The Stolen Laptop Has Almost Disappeared From America's Healthcare Breach Log

A laptop in Canton, Ohio

In 2010, someone stole a laptop from Aultman Hospital in Canton, Ohio. In the federal breach log it is 13,867 people's records, a column marked Theft, and another marked Laptop.

That is what a healthcare data breach used to look like. Someone took a thing, the thing had records on it, and afterwards you bought a better lock.

Fifteen years later that entire category has almost disappeared from the government's record. In 2010, 159 of the 199 breaches reported to the U.S. Department of Health and Human Services were classified as theft, loss or improper disposal. In 2025 — a year in which the register received 822 reports, more than four times as many — the count was twelve.

Laptops reported stolen specifically went from 53 breaches to four. More than one in four of everything reported in 2010; fewer than one in two hundred in 2025.

Something replaced it, and the replacement does not have a place at all.

What the log actually is

Since October 2009, HHS's Office for Civil Rights has published every healthcare breach reported to it affecting 500 or more people — the register the industry calls the Wall of Shame. It is a plain table: who reported, what kind of breach, where the information was, how many people's records, and a date.

Two of those columns are the subject of this piece, and both are HHS's own tickboxes rather than anyone's interpretation. Type of Breach offers Theft, Loss, Improper Disposal, Unauthorized Access/Disclosure and Hacking/IT Incident, plus Other and Unknown on a small number of older rows. Location of Breached Information offers Laptop, Desktop Computer, Other Portable Electronic Device, Paper/Films, Email, Network Server and a few more. A single breach can carry several values in each. We read both directly out of the archived record for all 7,894 filings we hold; Location is populated on every one, Type of Breach on all but one.

Throughout, “physical” means the first three breach types — theft, loss and improper disposal — and only those. That matters, because the same laptop or the same folder can also appear in the register under a different type, and keeping the axis fixed is the difference between a finding and a mistake we nearly made ourselves.

The crossing

The two lines cross in 2016. Before it, the typical reported healthcare breach was a physical event. After it, the typical reported healthcare breach was an intrusion.

That date is the most solid number in this piece: it lands on 2016 on HHS's own field, on our independent classification, and on a third reconciliation between them.

But the more interesting crossing happened earlier, and in a different unit. Counting people's records rather than filings, hacking overtook physical theft in 2015 — a year before it became the more common kind of breach. In 2015 the physical column accounts for about 0.87 million records and the hacking column about 111 million. The two never came close again; the narrowest margin in any following year is more than eight to one.

So the big crime arrived before the common crime. Servers were exposing more records while laptops were still being stolen more often.

A caveat volunteered rather than found: the record totals first cross in 2014, but that year's margin rests almost entirely on a single breach — remove it and the ordering reverses. 2015 is the year that survives every version of the test, including stripping out its own three largest incidents.

Paper: the control group, on the right axis

Here is the part that makes this more than a chart of the obvious — and it is also the part we got wrong once before publishing, so it is worth being precise about.

If devices stopped being stolen because organizations encrypted them, the effect should be specific to devices. Paper cannot be encrypted. Under the federal rule there are exactly two ways to put information beyond the reach of a breach report — encryption and destruction — and encryption is available only for electronic information. For paper the only route is destruction, and HHS closed the obvious workaround by name: redaction is specifically excluded.

So paper sits inside the same register, under the same reporting duty, the same 500-record floor, the same everything — except the one mechanism we think did the work. It is about as close to a control group as a real-world record provides.

The comparison has to be made on the same breach type — stolen or lost paper against stolen or lost devices — and on that axis, both fell hard. Devices reported stolen, lost or improperly disposed of went from 100 breaches in 2010 to 6 in 2025 (−94%); paper and film, same breach types, from 37 to 8 (−78%).

Both collapsed. Devices collapsed further. Pooling three-year windows at each end to steady the small 2025 counts, devices fell about two and a half times further than paper — they ended at roughly two-fifths of what paper's own trend would predict, and that gap is outside sampling noise (difference-in-differences 0.377, 95% CI 0.212–0.672).

The result that needs no statistics at all is what it did to the mix. In 2010, devices were 63% of physical breaches and paper 23%. In 2023–25 they are level — 51% each. The last physical thing in a healthcare breach is now as likely to be a folder as a laptop.

A note on what we corrected. An earlier draft compared paper to devices across all breach types, and paper looked almost flat — 51 breaches in 2010, 41 in 2025. That flatness was an artifact: 33 of those 41 paper rows in 2025 are mis-mailings and misfilings HHS classifies as “unauthorized access or disclosure,” not theft. Stolen paper did not hold steady. It fell 78%. We say so because a reader with the same table would find it in an afternoon.

What this does and does not prove

It is tempting to call it a rule that worked. The evidence does not reach that far, and the reason cuts against the story.

Roughly half the device decline is specific to devices. The other half is shared with paper — a medium encryption cannot touch. So a large part of what happened here is not encryption. It is whatever also made paper thefts fall: less paper, fewer records held locally, better physical security, changed workflows.

There is a harder problem too, and it is structural. The encryption safe harbor works by making an encrypted stolen laptop not a reportable breach. So the thing we would most like to count — laptops still being stolen, but now encrypted — is invisible by construction. A perfect encryption success and a perfect crime-prevention success look identical in this register.

Which is why the honest headline is about the log, not the world. The stolen laptop has almost disappeared from the breach log. Whether it has disappeared from hospital parking lots is a question this data cannot answer.

The floor

One more reason for care, and it runs the same direction.

The register only contains breaches affecting 500 or more people. A stolen laptop holding 200 records has never appeared in it. And the amount of data a laptop carries has been falling — the median laptop breach dropped 23% between the early and late eras (2,462 to 1,894 records, comparing 2010–14 with 2020–25), with the 25th percentile falling from 950 to 823.

Simulate that shift onto the early distribution and roughly 12% of those laptop breaches would slip below the reporting floor — against an observed decline in laptop breach count of about 78% over the same eras. So size drift explains roughly a sixth of what happened. It is not the story, but it is not nothing, and a reader who finds it themselves should find us having already said it.

That calculation deliberately takes the reading less favourable to us. It runs over every laptop breach in the register rather than only the stolen ones, which is the population that shows the greater size drift; restrict it to theft, loss and improper disposal and the median barely moves at all (2,462 to 2,340, a 5% drop), leaving even less of the decline for the floor to explain. We report the larger estimate because it is the one that cuts hardest against the headline.

What replaced it does not behave the same way

The old crime had a physical scale. A laptop holds what a laptop holds.

The new one is different in kind. Over 2010–2025, the median network-server breach in the register affects 10,373 people's records; the median laptop breach, 2,300. That is about four and a half times larger at the middle — but the middle is not where the difference lives. At the 95th percentile a server breach reaches 637,999 records against a laptop's 43,890, fourteen times larger. The two distributions have different tails, and the tail is the whole point.

The clearest evidence for a change in kind is that the physical numbers barely moved. Across sixteen years the median physical breach stayed between roughly 1,300 and 2,800 records with no trend — the same size of event, happening less and less often. The median hacking breach, meanwhile, climbed to a peak of 11,651 in 2022.

So this is not one category growing while another shrinks proportionally. One category held roughly still and became rare; another arrived and grew.

The tail belongs to the contractors

If the records are no longer on laptops, where are they when they are breached? At the top of the register, increasingly, they are at a contractor.

Sort the 4,367 hacking filings submitted between 2010 and 2025 by the number of records each reports. (The 2009 and 2026 rows are partial years and are left out; a 2026 filing would otherwise sit fourth.)

Among the fifty largest, twenty-seven were submitted not by a hospital or an insurer but by an organization filing as somebody else's business associate — 54%, against 16% across all 4,367 filings. Among the hundred largest, 44%. Five of the top ten. Or as one comparison: a filing reporting 100,000 records or more is about twice as likely to have come from a contractor as one below that line, an odds ratio of 2.17 (95% CI 1.79–2.64).

That is not the handful of giants at the top doing the work. Delete the three largest filings in the register and the top-fifty figure does not move at all. Nor does it rest on HHS's typing of its filers, which is loose in places: three organizations in that top fifty — HCA Healthcare, Trinity Health, CareSource — are recorded as business associates on these filings despite being a hospital operator, a hospital system and a health plan. Count all three as hospitals and it is still 48% of the top fifty and 41% of the top hundred.

The names are why. Change Healthcare's single filing reports 192.7 million records (2024); Conduent's, 62.2 million (2025); Welltok's, 14.8 million (2023) — a claims clearinghouse, a business-services contractor, a healthcare communications platform. Change Healthcare's one filing reports nearly six times as many records as every physical breach in the register between 2010 and 2016 combined: all 985 of those thefts, losses and improper disposals, 984 of them carrying a published count, together exposed 33.2 million.

Contractors run larger from the middle of the distribution upward — a median of 13,862 records against 9,013 for everyone else, on 2022–25 hacking filings — but the gap widens sharply in the tail, which is what concentration means. The other five of the top ten were not filed by a contractor. Four — Anthem, Aflac, Premera and Excellus — are health insurers whose filings record no business associate. The fifth, LabCorp, is a laboratory whose filing names its debt-collection contractor as the business associate that was attacked. The register's largest entries now belong about as often to intermediaries as to the insurers — companies the patient never chose and mostly cannot name.

What the register cannot tell you is whether this is getting worse. The relationship is stable: measured separately on 2016–19, 2020–22 and 2023–25 filings, the odds ratio reads 2.20, 2.12 and 2.15. What has risen is not how strongly contractor-filing predicts size but how many filings come from contractors at all — 11.9% of hacking filings in 2010–19 against 17.2% since. That rise is real; the association behind it is not moving. A pre/post interaction test on those two periods returns no evidence that contractor-filing predicts size any more strongly than it did (p = 0.37), and the three-era split above returns a weaker signal still. Earlier years are too thin to extend the comparison backwards: the register holds only sixteen pre-2016 hacking filings of 100,000 records or more. The level is here; the trend is not.

Two cautions attach to any count in this part of the register.

A filing is not a breach. When the billing contractor AMCA was breached in 2019, AMCA filed nothing; its clients filed instead, and eighteen rows name it, together reporting 13.7 million records. Only one reaches the top fifty — the next is 76th. A contractor that files centrally enters this ranking; one whose clients each file separately does not, and no ranking built on filings can tell them apart.

And the register's own vendor tickbox is a poor instrument, which is why the figures above rest on who filed rather than on the box. Business Associate Present is completed by the reporting entity, and inside that one AMCA cluster it is answered both ways: eight filings record a business associate, ten record none, one is not filed as a hacking incident at all. What it means has drifted, too — covered entities filing about somebody else's contractor were near zero before 2014 and are common now, in physical breaches as much as intrusions, where a contractor-borne hack cannot be the mechanism.

The register also disagrees with itself about size. On one 2019 filing HHS's count column reads 1,733,836 while the narrative HHS wrote when it closed the case describes 34,424 individuals — a fiftyfold gap between two fields of one row, which records no business associate in a narrative whose first sentence names one.

Whether the same multiplication is happening around Change Healthcare, we cannot tell you. These clusters are visible only through HHS's written narratives, and HHS writes those when an investigation closes: on hacking filings, coverage runs 100% for 2019, 92.6% for 2023, 76.4% for 2024 and 33.4% for 2025. No 2024 filing names Change Healthcare in its narrative, which tells you about the state of that column and nothing about the state of the world.

The same hospital, twice

Ten organizations appear in this register on both sides of the change by a strict test: a physical breach of a device or paper between 2010 and 2015, a hacking incident between 2020 and 2025, no physical breach after 2015 — and, on both filings, no business associate recorded, so that the intrusion is as far as the register can say the organization's own and not a contractor's. That last screen matters: relax it and the count more than doubles, because a great many “modern intrusions” here are a hospital's contractor being hacked, not the hospital. It is the one place this piece lets that unreliable tickbox decide what is counted, and it leans the wrong way — a filing that wrongly records no business associate stays in. Ten is therefore a rough figure, and the cases below were each read individually rather than taken on the flag's word.

Aultman, the hospital this piece opened with, is one. That stolen laptop in 2010, 13,867 records. Then in 2024, a hacking incident affecting 26,206 — an employee's email account, not a thing anyone could carry out of a building.

Lawrence General Hospital — which since September 2025 operates as Merrimack Health Lawrence Hospital — reported a lost thumb drive in 2015 affecting 2,071 records, and in 2020 a ransomware incident affecting 176,587. Eighty-five times as many, and nothing was taken from the premises.

Washington University School of Medicine: a stolen laptop in 2013, 1,105 records. A hacking incident in 2020, 14,795. Seven Counties Services in Kentucky: improper disposal in 2014, 727 records. Hacking in 2020, 13,375.

The pattern in each is the same. The early event has a place — a car, a drive, a bin. The later one does not.

The stragglers

Physical breaches have not stopped. There were 53 of them between 2023 and 2025, and who files them has changed. In the early era, hospitals, universities and medical centers accounted for about a quarter of physical breaches. In 2023–25 they are under a tenth. What remains skews toward small practices, still occasionally losing something — and 27 of those 53 filings involve paper, which no encryption programme would have covered.

Though not exclusively. Walgreen Co., Zuckerberg San Francisco General Hospital and Adventist HealthCare all appear in the recent record with paper losses. Paper is nobody's solved problem.

The enforcement wave

The reason to suspect encryption did some of the work is that from 2012 into 2017, HHS made an example of organizations that lost unencrypted devices. Resolution agreements are settlements; they include no admission of liability.

Alaska's health department paid $1.7 million in June 2012 over a USB drive stolen from an employee's car. Massachusetts Eye and Ear paid $1.5 million that September over an unencrypted laptop. In a December 2012 agreement announced that January, the Hospice of North Idaho paid $50,000 in what HHS called the first settlement involving a breach of unsecured electronic protected health information affecting fewer than 500 individuals — a deliberate signal that small losses counted too. On a single day in April 2014, Concentra paid $1,725,220 and QCA Health Plan $250,000, both over unencrypted laptops. Feinstein Institute paid $3.9 million in March 2016 over a laptop left in a vehicle. In February 2017 HHS imposed a $3.2 million civil money penalty on Children's Medical Center of Dallas — not a settlement; HHS's record says the hospital did not file a timely request for a hearing — over unencrypted devices it had been warned about since 2007.

The message was not subtle, and the category it targeted is the one that collapsed.

But the wave was broader than devices, and that belongs in the record too. North Memorial paid $1.55 million in 2016 to settle HHS charges that it potentially violated HIPAA after a contractor's unencrypted laptop was stolen; HHS's announcement centred on the absence of a business associate agreement. Raleigh Orthopaedic paid $750,000 the same year to settle charges that it had handed 17,300 patients' X-ray films to a vendor — to harvest the silver — without one. Affinity Health Plan paid $1,215,780 in 2013 over patient data left on the hard drives of returned photocopiers. Of those three, only Raleigh's films had no encryption route at all. HHS was enforcing custody and contracts, not just encryption — which is exactly why paper's decline, though smaller than devices', is not zero.

What the log is now

In 2025 the register received 822 reports. Roughly four in five were hacking or IT incidents. Twelve were theft, loss or improper disposal — eight of them involving paper.

A record that once described things being taken from buildings now describes access being taken from systems. The register was designed for the first world: it names the hospital, the hospital buys a lock, and the enforcement wave of the 2010s made the lock mandatory. Its largest entries now belong about as often to intermediaries as to the insurers — companies the patient never chose, and cannot buy a lock for. The events got rarer, then they got bigger, and the part of the story we can prove is the part about the log rather than the world.

Method & limitations

Source: the HHS Office for Civil Rights breach portal, the public register of healthcare breaches affecting 500 or more individuals. We hold 7,894 filings, parsed directly from the archived HHS table row into HHS's own published cells — Type of Breach and Location of Breached Information — with no model in the parse path. Location is populated on 7,894 of 7,894; Type of Breach on 7,893. A small number of records appear more than once in our copy, captured at different moments as HHS revised a figure; no endpoint figure in this report is affected by them — 2010's 159, 2025's twelve and both the device and paper series reproduce exactly — and the 2025 hacking share is 80.9% on our rows against 80.8% on HHS's live register. A separate small class is HHS's own: the register sometimes carries one breach as several rows and says so in the Web Description. Those sit in the middle of the physical series — 2015's 111 filings include one and 2016's 84 include one — and are counted here as filed, because this report counts the register HHS publishes. Rows sharing a filer name and submission date are not duplicates on that basis alone: one contractor commonly files separately for each affected client — Alvaria filed thirteen on a single day in 2023 — and one covered entity can report two incidents at once, as Montefiore did in 2010, filing once for three stolen desktop computers and again for two more. The repeat captures are told apart by their counts, not by that key.

We verified our copy against HHS's own numbers: 2010 and 2015 match record-for-record, and no year under-counts by more than two filings. HHS's Annual Reports to Congress count breaches by occurrence year while this register is organized by submission date; those are different populations, and HHS's own footnotes supply the submission-basis figures we compared against.

Conventions. Year is HHS's Breach Submission Date. “Physical” means Type of Breach in {Theft, Loss, Improper Disposal} — and only those; every device-versus-paper comparison is restricted to that type. A filing whose Type or Location cell names several values is counted in each. Counts are HHS's published cell. The series runs 2010–2025: 2009 opens in October and 2026 is truncated at collection, so neither is a trend endpoint. Counts are people's records as reported by filers, not distinct people; annual people-totals are dominated by single incidents — 2015 is 70% one breach, 2024 is 67% one breach — and are labelled wherever plotted. Percentiles are nearest-rank.

Our own classification agrees closely with HHS's field (99.1% on Hacking/IT, 93.0% on Theft, 98.6% on Loss) but is used only as corroboration. One known mapping defect — HHS's “Improper Disposal” landing in an error category rather than a physical one, in all 116 cases — understates the early physical share by about 3.5 points, which makes the decline reported here slightly conservative. We publish no figure derived from HHS's “Unauthorized Access/Disclosure” category, which maps inconsistently; the correction described in the paper section is what that rule looks like when applied to our own draft.

The contractor analysis rests on who filed, not on the tickbox. “Contractor-filed” means HHS's Covered Entity Type cell reads Business Associate — the filer's declaration of its own role. No published figure here is computed from the Business Associate Present tickbox, for the reasons the section gives. Where it does appear — the exclusion screen in “The same hospital, twice,” the eight-Yes/ten-No split inside the AMCA cluster, and in describing what an individual filing records — its unreliability is flagged in place, and none of those is a measurement taken on it. An earlier draft of this report built its central statistic on that tickbox and would have published a 34.5% base rate and a 62% top-fifty share; on the filer-role axis the same measurement reads 16% and 54%. Both describe a real concentration, but only the second is measured on a field whose meaning is stable across the sixteen years. The concentration is reported as a level, not a trend, because it does not have one. Two stability checks are published rather than described — removing the three largest filings, and reclassifying the three ambiguous filers. A third we ran and do not publish: the record-weighted share is not stable, moving from 67.8% to 52.0% for 2023–25 on the removal of Change Healthcare alone, so no record-weighted figure appears here.

Reproduce this in the product

Every filing in this report is also a record in our corpus — the same 7,894 rows, with their HHS cells preserved — so the arithmetic can be run against our copy. One caveat before re-running it: our own stored count differs from HHS's published cell on 96 filings, and every figure in this report uses the published cell.

• HHS OCR breach filings — the live feed behind this report
• The Washington Clock — the companion study: a state that publishes its own deadline arithmetic
• The Silent Majority — what happens after ransomware gangs name a company

Sources

• HHS Office for Civil Rights — Breach Portal (the Wall of Shame)
  the register itself: every breach affecting 500 or more individuals reported since October 2009, and the Type of Breach and Location of Breached Information cells this report is built on
• 45 CFR §§ 164.400–414 — the Breach Notification Rule
  the reporting duty, the 500-individual threshold for the public register, and the 60-day clock
• HHS — Guidance to Render Unsecured PHI Unusable, Unreadable, or Indecipherable (74 Fed. Reg. 42740)
  the safe harbor: encryption and destruction are the only two routes, encryption is electronic-only, and redaction is excluded by name (42742–43) — the legal basis for treating paper as a control group
• HHS OCR — Resolution agreements and civil money penalties
  the 2012–2017 enforcement wave, including Alaska DHSS, Massachusetts Eye and Ear, Hospice of North Idaho, Concentra, QCA Health Plan and Feinstein over unencrypted devices, a civil money penalty against Children's Medical Center of Dallas, North Memorial and Raleigh Orthopaedic over missing business associate agreements, and Affinity over ePHI left on returned photocopier drives
• HHS OCR — Annual Reports to Congress on Breaches of Unsecured PHI
  the reconciliation used to verify our copy; note HHS counts by occurrence year while the register is organized by submission date

Corrections: corrections@disclosurelens.com — 48-hour SLA. Every figure drawn from the breach register derives from HHS's own published cells; the enforcement amounts come from HHS's published resolution agreements and notices of civil money penalty. All were independently re-derived before publication and human-audited.