MisuseHealthcareHealthcarePrivilege AbuseEmployee Data InvolvedCustomer Data InvolvedPHIHealth (basic)Identity (basic)EmploymentLowContained

University of California Irvine Medical Center

bd_85c1d964b54f4f73 · schema v1 · pii pii-v1

Severity

Low

Discovered

Mar 13, 2015

Filed

Jun 17, 2015

To disclose

14 weeks

Affected

Not disclosed

Linked

2 filings

Confidence

66%

Full breach record for University of California Irvine Medical Center →2 incidents on file

UC Irvine Medical Center discovered on March 13, 2015, that an employee accessed patient records without a job-related purpose between June 2011 and March 2015. The accessed data included names, dates of birth, medical record numbers, diagnoses, and employment status. Forensic investigation found no evidence of data removal. The employee's access was revoked, and law enforcement was notified. Credit monitoring was offered to affected patients.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 1381 days

discovery → filing · 14 weeks / 96 days

Jun 1, 2011

Begins

Mar 13, 2015

Discovered

Jun 17, 2015

Filed

vs. sector median

+5 wks slower

This filing is one of 2 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

HHS OCRbd_c8a4ec506978d6972015-06-17Verified by operator

Name: University of California Irvine Medical Center
norm: university of california irvine medical center
Domain: ucihealth.org

Name: University of California Irvine Medical Center
norm: university of california irvine medical center
Domain: ucihealth.org
Industry: Healthcarellm

Discovered: Mar 13, 2015
Breach occurred: Jun 1, 2011 – Mar 6, 2015
Undetected for: 1,381 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: PHIHealth (basic)Identity (basic)Employment
Attack vector: Insider
Threat actor: Internal
Regulator citations: Informed local law enforcement
Initial access: insider_action

During the incident: Hired independent experts in computer forensics to conduct a thorough investigation
Informed local law enforcement
Removed the employee’s access to medical center computer systems and imposed disciplinary action
Changes made: Contracted with ID Experts to provide one year of FraudStop credit monitoring and recovery services at no charge
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 14 weeks(96 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings

View merged incident ↗

HHS OCRJun 17 · first

California State AGJun 17 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-56428
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 17, 2015
Raw hash: c422e296dc49678cb6cab3a82cb1345697d890199e59b640b117b0488c7563aa

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityUniversity of California Irvine Medical Center

Victim entityUniversity of California Irvine Medical Center

Incidentdiscovered Mar 13, 2015

Stated responseHired independent experts in computer forensics to conduct a thorough investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov