Health IT Research & Analysis
Quick Stats

Breaches of Unsecured Protected Health Information

Last Updated

June 2021

Link to Page Icon Link to Page

Based upon data collected by the HHS Office for Civil Rights, as of February 1, 2016, protected health information breaches affected over 113 million individuals in 2015. In 2015, hacking incidents comprised nearly 99% of all individuals affected by breaches, and the number of reported hacking incidents, 57, comprised over 20% of all reported breaches. From 2011 to 2014, 97 hacking incidents affected less than 4 million individuals – less than 10% of all reported breaches and affected individuals during this time.

However, despite the rise in breaches related to hacking incidents, reported breaches related to other incidents and the number of individuals affected by these breaches are down in 2015. Through February 1, 2016, theft, loss, improper disposal, and unauthorized access or disclosure of protected health information comprise 208 of all reported breaches (N=265), down from 216 (N=285) in 2014 and 211 (N=262) in 2013. These four types of breach incidents affected 1.4 million individuals in 2015, compared to 10.7 million in 2014 and 6.7 million in 2013.

In 2015, four of the fifty-one hacking incidents involved an electronic medical record (EMR). One hacking incident affected 3.9 million individuals’ health information – nearly all the individuals affected by an EMR hacking incident in 2015.

Note: ^a non-hacking/IT incident includes all other types of reported health information breaches: theft, loss, improper disposal, unauthorized access/disclosure, other, or unknown (not reported or data missing). See notes below for types of IT and devices involved in these incidents.

Number of Individuals Affected by a Protected Health Information Breach: 2010-2015

Count of affected individuals by the type and source of information breach

 201020112012201320142015
Type of Information Breach
Hacking/IT incident568,358297,269900,684236,8971,786,630111,812,172
(Of this total, 78M individuals (70%) were affected by a singular hacking/IT incident, and 5 of the 51 hacking/IT incidents affected 97% of all individuals)
Improper disposal34,58763,94821,329526,53893,61282,421
Loss924,9096,019,57895,815142,411243,37647,214
Theft3,691,4604,720,129927,9095,397,9897,058,678740,598
Unauthorized access/disclosure130,106118,444338,767383,7593,019,284572,919
Other breach158,59313,981503,900254,305413,878—
Source of Information Breach
Desktop computer246,6432,042,18681,3854,348,1292,378,304316,226
Electronic medical record803,6001,720,064
(Of this total, 1.7M individuals (99%) were affected by a singular incident)		136,75140,196121,8453,948,985
(Of this total, 3.9M individuals (99%) were affected by a singular incident)
E-mail8,0503,111294,30858,847519,625583,977
Laptop1,507,914405,873575,5291,023,1811,273,612391,830
Network server665,123613,963921,335320,1277,253,441107,252,466
(All but 26,000 individuals were affected by a hacking/IT incident)
Paper/Film204,966103,711198,409575,076590,352229,743
Portable Electronic Device29,7141,516124,978154,877141,110209,558
Other source2,058,1668,259,368455,709422,381343,537322,539
Note: Each count above is the total number of individuals affected by a breach of the specific information source and the breach type. Individual reports of a breach may involve one or more information sources, i.e. laptop, e-mail, etc, and one or more breach types, i.e. theft, loss, etc. In those cases, there may be double-counting of the number of affected individuals or reported breaches in a specific year.
Source: U.S. Department of Health and Human Services (HHS) Office for Civil Rights. Breaches Affecting 500 or More Individuals. February 1, 2016.

Number of Reported Protected Health Information Breaches: 2010-2015

Count of reported breaches by the type and source of information breach

 201020112012201320142015
Type of Information Breach
Hacking/IT incident101616233257
(4 of these incidents involved an electronic medical record)
Improper disposal107713116
Loss181719242822
Theft12711811712411380
Unauthorized access/disclosure726256372100
Other breach2221824280
Source of Information Breach
Desktop computer283523392929
Electronic medical record366141416
E-mail5210203637
Laptop503851674238
Network server171620304641
(34 of these breaches involved a hacking/IT incident)
Paper/Film464547536267
Portable Electronic Device6219202215
Other source425026243422
Note: Each count above is the total number of reported breach incidents of the specific information source and the breach type. Individual reports of a breach may involve one or more information sources, i.e. laptop, e-mail, etc, and one or more breach types, i.e. theft, loss, etc. In those cases, there may be double-counting of the number of reported incidents or reported breaches in a specific year.
Source: U.S. Department of Health and Human Services (HHS) Office for Civil Rights. Breaches Affecting 500 or More Individuals. February 1, 2016.
  1. The HIPAA Breach Notification Rule, http://www.hhs.gov/ocr/privacy/hipaa/understanding/coveredentities/breachnotificationifr.html, requires health care providers, health plans, and other HIPAA covered entities to notify affected individuals when their health information is breached, as well as the HHS Secretary and the media where a breach affects more than 500 individuals. As required by section 13402(e)(4) of the HITECH Act, the Secretary of HHS must post a list of breaches of unsecured protected health information affecting 500 or more individuals.
  2. A breach may involve any of the following types of incidents: theft, loss, hacking/IT incident, improper disposal, unauthorized access/disclosure, other, or unknown (not reported or data missing).
  3. Breach incidents may involve any of the following information, information technology, or devices: paper/films, network server, laptop, desktop computer, e-mail, electronic medical record, other portable electronic device, or other.