Open data · CC BY 4.0
Healthcare Breach Dataset.
A citable, versioned dataset of source recordsfrom HHS Office for Civil Rights breach filings and enforcement actions — the public evidence as published, not Patient Protect’s reconciled canonical events. Every row states its record class, because most rows are regulatory actions rather than breach reports. CSV and JSON. License and attribution metadata travel inside the download body.
CC BY 4.0 · HHS OCR sourced · Updated within 24 hours of new-record ingestion
Sample rows
What the data looks like.
A three-row excerpt. The live download contains every HHS OCR filing at the 500-individual threshold plus every OCR resolution agreement and civil money penalty.
| entity_name | record_class | source_type | state | individuals_affected | breach_submission_date | enforcement_action_date |
|---|---|---|---|---|---|---|
| Change Healthcare | breach_filing | hhs_breach | TN | 190,000,000 | 2024-02-21 | — |
| Kaiser Foundation Health Plan | breach_filing | hhs_breach | CA | 13,400,000 | 2024-04-12 | — |
| Providence Medical Institute | regulatory_action | ocr_enforcement | CA | 84,946 | — | 2024-09-26 |
Field dictionary
Every field, defined.
Every field emitted in the CC BY 4.0 file. Attack-vector classification and internal metadata are proprietary and are not emitted here.
- record_id
- string
- Stable per-row identifier.
- record_class
- enum
- breach_filing or regulatory_action. Most rows in this file are regulatory actions, not breach reports — filter on this before counting breaches.
- source_type
- enum
- hhs_breach (Breach Portal filing) or ocr_enforcement (resolution agreement / CMP).
- source_event_group_id
- string
- Upstream grouping key for rows describing one filing event. NOT a Patient Protect canonical event identifier, and grouping by it does not reproduce the canonical model.
- entity_name
- string
- Reporting entity as filed.
- state
- 2-letter code
- U.S. state where the reporting entity is located.
- individuals_affected
- integer
- As stated by the source. Not deduplicated at person level.
- breach_submission_date
- ISO date | null
- Date the breach was submitted to HHS OCR. Populated on breach_filing rows only.
- enforcement_action_date
- ISO date | null
- Date of the enforcement action. Populated on regulatory_action rows only.
- summary
- string | null
- Editorial one-line summary. Present on most regulatory actions and few breach filings.
- event_id
- string — deprecated
- Retires 2027-02-01. Identical to source_event_group_id; the name wrongly implied canonical event identity. Use source_event_group_id.
- severity_score
- integer — deprecated
- Retires 2027-02-01. A legacy modeled field on a nine-value ladder. Patient Protect's canonical breach metrics do not use it, and it is easily misread as breach seriousness or compliance risk.
License
Creative Commons Attribution 4.0.
The dataset is published under CC BY 4.0. You may reproduce, redistribute, remix, and build upon the data — commercially or otherwise — provided you attribute Patient Protect. License and attribution metadata is written inside the download body so the grant travels with the file when redistributed.
The severity_score integer emitted per row is CC BY 4.0. The methodology that produces it is proprietary.
Scope of the grant. Patient Protect licenses under CC BY 4.0 only the copyright and database rights it owns in the dataset’s selection, arrangement, schema, documentation and original enrichment. Underlying government records and third-party source materials retain their original legal status and terms. No endorsement by any source agency is implied.
Citation
Suggested format.
Academic / permanent (DOI): for peer-reviewed work or any citation that needs a stable identifier, use the Zenodo deposit.
Current / live dataset: for reporting or reference to the continuously updated corpus, cite the live URL.
The Zenodo DOI is a v1.0.0 snapshot supporting the SSRN research paper. The live dataset above is the ongoing production feed updated continuously from the HHS OCR Breach Portal.
Questions
Frequently asked.
- Can I cite this dataset in academic research or journalism?
- Yes. The dataset is published under Creative Commons Attribution 4.0 International (CC BY 4.0). You may reproduce, redistribute, remix, and build upon it — including for commercial use — provided you credit Patient Protect. A suggested citation format is provided on this page and inside the download body.
- Where does the data come from?
- The citable file is scoped to HHS OCR authoritative sources only: the HHS OCR Breach Portal (filings at the 500-individual threshold) and OCR resolution agreements plus civil money penalties. Non-HHS channels visible on the /breachdash dashboard UI (state AG filings, FTC settlements, CISA advisories, Patient Protect Network, AI-modeled projections) are intentionally excluded from this file — their inclusion would introduce semantic collisions in individuals_affected that a downstream researcher summing the column could not correct for.
- How often is the dataset updated?
- The dataset is served on a 24-hour incremental static regeneration cache. New HHS OCR filings and resolution agreements are ingested continuously; the downloadable file reflects state within 24 hours of new-record ingestion. Historical rows are stable — corrections are versioned in the changelog rather than silently rewritten.
- What does severity_score mean and how is it computed?
- severity_score is deprecated and retires on 1 February 2027. It is a legacy modeled field taking one of nine values between 30 and 95, and Patient Protect's canonical breach metrics do not use it. It is easily read as a measure of breach seriousness or compliance risk, which it is not, and the model behind it is not documented publicly — so it cannot be validated by anyone relying on it. Rather than document it into legitimacy we are removing it. Rank on individuals_affected instead.
- Why is there a preamble of #-prefixed rows in the CSV?
- The first five rows of the CSV are comment lines carrying license, source, attribution, and retrieval-timestamp metadata. This ensures the license grant travels with the file itself if it is redistributed. Most spreadsheet tools tolerate #-prefixed leading rows; you can also filter them explicitly during ingestion.
- Can I reproduce the Breach Dashboard figures from this file?
- No, and it is worth being direct about why. The dashboard and the state pages report canonical breach events produced by Patient Protect's internal Canonical Data Model, which reconciles multiple public records describing one underlying event across a wider source corpus than this file contains. This file is source records: the public evidence underneath, as published. Grouping by source_event_group_id is a different operation on a different set of rows and does not approximate the model — on the current file it yields roughly 1,200 groups where the model resolves over 2,100 events. Use this file to work with the underlying public evidence, and cite the dashboard for canonical figures.
- How do I count breaches and affected individuals correctly?
- Two filters, in this order. First, keep only rows where record_class is breach_filing — most rows in this file are OCR enforcement actions, and counting every row as a breach overstates breach volume by roughly 2.4x. Second, take one individuals_affected value per source_event_group_id, because a single filing event can produce several rows carrying the same count. Skipping the first filter is the common error: summing every row yields roughly 2.2 billion affected, and deduplicating without filtering by class still yields roughly 890 million, against roughly 345 million on the correct basis.
- Is attack-vector classification available in the download?
- No. Attack-vector classification is a proprietary render-time computation used on /breachdash and is intentionally excluded from the CC BY 4.0 file. If your research requires vector labels, contact us directly to discuss a research-use license.
- Can I use the data commercially?
- Yes. CC BY 4.0 permits commercial use, including in for-profit research, journalism, and derivative products. The only requirement is attribution: credit Patient Protect and link to patient-protect.com/breachdash or this landing page.
Part of the HIPAA Foundation · Free tools & resources
See the full collectionTrack the threat landscape
Use the dataset freely for research and journalism. The platform is where a healthcare organization keeps its own compliance record — vendors and their agreements, policies and their adoption, and the incidents its people log.
Next in the sequence
Breach DashboardThe Breach Dashboard, HIPAA Response, Signal, and the open dataset provide different views of the same healthcare compliance and security landscape.
Cite the dataset. Then close your own gaps.
The dataset is a research artifact. The platform is your program.
Use the dataset freely for research, journalism, and analysis. The Patient Protect platform is where a healthcare organization keeps its own compliance record — the vendors and agreements it enters, the policies it adopts, the workforce access it grants, and the incidents its people log. From $39/month.
Free tools stay free — no account needed. The 14-day platform trial asks for a card for identity verification; no charge before day 14, cancel any time.
Corrections & Updates
Healthcare security data changes as investigations progress, vendors update systems, and laws and guidance evolve. If you see something outdated, incomplete, or incorrect — or have newer source material — we’d appreciate hearing from you.