Since the US Department of Health and Human Services (HHS) Office for Civil Rights (OCR) began publishing healthcare data breach summaries in 2009, the numbers have moved in one direction. The annual record for large breaches affecting 500 or more individuals was set in 2025, when 772 such incidents were reported, according to Healthcare Data Breach Statistics - Updated for 2026, published by the HIPAA Journal, drawing on OCR portal data through August 2026. In total, more than one billion records have been compromised over that 16-year span, approximately 2.9 times the current US population.
The scale of that figure reflects a structural shift in how breaches happen, and who bears the compliance consequences when they do.
The dominant cause is no longer a lost laptop or a misfiled fax. Hacking and other IT incidents accounted for more than 80% of large healthcare breaches reported in 2025, based on the HIPAA Journal’s analysis of OCR portal data. OCR separately confirmed hacking accounted for 49% of all reported breaches in 2019. Between 2018 and 2023 alone, ransomware attacks against healthcare entities increased 278%, OCR reported.
More significant for employer-sponsored plans is where within the healthcare ecosystem those attacks are landing. Business associates - the third-party vendors that process claims, manage pharmacy benefits, administer health savings accounts, and run revenue cycle operations for covered entities - have grown steadily as a share of large breach reports. In the first half of 2026, business associates were involved in 43% of all large healthcare breaches reported to federal regulators, up from an average of 20% between 2009 and 2017, according to the HIPAA Journal’s analysis of OCR data.
The scale of business associate incidents helps explain why individual breach counts and total records exposed have moved at different rates. Between 2022 and 2023, large breach reports increased roughly 4%, but affected individuals rose more than 193%, per OCR data, a jump driven largely by a cluster of mega-breaches affecting tens of millions of records each. A single business associate handles data for dozens or hundreds of covered entities simultaneously, so one successful attack can cascade across an entire network of plans and providers.
The largest breach in US healthcare history illustrates the point. The 2024 ransomware attack on Change Healthcare, a clearinghouse subsidiary of UnitedHealth Group, exposed the records of an estimated 192.7 million individuals. That figure dwarfed the previous record of 78.8 million set by the Anthem breach in 2015. Change Healthcare processed billing and insurance claims for hospitals, pharmacies, and medical practices across the country, which is precisely why a single intrusion reached that scale.
The pattern has a direct consequence for employer-sponsored plans that is not always well understood. Under HIPAA, a self-funded employer plan is a covered entity, which means the plan sponsor carries breach notification obligations regardless of where in the vendor chain the incident originated. When a third-party administrator or benefits platform is compromised, the notification obligation does not automatically transfer to the vendor. It rests with the plan.
OCR enforced that principle this year against a company most people would not associate with healthcare compliance. The employer-sponsored group health plan of Spencer Gifts LLC agreed to a $450,000 settlement in June 2026 to resolve HIPAA violations identified during OCR’s investigation of a ransomware attack on its employer-sponsored group health plan. OCR found the plan had failed to conduct a compliant risk analysis and had not implemented HIPAA policies and procedures before the breach.
The attack occurred in November 2021. The plan reported it to OCR in January 2022. Spencer Gifts is a novelty retailer, not a healthcare company, but its self-insured plan held protected health information, and OCR pursued enforcement accordingly.
As of June 2026, the settlement was OCR’s 20th ransomware enforcement action and the 14th under its Risk Analysis Initiative, a targeted effort that focuses investigations on whether covered entities have conducted the foundational security assessments HIPAA requires.
The 2026 breach figures carry an important caveat. From January through April 2026, large healthcare data breach reports were running approximately 9.5% below the same period in 2025, according to OCR portal data. That apparent decline, however, reflects a backlog created by the 43-day HHS government shutdown in late 2025, during which breach additions to the OCR portal effectively stopped. As of mid-2026, breaches from early in the year were still being added to the portal months after the fact.
The HIPAA Journal flagged this lag in its October 2026 update, noting that the current year-over-year comparison is not a reliable indicator of whether the underlying breach environment has improved. That context is relevant to any plan sponsor or advisor reviewing 2026 breach statistics and drawing conclusions about risk trajectory.
The cumulative data creates a clear picture of where exposure concentrates. The Unlimited Technology Systems breach, in which a revenue cycle software firm exposed the benefits and insurance data of nearly 3.8 million people, illustrated the mechanism precisely. The breach did not happen at a hospital or a health plan, but liability flowed outward to every covered entity in the vendor’s client list. Stolen fields included insurance policy numbers, claims and benefits data, Social Security numbers, and medical record numbers.
