Healthcare data breaches remain a challenge for healthcare organizations and their business associates, as exemplified by the nearly 30 million records implicated in large data breaches in the first six months of 2025.
The HHS Office for Civil Rights (OCR) four of the 10 biggest healthcare data breaches (by number of individuals impacted) reported to OCR in 2025 affected provider organizations, while the remaining six impacted business associates. Notably, nine of the 10 breaches involved hacking or IT incidents, while just one was caused by an unauthorized disclosure.
This list reflects breaches reported to OCR in 2025: such as Yale New Haven Health System: 5,556,702 individuals affected, Episource: 5,418,866 individuals affected, Blue Shield of California: 4,700,000 individuals affected etal.
【MORE】