data Storage | Georgia | 14,000 | 6/21/10 | Loss | Other |
| Coordinated Health | Pennsylvania | 13,907 | 10/31/14 | Theft | Laptop |
| PRN Medical Services, dba Symbius Medical | Arizona | 13,877 | 7/29/14 | Other, Theft, Unauthorized Access/Disclosure | Email, Network Server |
| Aultman Hospital | Ohio | 13,867 | 8/5/10 | Theft | Laptop |
| Dennis Flynn, MD | Illinois | 13,646 | 8/19/14 | Theft | Laptop |
| Cahaba Government Benefit Administrators | Alabama | 13,412 | 5/25/11 | Unauthorized Access/Disclosure | Paper/Films |
| Triple-S Salud Inc. | Puerto Rico |
Topic:
