Illinois HHS Breach Reports: Twelve Months Read 2026

How many Illinois reports did the HHS portal list in twelve months?

On the HHS breach portal read October 21, 2026, 33 of 769 reports across the twelve complete months carried an Illinois reporting organisation.

Those 33 reports cover October 2025 through September 2026, and the individuals affected in them total 1,897,204 on the same read. Illinois health data breach counts like this one are counts of listings. A report's state is the one the portal lists for the reporting organisation, not where the affected people live, and a report's month is its submission date.

The portal publishes two lists. One holds reports within the last 24 months that are under investigation by the Office for Civil Rights. The other archives resolved reports and reports older than 24 months. Our counts combine both. Across every state and every year, the rows we read were 766 under investigation and 7,279 archived. Those row totals are not the twelve-month figure above and should not be mixed with it.

The portal lists only breaches affecting 500 or more individuals. We name no organisation behind any report, and nothing here says how any Chicago IT provider performs.

The portal's own labels for the Illinois reports

On the HHS portal read October 21, 2026, breach-type labels split the Illinois reports into 26 Hacking/IT Incident and 7 Unauthorized Access/Disclosure.

We repeat the portal's labels and do not interpret them. By covered entity type, the Illinois reports read Healthcare Provider 25, Business Associate 4 and Health Plan 4. By location of the breached information, a field where one report can list more than one entry, they read Network Server 21, Email 8, Paper/Films 3, Electronic Medical Record 1 and Other 1.

The location counts therefore do not sum to a report count, and we do not add them up. A label records how a report was filed on the portal; it says nothing about any organisation's safeguards.

Why do most months read 'fewer than five'?

On the HHS portal read October 21, 2026, a month with one to four Illinois reports shows neither its count nor its individuals affected.

A month with one to four reports could identify a single report on the portal, so most monthly rows below read fewer than five with individuals affected not printed. June 2026 is the one row that prints a count, 5 reports with 120,089 individuals affected. That is an observation about what the portal prints, not a statement that the other months were quieter: a fewer than five row could hold anywhere from one to four reports. We do not work out the other months from the totals, and we do not call any month, including June 2026, a trend.

The last column is the portal's all-states count for each month. We print it for context only. We make no comparison between states from it.

What does a business associate listing show?

Nine of the 33 Illinois reports on the HHS portal read October 21, 2026 list a business associate as present.

That shows nine of the 33 Illinois reports list a business associate as present on the portal. It does not tell us which organisation was at fault or what any contract said. The portal's covered entity type field is separate: 4 of the Illinois reports carry the Business Associate label there. The two figures come from different fields, so we do not add them together or net one against the other.

For a Chicago organisation under the Health Insurance Portability and Accountability Act of 1996 (HIPAA), the practical question is who else holds your data. Ask each vendor, including an IT provider, which other parties can reach it. Ask also how you would hear about an incident on their side, and get the answer in writing.

What does Illinois law say about a business that stores data it does not own?

815 ILCS 530/10(b), read October 21, 2026, addresses a data collector that stores computerized data it does not own or license.

The Illinois Personal Information Protection Act provision reads, as printed on the Illinois General Assembly's site: "Any data collector that maintains or stores, but does not own or license, computerized data that includes personal information that the data collector does not own or license shall notify the owner or licensee of the information of any breach of the security of the data immediately following discovery, if the personal information was, or is reasonably believed to have been, acquired by an unauthorized person." A quote like this can be part of a longer provision, and we do not restate it as a duty for anyone.

The same Act has other sections your counsel may read beside it, including one headed Data security. and one headed Entities subject to the federal Health Insurance Portability and Accountability Act of 1996. We do not say what either means for you. The General Assembly itself notes: "Because the statute database is maintained primarily for legislative drafting purposes, statutory changes are sometimes included in the statute database before they take effect." The text is at ilga.gov, and the source note for section 10 lists effective dates of August 18, 2017 and January 1, 2020.

Whether this wording applies to your organisation is a question for your own counsel. For how such provisions sit beside a service-level agreement (SLA), see our piece on an Illinois data security contract provision versus an SLA.

What a counts-only reading cannot tell you

The HHS portal, read October 21, 2026, lists only breaches affecting 500 or more individuals.

Smaller incidents are therefore outside these counts. The counts also say nothing about cause, cost, or any organisation's safeguards. We claim no trend, rank no state, and read the portal only as a list. A reporting organisation's listed state may differ from where the affected people live.

If you are choosing or renewing an IT provider, use the counts to frame questions rather than to score anyone. Ask your counsel whether 815 ILCS 530/10(b) bears on your own role, and ask each provider how it would notify you of an incident involving your data. Put the notification terms in the agreement text itself. Whether an SLA adds anything on top is a separate question: we hold that SLAs matter mainly in longer, multi-year agreements, and that under a year, or with a termination-for-convenience clause, ending the agreement is the better recourse. For healthcare-specific provider context, see our Chicago healthcare IT guide.