HIPAA Breaches in 2025: HHS Portal Data Analysis
Agency’s analysis of the HHS breach portal snapshot identifies 807 reports submitted during the latest complete calendar year that meet the portal’s large-breach threshold. This is a count of reports, not unique people or incidents across the entire health sector. Submission dates, entity classifications, and later corrections limit how the findings should be interpreted.
Key Takeaways
- •The combined exports contain 807 qualifying reports after the documented deduplication.
- •Hacking/IT Incident is the largest reported breach category in this snapshot.
- •Entity-type counts and breach-type counts describe the same reports.
- •Counts do not identify unique people or independent attack campaigns.
For implementation support, review HIPAA compliance support and business associate agreement definition. Confirm scope and operating responsibilities before choosing an engagement.
What population does this analysis measure?
It measures reports submitted in 2025 in the active and archive exports from the HHS breach portal, retrieved on the snapshot date. Both exports are needed because resolved investigations move to the archive. The results are Agency’s calculations from government data, not a separate HHS publication.
Which breach types appear in the export?
Hacking/IT Incident is the largest category in this snapshot. Counts by reported type appear in the chart, accessible table, and downloadable CSV below. Entity type is a separate dimension and should not be added to breach-type counts.
These are report classifications, rather than forensic judgments by Agency. A submission can change as the reporting entity or OCR updates the record.
What does the entity breakdown mean for health-tech vendors?
Business-associate reports are one category, alongside providers, health plans, and clearinghouses. A supplier incident can also affect multiple customer reports, so the number of portal records is not the number of independent attack campaigns.
The Security Rule summary explains the safeguard framework. Use the data to prompt questions about information flows, supplier responsibilities, access, and incident coordination. It does not rank vendors or establish the return on buying a product.
How can readers reproduce and reuse the result?
Download the aggregate CSV and review the methodology below. It explains the period filter, threshold, deduplication, and exclusions. The repository records hashes of the original exports and includes the aggregation script.
For operational planning, review HIPAA services and HIPAA for startups. A government dataset supplies context; the actual controls and responsibilities must follow your information and obligations.
Dataset findings
| Category | Count |
|---|---|
| Type: Hacking/IT Incident | 652 |
| Type: Unauthorized Access/Disclosure | 143 |
| Type: Theft | 9 |
| Type: Loss | 2 |
| Type: Improper Disposal | 1 |
| Entity: Healthcare Provider | 608 |
| Entity: Business Associate | 138 |
| Entity: Health Plan | 59 |
| Entity: Healthcare Clearing House | 2 |
Methodology
- Data source
- HHS OCR Breach Portal; active and archived HIPAA reports downloaded November 1, 2026.
- Sample size
- n = 807
- Period
- 2025-01-01/2025-12-31
- Inclusion criteria
- Reports with Breach Submission Date in the stated calendar year and at least 500 individuals affected, from both portal views.
- Exclusion criteria
- Other submission years, reports below the threshold, Part 2 reports, and 2 exact duplicate row signatures are excluded.
- Calculation
- Count each retained report once. Deduplicate on entity name, state, entity type, individuals affected, submission date, breach type, and information location. Group separately by breach type and entity type; no percentages or unique-person estimates are calculated.
- Limitations
- Submission year differs from incident year. Overlapping reports can describe related events and people. Exact row deduplication may combine indistinguishable submissions. The portal can be corrected after retrieval. This snapshot is not a prevalence census.
Frequently Asked Questions
Is this an official HHS annual total?
Does adding affected individuals count unique people?
Why include both active and archive exports?
Tyler Carbone
Managing Director and Cofounder
Tyler Carbone is a Managing Director and Cofounder of Agency and one of the industry's leading voices on governance, risk, and compliance. He holds degrees from Harvard and a JD/MBA from the University of Virginia, and previously worked in cybersecurity at Deloitte. Tyler has helped hundreds of companies operate SOC 2, ISO 27001, HIPAA, and GDPR programs.
LinkedIn
