Healthcare Compliance & HIPAA Statistics (2026)
Patient data has never been more exposed, and the cost of getting compliance wrong has never been higher. The numbers here come from federal regulators, the courts, and the leading breach researchers. They keep pointing back to the same root cause: documentation and risk analysis that never got done. Every figure is sourced and current.
Every number here comes from a named source: a government agency, a research body, or a peer-reviewed study, 16 in all. Use any of them, just credit the original source.
The scale of healthcare data breaches
In 2024 alone, 663 large healthcare data breaches exposed the protected health information of nearly 243 million individuals, roughly three quarters of the U.S. population in a single year. Since HHS OCR began tracking these incidents in 2009, cumulative exposure has surpassed one billion records, more than 2.9 times the current U.S. population. A single February 2024 ransomware attack on Change Healthcare accounted for 192.7 million of those victims, the largest healthcare data breach ever recorded, and cost UnitedHealth Group an estimated $3.09 billion for the year. The pace has not slowed. More than 700 large breaches are now reported annually, averaging roughly two every day.
242.9 million exposed in 2024
In 2024, 663 large healthcare data breaches (each affecting 500 or more individuals) were reported to HHS OCR, exposing the protected health information of 242,908,056 individuals.
Source:HHS Office for Civil Rights (OCR), 20251.01 billion records since 2009
Since HHS OCR began tracking large healthcare data breaches in October 2009, the protected health information of 1,013,066,481 individuals has been exposed, more than 2.9 times the current U.S. population.
Source:HIPAA Journal (citing HHS OCR breach portal data), 2026192.7 million in one attack
The February 2024 ransomware attack on Change Healthcare, a UnitedHealth Group subsidiary, affected an estimated 192.7 million individuals, making it the largest healthcare data breach ever recorded.
Source:The HIPAA Guide (citing HHS OCR breach portal reporting), 2025$3.09 billion in fallout
The 2024 ransomware attack on Change Healthcare cost UnitedHealth Group an estimated $3.09 billion in total cyberattack impacts for the full year.
Source:UnitedHealth Group, 2024Two breaches a day
More than 700 large healthcare data breaches affecting 500 or more individuals are now reported to HHS OCR each year, roughly two large breaches every day.
Source:HIPAA Journal (citing HHS OCR breach portal data), 2026What is causing the breaches
Hacking and IT incidents drove 81% of large healthcare breaches in 2024 and touched 99.45% of all individuals affected that year, making technical intrusion far and away the dominant vector. Ransomware is the sharpest edge of that trend, up 278% between 2018 and 2023, and by 2025 system intrusion had become the single most common breach pattern, with espionage as a motive rising from 1% of healthcare incidents to 16%. Business associates, the third-party vendors and partners who handle protected health information, were the breach location in 30% of 2024 incidents, and healthcare accounted for 41.2% of all third-party breaches tracked globally that year. Insider threats compounded the picture, with 70% of threat actors in 2024 internal, and errors, privilege misuse, and intrusions together responsible for 83% of breaches.
81% from hacking
Hacking and IT incidents caused 81% of all large healthcare data breaches reported to HHS OCR in 2024 and accounted for 241,582,022 of the individuals affected, or 99.45% of all victims that year.
Source:HHS Office for Civil Rights (OCR), 202516 million via unauthorized access
Unauthorized access and disclosure incidents were the second leading cause of large HIPAA breaches in 2024, accounting for 15.7% of reported breaches (114 incidents) and exposing 16,099,437 records, nearly double the prior year.
Source:HIPAA Journal (citing HHS OCR data), 202530% at business associates
Business associates were the location of 30% of large healthcare data breaches in 2024, while healthcare providers accounted for 62% and health plans 7%.
Source:HIPAA Journal (citing HHS OCR data), 202541.2% of third-party breaches
Healthcare was the industry most impacted by third-party breaches in 2024, accounting for 41.2% of all third-party breaches tracked globally.
Source:Black Kite (BRITE research team), 2025Ransomware up 278%
Between 2018 and September 2023, OCR documented a 278% increase in large healthcare breaches involving ransomware and a 239% increase in hacking-related breaches overall.
Source:HHS Office for Civil Rights (OCR), 2024System intrusion now #1
By 2025, system intrusion overtook miscellaneous errors as the top healthcare breach pattern, with ransomware up 37% year over year and espionage as a motive surging from 1% of healthcare incidents to 16%.
Source:Verizon, 202570% insider-driven
In 2024, 70% of the threat actors behind healthcare data breaches were internal, with miscellaneous errors, privilege misuse, and system intrusions together causing 83% of breaches.
Source:Verizon, 2024The cost of getting it wrong
Healthcare has carried the highest data breach cost of any industry for 14 consecutive years, reaching $9.77 million per incident in 2024 before settling at $7.42 million in 2025, still more than double the global cross-industry average. Containment is slow. In 2025 healthcare organizations took an average of 279 days to identify and contain a breach, roughly five weeks longer than the global average and the worst record of any sector. The operational fallout is just as severe, with 72% of attacked organizations reporting disruption to patient care in 2025. Among those hit by ransomware, one in three paid the demand, with the average payment reaching $1.2 million.
$9.77M per breach (2024)
For the 14th consecutive year, healthcare had the costliest data breaches of any industry, reaching $9.77 million per incident in 2024, more than double the $4.88 million cross-industry average.
Source:IBM / Ponemon Institute, 2024$7.42M per breach (2025)
Healthcare data breaches cost an average of $7.42 million per incident in 2025, still the highest of any industry and a rank healthcare has held for 14 consecutive years.
Source:IBM / Ponemon Institute, 2025279 days to contain
Healthcare data breaches took an average of 279 days to identify and contain in 2025, roughly five weeks longer than the 241-day global average, making healthcare the slowest industry to detect and remediate breaches.
Source:IBM / Ponemon Institute, 202572% disrupt patient care
In 2025, 72% of healthcare organizations that experienced cyberattacks suffered disruption to patient care, up from 69% the prior year.
Source:Ponemon Institute / Proofpoint, 2025$1.2M average ransom
Among healthcare ransomware victims in 2025, 33% paid the demand, with the average payment rising to $1.2 million from $1.1 million in 2024.
Source:Ponemon Institute / Proofpoint, 2025How HHS OCR enforces HIPAA
HHS OCR set a new enforcement record in 2024, imposing 22 financial penalties totaling nearly $10 million, while also receiving 30,256 new HIPAA complaints and opening investigations into all 663 large breaches reported that year. The single largest settlement, $4.75 million against Montefiore Medical Center, stemmed from a malicious insider who stole and sold the records of more than 12,500 patients. Since April 2003, OCR has received 374,322 complaints, resolved 99% of them, and referred 2,419 cases to the Department of Justice. When an investigation ends in a settlement or penalty, the process takes an average of 57 months from initial complaint to public announcement.
22 penalties in 2024
In 2024, HHS OCR imposed 22 financial penalties on covered entities and business associates, the most enforcement actions in a single year, collecting $9,944,612 in total penalties.
Source:HHS Office for Civil Rights (OCR), 202530,256 complaints
In 2024, HHS OCR received 30,256 new HIPAA compliance complaints, opened investigations into all 663 large breaches, and resolved 785 breach investigations.
Source:HHS Office for Civil Rights (OCR), 2025$4.75M insider settlement
OCR's largest 2024 single-case settlement was $4.75 million against Montefiore Medical Center for Security Rule failures that let a malicious insider steal and sell the ePHI of 12,517 patients.
Source:HHS Office for Civil Rights (OCR), 2024374,322 complaints since 2003
Since April 2003, OCR has received 374,322 HIPAA complaints, resolved 99% of them, and made 2,419 criminal referrals to the Department of Justice.
Source:HHS Office for Civil Rights (OCR), 202457 months to resolve
OCR investigations that end in a settlement or penalty take an average of 57 months from the initial complaint or breach notice to the public announcement, with a range of 14 to 88 months.
Source:Shook, Hardy & Bacon, 2025Risk analysis is the recurring failure
OCR's Risk Analysis Initiative found the same failure at the center of every enforcement action it produced in its first six months. Organizations had not conducted an accurate and thorough security risk assessment, and ransomware found the gaps that assessment would have surfaced. That pattern holds across the broader 2024 enforcement record, where risk analysis failures appeared in 13 of 20 enforcement matters, more often than any other cited violation. The consistency of the finding across organizations of different sizes and types suggests this is not an isolated oversight but a structural gap in how many covered entities approach security planning.
7 enforcement actions
OCR's Risk Analysis Initiative produced 7 enforcement actions in its first six months, each tied to a ransomware attack and every one citing failure to conduct an accurate and thorough security risk assessment.
Source:Feldesman LLP (reporting on HHS OCR), 202513 of 20 cases
Risk analysis failures were the most common HIPAA violation cited in OCR enforcement actions in 2024, appearing in 13 of the 20 enforcement matters analyzed, ahead of information system activity reviews and access requests.
Source:Shook, Hardy & Bacon, 2025Documentation and billing compliance
Poor documentation is not a technical problem so much as a financial one. The Medicare Fee-for-Service program recorded $31.7 billion in improper payments in FY 2024, with insufficient documentation among the leading drivers, and 82% of Medicaid improper payments in FY 2023 were tied to missing or inadequate records. The problem is equally acute in Medicare Advantage, where OIG found that roughly 70% of high-risk diagnosis codes were unsupported by medical records as of late 2023, and a focused 2024 audit of Humana found the rate was 84.2% among sampled enrollee-years, representing at least $13.1 million in estimated overpayments. Diagnoses captured only on health risk assessments, with no corroborating clinical documentation, drove an estimated $7.5 billion in risk-adjusted payments for 2023. Penn State Health's $11.7 million settlement over unsupported Annual Wellness Visit billings illustrates the legal exposure that follows.
$31.7B improper payments
The Medicare Fee-for-Service improper payment rate was 7.66% in FY 2024, totaling $31.70 billion, with insufficient documentation a leading driver.
Source:Centers for Medicare & Medicaid Services (CMS), 202482% from bad documentation
Most Medicaid improper payments in FY 2023, 82% of them, were associated with payments for services with missing or insufficient documentation.
Source:U.S. Government Accountability Office (GAO), 202470% codes unsupported
As of November 2023, OIG found that roughly 70% of high-risk Medicare Advantage diagnosis codes were not supported in the associated medical records, with some unsupported more than 90% of the time.
Source:HHS Office of Inspector General (OIG), 202384.2% unsupported at Humana
In a 2024 OIG compliance audit of Humana Medicare Advantage, 202 of 240 sampled enrollee-years (84.2%) had diagnosis codes unsupported by medical records, leading OIG to estimate at least $13.1 million in overpayments.
Source:HHS Office of Inspector General (OIG), 2024$7.5B from HRAs alone
Diagnoses reported only on health risk assessments, with no supporting documentation in any other service record, drove an estimated $7.5 billion in Medicare Advantage risk-adjusted payments for 2023 across 1.7 million enrollees.
Source:HHS Office of Inspector General (OIG), 2024$11.7M voluntary disclosure
Penn State Health paid $11,712,336 to resolve allegations that it billed Medicare for Annual Wellness Visit services that were not supported by the medical record.
Source:U.S. Department of Justice / HHS OIG, 2024Claim denials and the appeals burden
Sixty percent of medical group leaders reported rising denial rates in a 2024 MGMA poll, with insufficient documentation cited as a leading cause, and Medicare Advantage denials climbed 55.7% between 2022 and 2023. More than half of denied claims, 54.3%, were ultimately overturned on appeal, which means most initial denials were wrong, yet hospitals still spent an estimated $19.7 billion working through those appeals in 2022 alone. Initial denial rates of 15.7% for Medicare Advantage and 13.9% for commercial claims point to how much administrative energy is consumed before a clean payment arrives. Healthcare also accounted for over $1.67 billion of the $2.9 billion in False Claims Act recoveries in FY 2024, with billing, coding, and documentation fraud central to those cases.
60% see more denials
In a March 2024 MGMA poll, 60% of medical group leaders reported an increase in claim denial rates versus the prior year, with insufficient documentation cited as a leading cause.
Source:Medical Group Management Association (MGMA), 2024MA denials up 55.7%
Care denials rose an average of 55.7% for Medicare Advantage claims and 20.2% for commercial claims between 2022 and 2023.
Source:American Hospital Association (AHA), 202454.3% overturned
In 2024, 15.7% of Medicare Advantage and 13.9% of commercial claims were initially denied, and more than half (54.3%) were ultimately overturned, but only after costly rounds of appeals that cost hospitals an estimated $19.7 billion in 2022.
Source:American Hospital Association / Premier Inc., 2024$1.67B in FCA recoveries
Healthcare accounted for over $1.67 billion of the $2.9 billion in False Claims Act recoveries in FY 2024, much of it driven by billing, coding, and documentation fraud, alongside a record 979 qui tam lawsuits filed.
Source:U.S. Department of Justice (DOJ), 2025Curious where this is costing your clinic?
Relay builds AI employees that keep documentation, credentialing, and HIPAA compliance clean across every location, with your staff in the loop. Give us 30 minutes and we will show you where the money is leaking.