Breach intelligence · DC
16 reported healthcare data breach incidents affecting 407K individuals. Sourced from 7 federal and community intelligence feeds. Updated nightly.
16
Incidents reported
407K
Individuals affected
Other
Top attack vector
Stable
6-month trend
Recent incidents
Reported to HHS OCR.
Reported to HHS OCR.
Reported to HHS OCR.
Most affected entities
#1
1
incidents
19K
individuals
#2
1
incidents
1K
individuals
#3
1
incidents
1K
individuals
#4
1
incidents
15K
individuals
#5
1
incidents
18K
individuals
Attack vectors
Breakdown of breach types reported across 16 incidents in District of Columbia. Understanding which vectors dominate helps practices prioritize their security controls.
District of Columbia compliance requirements
Beyond federal HIPAA requirements, District of Columbia has its own breach notification law that may impose additional obligations on healthcare practices operating in the state.
D.C. Code § 28-3852(a)
Notification deadline
In the most expedient time possible and without unreasonable delay, subject to the needs of law enforcement and any measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system.
Attorney General notification
Required
For HIPAA-regulated entities operating in DC, satisfying HIPAA breach-notification obligations to individuals is deemed to satisfy the § 28-3852 individual-notice requirement under subsection (g). But the separate DC Attorney General notification obligation under § 28-3852(b-1) is triggered independently once a breach affects 50 or more DC residents, and HIPAA compliance does not substitute for that AG notice. Practices notifying HHS under HIPAA still owe a separate written AG notice to DC.
This is a general reference based on current District of Columbia law. Consult legal counsel for state-specific compliance obligations. Source: D.C. Code § 28-3852(a). Per-jurisdiction verification status and primary-source references are shown on each specialty/state compliance page.
Protect your District of Columbia practice
Patient Protect gives independent practices real-time compliance monitoring, breach prevention, and secure workflows — so your practice stays out of this database. Starting at $39/month.
14-day free trial · No charge until trial ends
FAQ
Patient Protect tracks 16 reported healthcare data breach incidents in District of Columbia, affecting approximately 407K individuals. Data is sourced from HHS OCR, State Attorney General offices, FTC enforcement, and community intelligence — updated nightly.
The most frequently reported breach vector in District of Columbia is Other/Unknown, accounting for 6 of 16 incidents. Hacking/IT Incident is the second most common with 3 incidents.
Independent healthcare practices are the fastest-growing target for healthcare cyberattacks nationwide — attacks on small providers have increased 6x since 2021. District of Columbia practices face the same threat landscape with fewer resources to defend against it. Patient Protect provides breach prevention specifically for independent practices starting at $39/month.
District of Columbia requires breach notification within in the most expedient time possible and without unreasonable delay, subject to the needs of law enforcement and any measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system., and requires notification to the Attorney General. These requirements apply in addition to federal HIPAA's 60-day notification deadline. Reference: D.C. Code § 28-3852(a).
Explore the full breach intelligence dashboard with 12 analytical views, risk forecasting, and attack chain visualization.
Open full dashboardData Disclaimer: This data is aggregated from publicly available sources including the HHS OCR Breach Portal, FTC, state AG databases, CISA advisories, and curated reporting. Certain records are algorithmically modeled from news sources and labeled accordingly. Data is provided “as-is” for informational purposes only. Inclusion of any entity does not imply wrongdoing. Users must independently verify information before relying on it. See Terms of Use.
Where the source record supports an operational takeaway, the incident gets a Response. Most do not.
