What to do About Healthcare Breaches (2025)

Protect your practice with seven steps: turn on multi-factor authentication, train staff, patch systems, sign a business associate agreement with every vendor, finish your risk analysis, get cyber insurance, and plan for ransomware. That agreement is a contract that makes a vendor protect patient data. In 2025, about two large breaches were reported to HHS every day.

Here’s a number that sounds terrible: at least 710 healthcare data breaches were reported to HHS in 2025. Each one affected 500 or more people. Together they exposed the records of more than 61 million people.

Here’s a number that sounds almost encouraging by comparison: that’s actually a 78.7% drop in the number of people affected from 2024. That year, about 289 million people were affected.

Both numbers are real. Both come from the HHS Office for Civil Rights breach portal. And together, they tell a story that every small practice needs to understand, because the threat isn’t getting smaller. It’s getting closer to you.

Strip the Change Healthcare Outlier and the Picture Changes

The 2024 numbers were dominated by one event: the Change Healthcare breach, which exposed data on 192.7 million Americans. That single incident (one company, one set of stolen credentials, zero multi-factor authentication) made up about two-thirds of all the people affected that year.

Behavioral health is not spared either. In March 2026, attackers broke into an email account at Acadia Healthcare, one of the largest behavioral health providers in the country. The stolen files held treatment and insurance details. For some patients, they also held a Medicare number that may include a Social Security number.

Strip Change Healthcare from the 2024 totals and the year-over-year comparison looks very different. The remaining breaches in 2024 affected roughly 96 million people. In 2025, it was about 61.6 million. That is still a drop. One reason: there were fewer mega breaches, meaning breaches that affected more than 1 million people. There were 18 in 2024 and only 9 in 2025.

Every one of those breaches triggers breach notification requirements under HIPAA, and many organizations learn about their obligations only after a breach forces the issue.

What did not change much is the number of organizations getting hit. The 710 breaches reported in 2025 were only about 4% fewer than 2024’s 742. Also, the federal government shut down for 43 days in late 2025.

During that time, no new breach reports were added to OCR’s online breach list. So some 2025 breaches may show up late. The real story: hundreds of separate healthcare organizations reported breaches to OCR in a single year. That’s almost 14 new breaches per week, every week, for the entire year.

And the organizations hit by those attacks aren’t all hospital systems with 10,000 beds. Many of them are practices like yours.

Healthcare Breach Trends: The Shift Toward Smaller Targets

The 2025 data points to a clear trend: attackers are going wider and smaller. They hit more targets, and smaller ones.

Of the 710 large breaches reported in 2025, 455 (about 64%) affected fewer than 10,000 people. Together they made up only a small share of the total exposed records. In other words, lots of organizations are getting hit, and each one loses a fairly small number of records.

Meanwhile, ransom demands dropped 91%. They fell from $4 million in 2024 to $343,000 in 2025, according to Sophos’s survey of healthcare providers hit by ransomware. That’s not because attackers got more charitable. It’s because they shifted strategy. Instead of spending months infiltrating a major health system and demanding a multi-million dollar payout, they’re hitting dozens of smaller targets with lower demands that are easier to collect.

The math works for them. Ten practices paying $50,000 each is more reliable income than one hospital that might refuse to pay $4 million.

For a small practice, this is the number that matters: ransomware attacks on healthcare businesses rose 25% in 2025. These are companies that serve providers, like billing and health tech companies. Attacks on providers stayed about flat. Over 80% of stolen protected health information (patient data) came from outside hospitals: third-party vendors, software services, business associates (outside companies that handle patient data for you), non-hospital providers, and health plans.

You don’t have to be a big target to be a target. You just have to be a connected one.

The 5 Attack Patterns Hitting Small Practices in 2025

Based on the 2025 breach data from the HIPAA Journal’s annual report, industry surveys, and OCR’s breach portal, here’s what’s actually happening at the practice level.

1. Phishing and Email Attacks Remain a Top Way In

Hacking and IT incidents made up most large healthcare data breaches in 2025. Email was involved in almost 1 in 4 breaches (24.9%). These aren’t sophisticated zero-day exploits. They’re fake login pages, spoofed vendor emails, and credential-stuffing attacks that work because someone reused a password or clicked a link without checking the sender.

2. Exploited Vulnerabilities Overtook Credential Theft

For the first time in three years, healthcare providers in the Sophos survey named exploited vulnerabilities (known security holes that attackers use) as the most common technical root cause, showing up in 33% of incidents. That means unpatched software, outdated systems, and internet-facing applications with known security holes. If your practice management software or remote access tools haven’t been updated recently, they may already be on an attacker’s list.

3. The Staffing and Capacity Problem Is Real

The most common factor contributing to successful ransomware attacks was lack of people and capacity, cited in 42% of incidents. Right behind it: known security gaps that simply hadn’t been handled, at 41%. Most small practices don’t have dedicated security teams. That’s not a moral failing. It’s a resource reality. But attackers know it, and they exploit it.

4. Business Associates Are a Growing Attack Surface

Healthcare ransomware attacks shifted focus to vendors and service partners in 2025. Comparitech counted 191 ransomware attacks on healthcare businesses for the year (40 of them confirmed). The confirmed attacks alone exposed over 6.4 million records. The average ransom demand was $584,700. Your billing company, your IT vendor, your EHR provider: if they get compromised, your patients’ data goes with them.

5. The Largest 2025 Breaches Show Nobody Is Immune

The biggest breaches of 2025 included Aflac (13.9 million records), Yale New Haven Health System (5.6 million), Episource (5.4 million from a cyberattack), Blue Shield of California (4.7 million from a Google Analytics misconfiguration), and DaVita (2.7 million from a ransomware attack). Even well-resourced organizations with dedicated security teams got hit.

What a Healthcare Data Breach Actually Costs in 2025

IBM’s 2025 Cost of a Data Breach report found that healthcare breaches cost an average of $7.42 million. That’s down from $9.77 million in 2024, but healthcare has held the top spot as the most expensive industry for breaches for 14 consecutive years.

A small practice obviously isn’t absorbing a $7.42 million loss: that average includes large health systems with complex computer systems. But the cost categories are useful no matter your size. Across all industries, IBM broke the average cost down like this:

• Detection and escalation: $1.47 million average
• Lost business costs: $1.38 million average
• Post-breach response: $1.2 million average
• How long a healthcare breach lasts: 279 days from the first break-in to containment, five weeks longer than the global average

For a small practice, the dollar amounts are smaller, but the same costs still add up fast:

• Forensic investigation to find out what happened
• Legal counsel
• Notifying patients
• An OCR investigation and possible fines
• Lost patients and damage to your reputation

In a Netwrix survey, the share of healthcare organizations that lost more than $200,000 to cyberattacks nearly quadrupled. It went from 5% in 2024 to 19% in 2025. And 12% of healthcare organizations experienced cyberattack-related losses exceeding $500,000, up from just 2% the year before.

The financial impact is spreading down-market along with the attacks themselves.

OCR Enforcement Is Targeting Small Practices

If you think OCR only goes after hospital systems, the 2025 enforcement data says otherwise.

In 2025, OCR closed 21 cases with a settlement or a civil money penalty (a fine OCR orders). That is the second-highest number for any year on record. Many of those came through OCR’s risk analysis enforcement effort, which specifically targets organizations that failed to do or write down a proper HIPAA risk analysis, which the Security Rule requires (45 CFR § 164.308(a)(1)(ii)(A)).

In 2025 alone, OCR collected $8.3 million from these cases. Cooperating with OCR helps, but only if you have something to show. If OCR comes knocking and you have no risk analysis, no written policies, and no training records, the conversation starts in a very different place.

The current HIPAA penalty tiers were last adjusted for inflation in 2025. They start at $145 per violation when you did not know about the violation. They go up to $2,190,294 per year for violations of the same rule caused by willful neglect. Willful neglect means a conscious or reckless failure to follow the rules. Those aren’t theoretical numbers. They’re set in federal regulation (45 CFR 102.3).

Risk analysis failures remain the most commonly cited finding in OCR enforcement actions. (HHS OCR Resolution Agreements) In 2025, 76% of OCR enforcement actions included a penalty for a risk analysis failure, according to HIPAA Journal’s 2025 breach report. That’s the single most important record in your compliance program, and the one that’s most often missing.

Cyber Insurance for Healthcare Is No Longer Optional

The cost of cyber insurance depends on your practice’s size, your security controls, and how much coverage you buy. Get quotes to see what yours would cost.

That sounds like an expense until you compare it to what you’d pay without it.

The Change Healthcare outage in 2024 showed why. A cyber policy can cover business interruption losses (income lost while you can’t operate), legal fees, breach response costs, and forensic investigation (finding out what happened). Practices without it pay those costs themselves, or can’t pay them at all.

Many cyber insurance policies now require basic security controls before they will cover you: multi-factor authentication, endpoint detection (software that spots attacks on your computers), backup procedures, and staff training. Those requirements aren’t arbitrary. They’re the same controls that block the most common attacks described above.

Getting insured forces you to get your house in order. And if something still goes wrong, the policy absorbs the financial shock that would otherwise threaten your practice’s survival.

7 Things Small Practices Should Do Right Now

The 2025 data is clear about who’s getting hit and why. Here’s what actually reduces your risk.

1. Enable Multi-Factor Authentication on Everything

Email, EHR, remote access, cloud storage. MFA stops the majority of credential-based attacks. The Change Healthcare breach (192.7 million records) happened because MFA wasn’t enabled on a remote access portal. One setting.

2. Train Your Staff This Quarter

Not next year. This quarter. Email-based attacks rely on human error. A 30-minute training session on recognizing phishing emails, verifying sender addresses, and reporting suspicious messages costs nothing and addresses one of the most common ways attackers get in.

3. Patch and Update Your Systems

In the Sophos survey, exploited vulnerabilities (known security holes) were the top technical root cause of ransomware attacks on healthcare providers. If your practice management software, operating systems, or network equipment have updates waiting, those are open security holes.

4. Audit Your Business Associates

Make a list of every vendor that touches patient data. Confirm you have a signed BAA with each one. Ask them about their security practices. If they can’t answer basic questions about MFA, encryption, and incident response, that’s a red flag.

5. Complete Your Risk Analysis

If you don’t have a written, up-to-date risk analysis, you have the compliance gap OCR penalizes most often. HHS offers a free Security Risk Assessment Tool, updated to version 3.6 in September 2025. Use it. Or get help, but do it.

6. Get Cyber Insurance

If you don’t have it, get quotes this month. If you do have it, review your policy. Make sure it covers ransomware, business interruption, regulatory fines and penalties, and breach notification costs. The coverage requirements will also tell you exactly which security controls you need in place.

7. Build a Ransomware Response Plan

Know exactly what you’ll do in the first 72 hours after an attack. Who calls whom. How you isolate systems. When you notify OCR. Having a plan before you need one is the difference between a bad week and a practice-ending event.

The Bottom Line on Healthcare Breach Statistics

The 2025 breach data tells a specific story: attackers are targeting more organizations with less effort for smaller payouts, and small and mid-sized practices with limited IT resources are right in their path.

The era of “we’re too small to hack” ended years ago. The 2025 numbers just made it impossible to ignore.

2025 by the numbers: At least 710 large healthcare breaches (500 or more people each) were reported to OCR in 2025, about 2 per day. That is slightly fewer than the 742 reported in 2024. The Change Healthcare breach was reported in 2024. It affected 192.7 million people. It is the largest healthcare data breach ever reported.

Sources

• HHS OCR Breach Portal
• HHS OCR Enforcement Data
• 45 CFR Part 164, Subpart D: Breach Notification Rule
• HHS OCR Enforcement Actions

Breach News and Analysis

• Acadia Healthcare Data Breach
• Healthcare Data Breach Trends Analyzed
• Okanogan Breach Settlement
• UMMC Ransomware Attack Lessons

Related Reading

• HIPAA Breach Notification Rule Compliance Guide
• How to Respond to a HIPAA Data Breach
• Healthcare Data Breach Prevention Strategy
• The Change Healthcare Breach One Year Later: What the largest healthcare breach in history means for your practice
• Ransomware Hit Your Practice: The First 72 Hours: Step-by-step response when an attack happens
• Your Vendor Got Hacked: Now What?: How to respond when a business associate is breached
• $6.6 Million in HIPAA Fines in 2025: The enforcement actions that hit hardest
• The HIPAA Compliance Starter Kit for Small Practices: What small practices actually need to get compliant

Getting your practice protected doesn’t require an enterprise budget. It requires knowing what to do first and doing it methodically. One Guy Consulting builds affordable HIPAA compliance programs for independent practices and small clinics. Explore HIPAA compliance services HIPAA compliance help