University of Utah Health

University of Utah Health (covered entity) reported an email phishing incident in which multiple employees' email accounts were compromised, exposing PHI. The HHS OCR breach portal lists 3,670 individuals affected for this entry; the narrative description references 18,317 individuals — the discrepancy likely reflects multiple related submissions. Exposed PHI included names, birthdates, lab results, medications, and diagnoses. The CE notified HHS, affected individuals, and the media, and implemented additional administrative, technical, and security safeguards. No business associate was indicated.