Health Data Breaches Reported to HHS (Monthly)

## What this measures

The number of breaches of protected health information affecting 500 or more people that U.S. health plans, providers and their business associates reported to the HHS Office for Civil Rights, by the month they were submitted. Every such breach must be reported, so this is a full count rather than a sample.

## Why it matters

It is the longest mandatory, case-by-case count of data breaches in any U.S. industry, running since late 2009.

## How to read it

Read the 12-month totals (cyber.hhs.breaches_12m, cyber.hhs.hacking_breaches_12m). A month is published only once it ended at least 60 days ago: cases reach the portal weeks after they are filed, so newer months would read low.

## What it does not say

It covers health care only, and breaches of 500+ people. It counts breaches, not attackers, and the submission date can be weeks after the breach.

## Source

U.S. Department of Health and Human Services, Office for Civil Rights, Breach Portal (ocrportal.hhs.gov/ocr/breach), HIPAA breach reports, Under Investigation and Archive tabs combined, by breach submission date. Palanor reads both CSV exports every day. U.S. government work, public domain.