The HIPAA Pulse breach tracker pulls from five public-record data streams that together form a near-complete picture of healthcare cybersecurity incidents. Each row in the tracker originates in a regulator filing, an enforcement action, or a government advisory — never an unverified claim.

Sources

HHS OCR Breach Portal Primary

The U.S. Department of Health and Human Services, Office for Civil Rights maintains the official Breach Notification Portal. Under HIPAA, covered entities must report breaches affecting 500 or more individuals. This is the most authoritative federal source for healthcare breach data.

State Attorney General notifications Primary

State AGs receive breach notifications under state-level data breach laws. Many states require notification for breaches smaller than the federal 500-person threshold, making AG data a critical supplement that often surfaces weeks before the federal portal updates.

OCR enforcement actions Regulatory

Resolution Agreements (negotiated settlements), Civil Money Penalties, and Corrective Action Plans imposed on covered entities for HIPAA violations. Enforcement data identifies which breaches led to regulatory consequences and the financial penalties that followed.

FTC Health Breach Notification Rule Regulatory

The Federal Trade Commission enforces the HBNR for entities that handle health data outside HIPAA’s jurisdiction — consumer health apps, wearable device makers, and non-HIPAA-covered services. FTC data captures healthcare-adjacent breaches the OCR portal does not.

CISA medical-device advisories Cyber

The Cybersecurity and Infrastructure Security Agency publishes advisories for vulnerabilities in medical devices and healthcare IT systems. Advisories include CVE identifiers, CVSS scores, affected products, and patch availability. They are leading indicators — flagged here as advisories, not breaches, until confirmed exploitation appears in HHS or AG filings.

What we exclude from the public tracker

The platform behind this tracker also ingests two streams we do not publish here: modeled breach projections (statistically inferred from leading indicators) and internal Patient Protect Network reports (community-reported incidents from the Patient Protect platform). These belong in compliance tooling, not in a public publication. The HIPAA Pulse tracker is restricted to incidents with public-record provenance: a regulator filing, an enforcement record, or a government advisory.

Severity, scoring, and reporting lag

Each incident carries a severity score (0–100) computed from individuals affected (35%), attack vector risk (25%), entity criticality (15%), enforcement history (10%), and source confidence (15%). Source confidence is highest for HHS OCR (95%) and FTC (90%); lower for unconfirmed sources. The dashed boundary between “moderate” and “high” severity in the table reflects the platform’s standard 60-point cutoff used in the Patient Protect breach dashboard.

Reporting lag — the gap between breach discovery and regulator notification — varies widely. HIPAA requires notification within 60 days, but many filings arrive later. The tracker shows the regulator-reported date, not the discovery date; lag analysis lives in the full breach dashboard.

Source links

HHS OCR Breach Portal → · FTC Health Breach Notification Rule → · CISA healthcare advisories → · Patient Protect breach dashboard →