Breach notification
The HHS OCR breach portal explained
Short answer
- Listed breaches
- 500 or more individuals 1
- Large breach deadline
- No later than 60 calendar days after discovery 1
- Small breach deadline
- 60 days after end of calendar year 1
- 2024 large breach reports
- 663 3
- 2024 small breach reports
- 74,299 3
What the portal is
The portal is run by the Office for Civil Rights at the US Department of Health and Human Services 2. OCR says it investigates all breaches of protected health information and Part 2 records that affect 500 or more individuals 2. The portal has separate lists for HIPAA breaches and for 42 CFR Part 2 breaches 2.
The duty to report comes from the HIPAA Breach Notification Rule at 45 CFR 164.400 to 414 4. It applies to covered entities and their business associates 4.
How and when breaches are reported
- 500 or more people: without unreasonable delay and no later than 60 calendar days after discovery 1.
- Fewer than 500 people: within 60 days after the end of the calendar year of discovery, with a separate notice for each breach 1.
- Uncertain numbers: the entity should give an estimate 1.
- Updates: an addendum can be filed using the transaction number of the first report 1.
- Business associates may submit on behalf of the entity 1.
Reading a portal entry with care
The number on a listing is what the entity reported, and it can change. Change Healthcare first reported 500 as the approximate number of people affected on 19 July 2024 5. HHS later recorded about 190 million people affected as of 24 January 2025 and about 192.7 million as of 31 July 2025, as reported by the company 5.
One report can cover many organisations. HHS said only one entity, the covered entity or its business associate, needs to complete notifications for that breach 5.
A listing is not a penalty. In 2024 OCR completed 785 breach investigations through technical assistance, corrective action, resolution agreements or a finding of no violation 3. Twelve were resolved with resolution agreements, corrective action plans, settlements or civil money penalties totalling US$7,813,831 3.
What the 2024 figures show
| Measure for calendar year 2024 | Figure |
|---|---|
| Reports of breaches affecting 500 or more 3 | 663, down 9% on 2023 3 |
| People affected by those breaches 3 | About 242,908,056 3 |
| Hacking or IT incidents 3 | 534 reports, 81% 3 |
| Network server as location 3 | 418 reports, 63% 3 |
| Reports by health care providers 3 | 505, 76% 3 |
| Reports by business associates 3 | 106, 16% 3 |
| Reports of breaches affecting fewer than 500 3 | 74,299, about 340,618 people 3 |
Annual reports to Congress
HHS publishes a yearly report to Congress on the breach notification program 6. The page lists reports from 2009 to 2010 through calendar year 2024, the latest listed 6.
Common questions
Does being on the HHS breach list mean a company broke HIPAA?
No. The list records reported breaches. OCR closes many investigations through technical assistance or a finding of no violation 3.
Why are breaches under 500 people not on the portal list?
The public lists cover breaches affecting 500 or more individuals 1. Smaller breaches are reported yearly 1.
Can the number of people affected change after listing?
Yes. Entities can file addenda 1. Change Healthcare's figure went from 500 to about 192.7 million 5.
How long do covered entities have to tell patients?
No later than 60 days after discovery of the breach 4.
Rules and charges change. Check the official source linked on this page before you pay or travel. Spotted an error? Email hello@breachandfinetracker.com.
Sources
- HHS: Submitting Notice of a Breach to the Secretary
- HHS Office for Civil Rights: Breach Portal
- HHS Office for Civil Rights: Annual Report to Congress on Breaches of Unsecured Protected Health Information For Calendar Year 2024
- HHS: Breach Notification Rule
- HHS: Change Healthcare Cybersecurity Incident Frequently Asked Questions (updated as of 14 March 2025)
- HHS: Reports to Congress on Breach Notification Program
Related
- US state breach notification laws explained
How US state data breach laws work, with deadlines, regulator notice and penalties from the statutes of California, Washington, Florida and New York.
- Data breach statistics by sector
Official breach notification counts by sector and cause from regulators in Australia, Canada, Ireland, France, Spain and Luxembourg, with periods.
- Breach notification rules compared
Breach notice deadlines and triggers in the EU, UK, US, Canada, Australia, Singapore, India and Brazil, from laws and regulator pages.
- FTC data security enforcement explained
How the US Federal Trade Commission brings data security cases, what consent orders require, when it can seek money, and its breach reporting rules.
- How the HIPAA Breach Notification Rule works
What a breach is under HIPAA, the four-factor risk assessment, and the 60-day deadlines to notify individuals, the HHS Secretary and the media.