InfoSec Signals™
Sign InStart Free
CSV export is a subscriber feature

Updated 12 hours ago ()

Breach analytics · 2022 to 2026

What the HIPAA breach register says about running a security program

14 chapters, each answering one question a healthcare security or privacy leader would ask, and each ending with the program actions it points to and the CISSP, CISM and CISA domains it bears on. Subscribers recalculate every number for their own filters and drill every chart down to the reports behind it.

Reports in view
3,605
Individuals affected
757.7M
Program actions
48

What this means for you

86% of 2026 reports were hacking or IT incidents.

Up from 79% in 2022. Report volume is falling (−6% year over year). Weight the likelihood ratings in your risk analysis to the current breach mix. If the analysis was written when theft and loss dominated, its top risks are out of date.

Do this next

Executive summary

8 things to know

  1. Chapter 1 · Threat landscape now86%of 2026 reports were hacking or IT incidentsUp from 79% in 2022. Report volume is falling (−6% year over year).Read the chapter
  2. Chapter 2 · Attack surface66%of reports list network server as a locationEmail follows at 22%. Email and servers are the front doors.Read the chapter
  3. Chapter 3 · Third-party and business associate risk66%of individuals affected were in breaches involving a business associateThose breaches were 35% of reports: fewer, but larger.Read the chapter
  4. Chapter 4 · Scale and impact62%of individuals affected come from the largest 1% of breachesThe median breach affects 6,132 people; the mean is 210.2K.Read the chapter
  5. Chapter 6 · Enforcement and the investigation pipeline753reports are still under OCR investigation37% of them have been open for more than a year.Read the chapter
  6. Chapter 8 · Repeat reporters and recurrence193organizations reported more than one breachThat is 6% of reporting organizations in this view.Read the chapter
  7. Chapter 9 · Vulnerabilities and vendors513CVEs in mapped health IT products, 2022 to 2026Cross-site scripting is the most common weakness. Counts follow disclosure practice, not security.Read the chapter
  8. Chapter 9 · Vulnerabilities and vendors8 daysmedian from CVE publication to confirmed exploitation (CISA KEV)26% were added on or before publication day.Read the chapter

Organizations like yours

How is your peer group doing?

Pick the entity type and state that describe you for a first headline about your peer group. It appears as soon as both are chosen.

Subscriber feature · $5 a month or $50 a year

See how your peers compare across 10 measures

The full benchmark tests your peer group against every other report, measure by measure: breach types, where the data lived, business associate involvement and breach size, with significance tests, a size band filter and the reports behind each figure.
  • Hacking/IT incidents
  • Unauthorized access or disclosure
  • Theft or loss
  • Email
  • Network server
  • Electronic medical record
Start freeOr subscribe for $5 a month

Included with an ExamPrep subscription or as a DueCare site administrator. How linking works

$5 a month or $50 a year, or included with ExamPrep and DueCare

Unlock all 14 chapters

Chapter 1, Threat landscape now, is yours in full. Every other chapter opens with its narrative and first chart; a subscription opens the rest, with filters, drill-down to every report, program actions mapped to HIPAA and NIST CSF 2.0, and the exam angle.

  1. 1Threat landscape now FreeIs the breach problem growing, and what kind of breach is taking over? 4 program actions.
  2. 2Attack surface PreviewWhere does breached information sit, and which breach types go with which systems? 4 program actions.
  3. 3Third-party and business associate risk PreviewHow often is a business associate involved, and do those breaches run larger? 3 program actions.
  4. 4Scale and impact PreviewHow large is a typical breach, and what separates the mega-breach from the rest? 3 program actions.
  5. 5Peers and geography PreviewHow do organizations like mine compare, and where are breaches reported? 3 program actions.
  6. 6Enforcement and the investigation pipeline PreviewHow many reports are still under investigation, and how long does OCR take? 3 program actions.
  7. 7Regulatory and advisory signals PreviewWhat are regulators and advisory bodies publishing, and what should I act on? 2 program actions.
  8. 8Repeat reporters and recurrence PreviewHow often does the same organization report again, and how soon? 3 program actions.
  9. 9Vulnerabilities and vendors PreviewWhich health IT products carry published and exploited vulnerabilities, and what should a program do about it? 4 program actions.
  10. 10Exploitation is speeding up PreviewHow soon after disclosure are vulnerabilities exploited now, and how fast does a program have to patch? 4 program actions.
  11. 11Where attackers get in PreviewWhich kinds of technology are attackers exploiting to get in, and is the network edge taking over? 4 program actions.
  12. 12Ransomware's toolkit PreviewWhich exploited vulnerabilities do ransomware crews use, and how quickly? 4 program actions.
  13. 13Weaknesses that keep coming back PreviewWhich flaw types keep getting exploited year after year, and what should we ask vendors and configure ourselves? 4 program actions.
  14. 14Breaches and exploitation PreviewDo waves of exploitation show up in healthcare hacking reports, and what should a program take from the comparison? 3 program actions.
Start freeOr subscribe for $5 a month

Start with the free chapter

For program leaders

48 program actions across the chapters, each mapped to a HIPAA standard and to NIST CSF 2.0. How they spread across the six CSF functions:

  • Govern14
  • Identify17
  • Protect18
  • Detect6
  • Respond8
  • Recover3

An action can belong to more than one function. Open any chapter for its actions with the HIPAA citations.

For certification candidates

Which chapter to read for each exam domain. Each chapter ends with a study prompt.

Chapters by certification domain
ChapterCISSP1 2 3 4 5 6 7 8CISM1 2 3 4CISA1 2 3 4 5
1. Threats
2. Surface
3. Third party
4. Scale
5. Peers
6. Enforcement
7. Signals
8. Recurrence
9. Vendors
10. Speed
11. Entry points
12. Ransomware
13. Weaknesses
14. Breaches

Column numbers are domain numbers:CISSPCISMCISADomains follow the current ISC2 and ISACA outlines.

Lessons learned, in the same chapters

Resolved OCR cases, grouped by control domain, each with a program action and exam tags.

Open lessons
Your cookie choices
We use essential cookies to run this site, and, only with your consent, an advertising cookie from Google to measure whether our ads lead to sign-ups and subscriptions. See our for details.