Data Breach Notification
,
Data Security
,
HIPAA/HITECH
345 Major HIPAA Breaches Reported to Feds So Far This Year, Affecting 29.9 Million
Midway through 2025, the federal website listing major health data breaches in the U.S. shows a familiar scene: Many hacking incidents including ransomware, dozens of third-party vendor incidents, and millions of individuals affected by compromised personal data.
As of Monday, a snapshot of the U.S. Department of Health and Human Services’ HIPAA Breach Reporting Tool website shows 345 health data breaches reported so far in 2025 affecting 500 or more individuals. Those 345 breaches affected nearly 29.9 million people. That’s fewer than the 408 breaches reported by June 30, 2024, and at that time, those breaches affected nearly 52.7 million people – nearly twice as many for the same period in 2025.
Hacking/IT incidents lead the way by far as the most commonly reported type of health data breach midway in 2025. The HHS OCR website show 258 such hacks, compromising the data of 28.8 million people, or nearly 97% of the people affected so far in 2025. In fact, nine out of the 10 largest health data breaches posted to the HHS OCR website so far this year involved a hacking incident.
The largest of the breaches so far posted to the HHS Office for Civil Rights’ website so far this year was reported in April by Connecticut-based Yale New Haven Health System as a hacking incident affecting 5.5 million patients (see: Yale New Haven Health Notifying 5.5 Million of March Hack).
Breaches reported as “unauthorized access/disclosures” incidents were the second most commonly reported breach, with 74 such incidents affecting more than 950,000 people.
By far, the largest of those unauthorized access/disclosure incidents was reported by Serviceaid – a breach affecting 483,000 people. The vendor of agentic artificial intelligence-based IT management and workflow software, reported in May to HHS OCR that an inadvertent exposure of data on the web has led to the incident affecting patients of its client Catholic Health, a network of six hospitals and dozens of other facilities in western New York (see: Agentic AI Tech Firm Says Health Data Leak Affects 483,000).
10 Largest Health Data Breaches, Mid-Year 2025
| Breached Entity | Individuals Affected |
|---|---|
| Yale New Haven Health System | 5.55 Million |
| Episource | 5.4 Million |
| Blue Shield of California | 4.7 Million |
| Southeast Series of Lockton Cos. | 1.1 Million |
| Community Health Center | 1 Million |
| Frederick Health | 934,300 |
| Medusind | 701,500 |
| Kelly & Associates | 553,300 |
| United Seating and Mobility (Numotion) | 494,300 |
| Serviceaide | 483,100 |
Of the 345 breaches reported to HHS OCR in 2025 so far, 127 incidents affecting more than 15.8 million individuals were reported as involving third-party business associates.
That means that while business associates were reported at the center of 37% of major health data breaches so far in 2025, those incidents were responsible for more than half of the people affected.
Episource, a vendor of medical coding and risk adjustment services, last month reported the largest of those incidents – a ransomware hack affecting 5.4 million people.
Several of Episource’s healthcare sector clients that were affected by the hack have also issued their own breach notices about the incident, including healthcare delivery system Sharp HealthCare in California and health insurer Horizon Blue Cross Blue Shield of New Jersey.
“Covered entities should be holding their business associates to the same requirements as their own organizations, and their controls should be reviewed annually,” said Mike Hamilton, field CISO of security firm Lumifi Cyber. “This should be embodied in contract language with clear ramifications for the failure to implement controls, and to limit liability for the covered entity,” he said.
More to Come
It’s also worth noting that as of Monday, healthcare organizations reported at least 34 of the major 2025 health data breaches as affecting only 500 or 501 people. Those figures are usually used as a placeholder number while the reporting entity completes its full analysis of its incident and the scope of protected health information compromised.
Once those breach reports get updated with more accurate numbers, the total of affected individuals will also potentially rise significantly.
In many cases, a report of 500 and 501 people affected by a HIPAA breach ends up being replaced later with an absolutely eye-popping figure.
That was certainly the case when Change Healthcare first reported its massive ransomware incident to HHS OCR in July 2024 as a breach affecting 500 individuals.
That number grew to a record-breaking 190 million victims by the time the UnitedHealth Group’ IT services unit updated its breach report to HHS OCR several months later (see: Change Healthcare Now Counts 190 Million Data Breach Victims).
Since the HHS OCR website began in September 2009, healthcare organizations reported 6,982 major health data breaches, affecting nearly 884.6 million people, as of Monday.