Healthcare Data Breaches: Why and How They Happen

Healthcare data breaches happen because patient records are valuable, systems are complex and many people and vendors need access. Most incidents fall into a few patterns: hacking and ransomware, unauthorized access by insiders or partners, theft or loss of devices and records, and improper disposal. Each pattern has known controls that lower the risk.

Key takeaways

• Health records combine identity, insurance and medical details, which makes them attractive to criminals.
• Breaches come from outside attackers, insiders, vendors and simple mistakes.
• HIPAA sets firm notification deadlines once a breach is discovered.
• Access control, patching, backups and vendor oversight address most common causes.

Why are healthcare organizations targeted?

A medical record can include a name, date of birth, address, Social Security number, insurance details and diagnosis history. That combination supports identity theft, insurance fraud and extortion. Medical identity theft can also corrupt a patient's record with someone else's treatment, a risk explained in our guide to preventing medical identity theft.

Operations add pressure. Hospitals cannot easily take systems offline, which attackers know when they deploy ransomware. Clinical environments also run older devices and specialized software that are hard to patch, and staff often share workstations in fast-moving settings.

How do healthcare data breaches happen?

The HHS Office for Civil Rights publishes reports of breaches affecting 500 or more individuals, sorted by type such as hacking or IT incident, unauthorized access or disclosure, theft, loss and improper disposal. Those categories map to practical causes:

Breach type	How it typically happens	Key controls
Hacking or IT incident	Phishing, stolen passwords, unpatched systems, ransomware	Multi-factor authentication, patching, email filtering, offline backups
Unauthorized access or disclosure	Staff viewing records without need, misdirected mail or email	Role-based access, access monitoring, training
Theft	Stolen laptops, phones or paper files	Device encryption, physical security
Loss	Misplaced devices, drives or documents	Encryption, asset tracking
Improper disposal	Records or drives discarded without destruction	Certified destruction, disposal procedures

Many breaches also involve business associates, such as billing companies, IT providers or cloud hosts, so your exposure extends to the vendors that hold your data.

What does HIPAA require after a breach?

The HIPAA Breach Notification Rule sets the following deadlines, according to HHS:

• Individuals: notice without unreasonable delay and no later than 60 days after discovery.
• HHS: for breaches affecting 500 or more individuals, notice within the same 60-day window; smaller breaches may be reported annually, within 60 days after the end of the calendar year.
• Media: required when a breach affects more than 500 residents of a state or jurisdiction.
• Business associates: must notify the covered entity without unreasonable delay and no later than 60 days after discovery.

State breach laws may add requirements, so involve counsel early.

What a breach costs beyond penalties

Regulatory penalties get the headlines, but the operational impact is often larger. A ransomware attack can force clinicians back to paper, delay procedures and divert ambulances. Notification, credit monitoring, forensic investigation and legal work add direct costs. Patients may lose trust and move their care elsewhere, and staff spend weeks on recovery instead of their normal work. Vendor contracts and cyber insurance terms decide how much of that cost you carry yourself, which is why they belong in the same conversation as technical controls. Leaders should also expect follow-up questions from regulators, auditors and the board about what changed after the incident.

A prevention checklist

• Require multi-factor authentication for email, remote access and the EHR.
• Patch internet-facing systems quickly and scan for vulnerabilities regularly.
• Keep encrypted, offline backups and test restoring them, as CISA recommends for ransomware readiness.
• Encrypt laptops, phones and removable media.
• Limit record access by role and review access logs for unusual activity.
• Run phishing training with realistic examples for clinical and administrative staff.
• Inventory vendors that hold PHI and confirm business associate agreements.
• Write and rehearse an incident response plan that includes notification steps.

Cloud systems need their own controls, covered in our article on achieving data security in the cloud. For the broader compliance program, see the path to becoming HIPAA and OSHA compliant.

Frequently Asked Questions

What is the most common cause of healthcare data breaches?

Hacking and IT incidents, including ransomware and compromised email accounts, have become a leading category in the breach reports HHS publishes. Many of these start with phishing or stolen credentials. Insider access, lost or stolen devices and vendor incidents still cause a meaningful share, so a prevention program should cover people and partners as well as technology.

Is every security incident a reportable breach?

Not necessarily. Under HIPAA, an impermissible use or disclosure of unsecured PHI is presumed to be a breach unless a documented risk assessment shows a low probability that the information was compromised. Properly encrypted data that is lost may not count. Document the assessment for every incident, whatever the conclusion.

Who should we contact during a ransomware attack?

Activate your incident response plan, engage counsel and your cyber insurer, and isolate affected systems. CISA advises reporting ransomware to federal law enforcement through the FBI's IC3 or a Secret Service field office, and contacting CISA for technical assistance. Preserve logs and evidence before rebuilding systems.

Next steps

Compare your controls against the table above, starting with multi-factor authentication, backups and device encryption. Confirm your incident response plan names who decides on notification and how the 60-day clock is tracked, then schedule a tabletop exercise with clinical, IT, legal and communications leaders.

Last reviewed: October 2026.

Sources

• Breach Notification Rule, US Department of Health and Human Services
• Breach Portal, HHS Office for Civil Rights
• StopRansomware, Cybersecurity and Infrastructure Security Agency