HIPAA Breaches in 2025: What Went Wrong and What to Do Next

Every large health data breach in the U.S. ends up on the HHS Office for Civil Rights (OCR) breach portal. Looking at a full year of those reports, along with what OCR chose to penalize, gives a clearer picture than any single headline. Here is what 2025 showed, and what practices and the vendors that serve them can take from it.

Breach figures below come from HIPAA Journal's analysis of the OCR portal, published in February 2026. Portal entries can be revised as investigations finish, so treat the numbers as a snapshot.

The 2025 numbers

710 large breaches (500 or more records) were reported to OCR in 2025, down 4.3% from 742 in 2024. HIPAA Journal describes the annual count as plateauing in the 700 to 750 range, roughly two a day.
At least 61.5 million people had protected health information exposed or impermissibly disclosed, down 78.7% from about 289 million in 2024. The 2024 total was inflated by the Change Healthcare attack, which alone affected about 192.7 million people.
The typical breach was smaller. The average 2025 breach affected 86,699 people and the median was 4,011, down from an average of 389,707 and a median of 6,702 in 2024.

Fewer people affected is good news, but around 700 large incidents a year is not a declining problem.

Where the data leaked

By location of the breached information:

Location	Share of 2025 large breaches
Network servers	61.5%
Email accounts	24.9%
Paper and films	5.6%
Electronic medical records	4.6%

By the type of organization that suffered the breach, healthcare providers accounted for 57.5%, business associates (vendors handling data for covered entities) 35.8%, and health plans 6.5%.

Two other trends stand out. Hacking and IT incidents still dominated and caused the largest breaches. And unauthorized access or disclosure incidents rose 17.4% year over year, which covers things like misdirected records, staff snooping and data sent where it should not go.

The biggest incidents

The five largest breaches reported in 2025, per HIPAA Journal:

Aflac: about 13.9 million people in the U.S.
Yale New Haven Health System: about 5.6 million
Episource: about 5.4 million
Blue Shield of California: 4.7 million
DaVita: about 2.7 million

Blue Shield of California is worth a second look for anyone who runs a website. It was not a hack. The insurer said Google Analytics on some of its sites was configured in a way that shared member data with Google Ads from April 2021 to January 2024, and that the data likely included protected health information. The connection was cut in January 2024 but not discovered until February 2025.

What went wrong, in plain terms

The 2025 pattern points to a handful of recurring gaps:

Servers and remote access. Most breached records sat on network servers. That usually means internet-facing systems, remote access tools or unpatched software that attackers got into.
Email. A quarter of breaches involved compromised email accounts, typically through phishing or stolen passwords without multi-factor authentication.
Vendors. More than a third of breaches happened at business associates. Your patients' data is only as safe as the weakest vendor holding it.
Website tracking. Analytics and ad tools can leak health information without anyone breaking in, as Blue Shield shows.
Internal access. Rising unauthorized access and disclosure incidents point to access controls and staff habits, not only outside attackers.

What OCR penalized in 2025

In October 2024, OCR launched its Risk Analysis Initiative, an enforcement push focused on the Security Rule's requirement that regulated entities conduct an accurate and thorough risk analysis of risks to electronic protected health information.

HIPAA Journal's tally for 2025:

21 enforcement actions: 19 settlements and 2 civil monetary penalties
About $8.33 million collected in total
76% of actions included a penalty tied to risk analysis failures
Breach notification failures were the second most common issue, in more than one fifth of actions

HIPAA Journal also reports that OCR plans to widen its focus in 2026 to risk management, meaning evidence that risks identified in the analysis were actually reduced on time. The lesson is consistent: OCR's first question after a breach is usually whether a current risk analysis exists, and its second is what you did about what it found.

Current HIPAA penalty amounts

HIPAA civil penalties are adjusted for inflation. The most recent adjustment was published January 28, 2026, applying the 2025 multiplier. On October 21, 2026, HHS announced there would be no 2026 adjustment, so these 2025 figures remain in effect.

Culpability tier	Minimum per violation	Maximum per violation	Calendar year cap
Did not know	$145	$73,011	$2,190,294
Reasonable cause	$1,461	$73,011	$2,190,294
Willful neglect, corrected within 30 days	$14,602	$73,011	$2,190,294
Willful neglect, not corrected	$73,011	$2,190,294	$2,190,294

Separately, under a 2019 Notice of Enforcement Discretion, HHS said it would apply lower annual caps for the first three tiers: $25,000, $100,000 and $250,000, with $1.5 million for the top tier, each adjusted for inflation. That notice is a statement of enforcement policy, not a change to the regulation.

A rule change still pending

In January 2025, OCR proposed a major update to the HIPAA Security Rule. The proposal would, among other things, expressly require encryption of electronic health information with limited exceptions, require a technology asset inventory and a map of how that information moves through systems, and add multi-factor authentication and compliance audit standards. As of July 2026, HHS's regulatory agenda moved the final rule to July 2027 and into its long-term actions list. Until a final rule is published, the current Security Rule applies.

A practical checklist for 2026

These are steps businesses in healthcare commonly take after reading a year like 2025. They are a starting point to discuss with your IT provider and counsel, not a statement of what any particular practice is legally required to do.

Update the risk analysis. Date it, cover every system that holds patient data, and redo it when systems change.
Write the risk management plan. For each risk the analysis found, record who owns it, what will be done and by when.
Turn on multi-factor authentication for email, remote access, the EHR and any cloud tool holding patient data.
Patch and inventory. Keep a list of every device and system, and a routine for applying security updates.
List your vendors. For each vendor that touches patient data, confirm a Business Associate Agreement is in place where required and ask how they would notify you of a breach.
Audit website tracking. Check which analytics and ad tags run on booking pages, forms and portals.
Review who can see what. Limit access by role, and look at access logs on a schedule.
Practice the breach response. Know who decides, who calls counsel, and how the 60-day notification clock works before you need it.
Train staff on phishing with real examples, more than once a year.

Where NutriCove fits

NutriCove builds AI automation for medical offices: receptionist, missed-call text back, follow-up and booking systems. Because those tools can hold patient information, our medical page notes that GoHighLevel needs its HIPAA add-on and a signed Business Associate Agreement before any protected health information goes in, which is the kind of vendor check the list above describes. We do not provide legal, security or HIPAA compliance services. If you are reviewing which tools in your office touch patient data, see how we set up automation for medical offices.

Sources

This article is general information, not legal or medical advice. Talk to a qualified attorney or licensed professional about your situation.