Healthcare Data Breach Statistics (2026): Records Exposed, Costs & Enforcement Trends

In 2024, healthcare set a grim record: about 289 million records exposed in a single year, with one attack, Change Healthcare, accounting for roughly 192.7 million of them. Healthcare has been the most expensive industry for data breaches for 14 straight years. The pattern behind the numbers is consistent, and it points to a single lesson about where sensitive records should live.

What's in This Guide

1 The Scale of Healthcare Breaches

Healthcare is now the most breached vertical in U.S. history, and the cumulative figures are staggering when stated in one place rather than one incident at a time.

The frequency has plateaued while the severity has climbed. Large breaches, those affecting 500 or more individuals, now run at roughly 700 to 770 per year, about two per day and double the 2018 rate. The 2024 record was not a one-off: it reflects a shift from many small incidents to fewer, catastrophic mega-breaches concentrated at the points where data pools most heavily. Even in 2025, when total exposures fell sharply (largely because there was no second Change Healthcare), 16 separate breaches each still topped one million records.

Source: HIPAA Journal healthcare data breach statistics | HIPAA Journal 2025 breach report

2 The Cost of a Breach

Healthcare has topped every industry for breach costs for 14 consecutive years, and understanding the range matters more than fixating on a single figure.

The cost estimates differ across reports, roughly USD 7.42 million (IBM 2025) to USD 9.77 million (2024 cross-report) to a USD 10.22 million U.S. figure, because they cover different years and different scopes (U.S. versus global). What every report agrees on is the ranking: healthcare is the costliest, every year, by a wide margin. A key driver of the U.S. premium is regulatory: IBM explicitly identifies higher regulatory fines as a primary reason U.S. breach costs surged, meaning OCR penalties and class-action exposure are now a major component of the total, not an afterthought.

Source: Cobalt on healthcare breach costs | DeepStrike on the U.S. breach-cost surge

3 What Causes Breaches

The cause profile of healthcare breaches has shifted dramatically over the past decade, and the direction is unambiguous.

A decade ago, lost laptops, improper disposal, and insider errors drove a large share of breaches. Today it is overwhelmingly deliberate cyberattack. Ransomware was present in a large share of confirmed breaches, phishing is a leading access vector, and financial gain motivates about 90% of healthcare security breaches. The through-line is that healthcare data is deliberately hunted because it is uniquely valuable, and the attack surface that matters most is where large volumes of that data sit accessible.

Source: HIPAA Journal analysis on breach causes | The Relay Co. healthcare compliance statistics

4 The Vendor & Concentration Problem

The single most important structural insight in the breach data is that the biggest exposures happen where data concentrates, at vendors, clearinghouses, and business associates that hold data for many organizations at once.

The Change Healthcare attack is the defining example: a single clearinghouse that processes roughly 40% of U.S. medical and dental claims was compromised, and roughly 192.7 million people were affected, with claims processing disrupted nationwide for weeks. A vendor breach is a force multiplier. When data pools in one place, one intrusion reaches everyone connected to it. This is why supply-chain and business-associate security is repeatedly named as healthcare's biggest cybersecurity challenge.

Source: Sprinto on business-associate breach exposure | Bright Defense on vendor breach trends

5 Enforcement Trends

Alongside the breaches runs a tightening enforcement environment. The high-level trend is what matters here; the year-by-year fine detail and violation-type breakdowns are covered in dedicated companion reports on HIPAA violations and HIPAA fines.

Two enforcement themes define the current environment. First, OCR's Risk Analysis Initiative has made a single failure, not conducting a thorough security risk assessment, the most commonly cited violation, appearing in the large majority of Security Rule actions. Second, proposed 2025 changes to the HIPAA Security Rule would remove the distinction between "required" and "addressable" controls, effectively making encryption and multi-factor authentication mandatory rather than optional. The regulatory direction is toward fewer loopholes and stricter baseline controls, and small practices are explicitly in scope, one analysis found 55% of OCR financial penalties in 2022 were imposed on small medical practices.

Source: HIPAA Journal on 2025 OCR enforcement | DeepStrike on proposed HIPAA Security Rule changes

6 What It Means for Practices

The healthcare-wide data lands on a practical, local conclusion for any office that holds patient data, including dental and oral surgery practices running sedation.

The record breaches happened where data concentrates and where detection was slow. The costliest failures took the better part of a year to find. Enforcement increasingly punishes the practices that never did a proper risk analysis or left controls optional. Every one of these points to the same defensive priority: get sensitive records into secure, monitored, HIPAA-compliant systems, and out of the exposed places, email, unmonitored local servers, loose files, where small-practice breaches actually begin.

Treated as a secure, monitored Sedation Intelligence System, the sedation record moves out of the exposed category and into the protected one, which, read against 935 million breached records, is exactly where it belongs.

Source: HIPAA Journal on breach concentration | HIPAA Compliant Hosting on infrastructure as defense

7 Summary Table: Every Statistic at a Glance

Frequently Asked Questions