Track newly published HHS OCR healthcare breach disclosures and source-linked changes

Security researchers, healthcare risk teams, and compliance analysts use this Actor to monitor public HHS OCR breach disclosures. Provide a date window, optional state and entity filters, and watch terms; it returns source-linked disclosure digests with affected-entity counts, incident types, and change evidence. It tracks newly published portal disclosures — it does not query Google News RSS and it does not clean article HTML.

The output reports public disclosure facts as published and does not provide legal advice, security certification, or inferred culpability.

$10.00 / 1,000 healthcare breach change rows

Open HHS Healthcare Data Breach Change Scraper on Apify

HHS OCR disclosure changes, not Google News RSS or article HTML cleanup

Use this page when the job is monitoring the public HHS OCR Breach Portal for new or changed HIPAA breach disclosures. Use Google News Scraper to discover article URLs from Google News RSS queries. Use Article Content Extractor to extract headline, byline, body, and hero image from news, blog, and press URLs you already have. Use RSS & Atom Feed Extractor for known-publisher feed XML. Use Website Content Extractor for docs, product, pricing, policy, or help-center HTML. The Content Intelligence pack groups those discovery and cleanup Actors; this Actor is HHS OCR change detection, not that pack.

This Actor Google News Scraper Article Content Extractor
Intent Newly published HHS OCR healthcare breach disclosures and source-linked changes Query-based Google News RSS discovery Article HTML cleanup for news, blog, and press URLs
Source Public HHS OCR Breach Portal disclosure rows Google News RSS for search queries Live article-shaped page HTML
Primary input Date window and optional filters (lookbackDays, stateFilter, entityKeywords) queries (maximum 50) Page URLs (maximum 300)
Deliverable One summary digest row per configured query window, with counts, incident types, top entities, and evidence Headline, article URL, publisher, timestamps, snippet Headline, byline, publish date, article body, excerpt, hero image
HTML cleanup? No. Portal disclosure change detection No. RSS discovery only Yes — bounded article extraction

This Actor does not accept Google News queries, article URL lists, or feed URLs. It does not clean article HTML.

How is HHS Healthcare Data Breach Change Scraper different from Google News Scraper and Article Content Extractor?

This Actor monitors the public HHS OCR Breach Portal for newly published HIPAA breach disclosures and source-linked changes. It is not a news-query discovery layer and not an article HTML cleaner. Live schema description: produce one summary digest row per query window from a date window, optional state and entity filters, and watch terms. Google News Scraper queries Google News RSS (queries) and returns headlines, article URLs, publishers, timestamps, and snippets. Article Content Extractor fetches public news, blog, newsroom, and press URLs and extracts headline, byline, publish date, article body, excerpt, and hero image. RSS & Atom Feed Extractor parses known-publisher feed XML. Website Content Extractor cleans docs, product, pricing, policy, and help-center HTML. This Actor does not accept Google News queries, article URL lists, or feed URLs. It does not clean article HTML.

Use cases

Published key features: public-source evidence from published HHS OCR disclosure rows with source context preserved; recurring change detection; bounded output (one summary row per configured query window rather than charging per raw table cell); watch filters by state, entity keyword, affected count, date window, and incident terms; no-change is free on a stable recurring run.

What input is required?

The published input schema has an empty required list. A starter run can use schema defaults. Schema starter path: default lookback and dataset delivery. Recurring path: add keyword filters and webhook after the first run proves value. Other live fields:

Field Type Default Notes
lookbackDays integer 30 Days back from today to include breach submissions. Minimum 1, maximum 730. Submissions before this window are ignored.
entityKeywords string empty Comma-separated keywords to filter by covered entity name. Case-insensitive substring match. Leave empty to include all breaches in the window.
stateFilter string empty Comma-separated two-letter US state codes (for example CA,TX,NY). Leave empty to include all states.
minIndividualsAffected integer 500 Minimum 0, maximum 10000000. The HHS portal only lists breaches affecting 500+, so values below 500 have no effect.
maxBreachesInEvidence integer 50 Maximum individual breach records in the evidence array. Minimum 1, maximum 200.
watchTerms string empty Comma-separated terms that set actionNeeded true when found in breach entity names or breach types (competitor names, vendor names, or breach types of concern).
requestTimeoutSeconds integer 45 HTTP timeout for the HHS portal request. Minimum 10, maximum 120.
delivery string dataset dataset or webhook
datasetMode string changes_only all always emits the digest. changes_only emits only when new breaches appeared since last run. action_needed emits only when actionNeeded is true.
webhookUrl string — Required when delivery is webhook. Receives the full digest payload as JSON POST.
notifyOnNoChange boolean false When false, webhook delivery is skipped if no new breaches since last run.
snapshotKey string hhs-breach-monitor-snapshots Stable key for run-to-run state. Keep constant across runs for change detection. Store exampleRunInput uses hhs-breach-monitor-quickstart.
nowIso string — Optional deterministic ISO 8601 timestamp for testing. Leave empty for real runs.
dryRun boolean false When true, no snapshots are saved and no webhook is fired.

The schema sets additionalProperties to false. README examples that send states or sinceDays (including entityKeywords as an array) are not live schema fields. Live names are stateFilter (comma-separated string) and lookbackDays.

Published README input example (matches the live schema; uses datasetMode all for a first baseline):

{
  "lookbackDays": 30,
  "entityKeywords": "",
  "stateFilter": "",
  "minIndividualsAffected": 500,
  "maxBreachesInEvidence": 50,
  "watchTerms": "",
  "requestTimeoutSeconds": 45,
  "delivery": "dataset",
  "datasetMode": "all",
  "notifyOnNoChange": false,
  "snapshotKey": "hhs-breach-monitor-snapshots",
  "dryRun": false
}

Run HHS Healthcare Data Breach Change Scraper on Apify

What does a digest row contain?

The published README output table lists:

Nested topEntities fields in that table are entityName, state, individualsAffected, breachType, and submissionDate. The Actor produces one summary row per configured query window rather than charging per raw table cell.

Published README sample (starter shape; the Store README sample ends after the third topEntities row):

{
  "queryId": "hhs-breach-30d",
  "source": "hhs_ocr_breach_portal",
  "checkedAt": "2025-06-15T12:00:00.000Z",
  "windowStart": "2025-05-16",
  "windowEnd": "2025-06-15",
  "executiveSummary": "18 HIPAA breaches reported in the last 30 days affecting 142,853 individuals. 3 new since last run. 1 watch-term hit: UnitedHealth Group (54,200 affected).",
  "status": "action_needed",
  "actionNeeded": true,
  "totalBreachCount": 18,
  "newBreachCount": 3,
  "totalIndividualsAffected": 142853,
  "breachTypeSummary": {
    "Hacking/IT Incident": 12,
    "Unauthorized Access/Disclosure": 4,
    "Theft": 1,
    "Loss": 1
  },
  "topEntities": [
    {
      "entityName": "UnitedHealth Group",
      "state": "MN",
      "individualsAffected": 54200,
      "breachType": "Hacking/IT Incident",
      "submissionDate": "2025-06-10"
    },
    {
      "entityName": "Regional Medical Center of San Jose",
      "state": "CA",
      "individualsAffected": 32100,
      "breachType": "Hacking/IT Incident",
      "submissionDate": "2025-06-05"
    },
    {
      "entityName": "Blue Cross of Texas",
      "state": "TX",
      "individualsAffected": 21000,
      "breachType": "Unauthorized Access/Disclosure",
      "submissionDate": "2025-05-28"
    }
  ]
}

That sample is the published README illustration of the digest shape, not a live coverage guarantee.

How does changes_only recurring monitoring work?

datasetMode default is changes_only: emit the digest only when new breaches appeared since last run. all always emits the digest row. action_needed emits only when actionNeeded is true. Keep snapshotKey constant across runs for change detection (schema default hhs-breach-monitor-snapshots).

The published README says the default changes_only mode is designed for recurring runs: unchanged checks write zero Dataset rows and incur zero result charges, and a stable recurring run captures zero result charges. Recurring change detection emits a digest only for a first baseline or a changed disclosure set. Schema starter path: default lookback and dataset delivery. Recurring path: add keyword filters and webhook after the first run proves value.

How is HHS Healthcare Data Breach Change Scraper priced?

Billing is pay-per-event. The live Store card is $10.00 / 1,000 healthcare breach change rows. The current Store event is Healthcare breach change row at $0.01, charged for one successfully delivered new or changed public HHS breach disclosure row.

The published README says unchanged checks in the default changes_only mode write zero Dataset rows and incur zero result charges. The published README Cost section lists actor-start at $0.01 and dataset-item at $0.003 per output item; those figures do not match the live Store pricing tab.

$10.00 / 1,000 healthcare breach change rows ($0.01 per successfully delivered new or changed public HHS breach disclosure row)

See HHS Healthcare Data Breach Change Scraper pricing on Apify

How do dataset, webhook, and dry-run delivery work?

delivery defaults to dataset and writes the digest to the Apify dataset. webhook POSTs the digest to webhookUrl (required when delivery is webhook). The published Store quickstart says results appear in the Apify Dataset and can be sent to a webhook after the Dataset charge is captured. notifyOnNoChange default is false: when false, webhook delivery is skipped if no new breaches since last run. dryRun true saves no snapshots and fires no webhook. Use dryRun to validate before committing to a schedule.

Open HHS Healthcare Data Breach Change Scraper on Apify

Related pages