DC Health Care Finance reports unauthorized access to nearly 400,000 records
Under review: a routine re-check found that the government record may have changed since this entry was written. It is being checked and will be corrected if needed (since 2026-10-20).
The Department of Health Care Finance for the District of Columbia filed a breach report with HHS OCR on September 3, 2026. The filing covers 399,086 individuals whose protected health information was involved in an unauthorized access or disclosure. The compromised data resided in an electronic medical record system. As a health plan, this entity is a covered entity under HIPAA. This submission date reflects when the report was filed with the government, not necessarily when the incident occurred or was discovered. Healthcare administrators should note the scale of this event involving a major public health plan.
Sources differ:
- The HHS OCR record lists an Unauthorized Access/Disclosure breach of 399,086 people involving an Electronic Medical Record. SecurityWeek and HIPAA Journal report that the cause was personal data hidden in two DHCF web reports, not a hack.
Primary source: HHS OCR Breach Portal — District of Columbia, Department of Health Care Finance (MD) · reported 09/03/2026 · 399,086 individuals · Checked against the record 2026-10-20