HIPAA Breach Intelligence Dashboard

📈Breach Type Trends 2020–2025

So what: Hacking/IT incidents now account for 81% of all breaches — up from just 4% in 2010. Ransomware is the dominant vector. Unauthorized access remains a persistent secondary threat driven by insider behavior and phishing.

🏢Breaches by Entity Type (2025)

So what: Healthcare Providers are hit hardest (523 breaches), but Business Associates cause disproportionate damage — a single BA breach can expose patients across hundreds of covered entities, as seen with Change Healthcare (190M records) and Conduent (62M records).

⚠️2025 Major Breach Risk Scorecard — Real HHS/OCR Data

Organization	Type	Breach Vector	Records Affected	Risk Score	Severity
Conduent Business Services	Business Associate	Unauthorized Access	62,000,000	98/100	Critical
Aflac	Health Plan	Hacking/IT	13,700,000	91/100	Critical
Yale New Haven Health	Healthcare Provider	Hacking/IT	5,600,000	84/100	High
Episource	Business Associate	Ransomware	6,700,000	86/100	High
Numotion (Phishing)	Healthcare Provider	Phishing → Email	529,004	67/100	Medium
Radiology Assoc. of Richmond	Healthcare Provider	Ransomware	1,419,091	82/100	High

Risk Score methodology: Weighted composite of records affected (40%), breach type severity (30%), entity type exposure (20%), and detection/response time (10%). Scores above 80 indicate systemic control failures requiring immediate remediation.

🎯Attack Vector Breakdown (2025)

So what: Network servers (61.5%) and email (24.9%) are the top two locations of breached PHI. Together they account for 86.4% of all breach locations — making server hardening and email security the highest-ROI controls for any healthcare organization.

📊Organizational Risk Factor Scoring

Ransomware Exposure

Phishing Vulnerability

BA/Vendor Risk

Insider Access Risk

Email Security Gap

Detection Speed

Patch Management

So what: Ransomware (92) and Business Associate risk (85) are the two highest-priority gaps. Both require immediate vendor governance review and endpoint detection investment.

🛡️NIST CSF 2.0 Controls Mapping — What Would Have Prevented Each Breach

IDENTIFY (ID)

Asset Inventory & Vendor Risk Assessment

Would have caught: Change Healthcare, Conduent BA exposure

PROTECT (PR)

MFA, Email Security (DMARC/DKIM), Network Segmentation

Would have caught: Numotion phishing, Yale New Haven hacking

PROTECT (PR)

Least-Privilege Access Controls & PAM

Would have caught: Conduent unauthorized access, insider threats

DETECT (DE)

SIEM / Access-Log Monitoring & Anomaly Detection

Would have caught: After-hours access, cross-dept PHI access

RESPOND (RS)

Incident Response Plan & Ransomware Playbook

Would have reduced: Episource, Radiology Assoc. impact (241-day avg)

RECOVER (RC)

Offline Backups & Business Continuity Planning

Would have reduced: Ransomware encryption impact across all providers

PROTECT (PR)

Endpoint Detection & Response (EDR) + Patch Management

Would have caught: Network server exploits (61.5% of breach locations)

IDENTIFY (ID)

Third-Party Risk Management (TPRM) Program

Would have caught: 128 BA breaches — highest-impact category per record

So what: Of the top 2025 breaches, every single one could have been prevented or significantly reduced by controls already defined in NIST CSF 2.0. The gap isn't knowledge — it's implementation. Organizations with mature TPRM, MFA enforcement, and access-log monitoring programs consistently report lower breach severity and faster containment times.