MisuseHealthcareHealthcarePrivilege AbuseEmployee Data InvolvedCustomer Data InvolvedPHIHealth (basic)Identity (basic)EmploymentLowContained

University of California Irvine Medical Center

bd_85c1d964b54f4f73 · schema v1 · pii pii-v1

Severity

Low

Discovered

Mar 13, 2015

Filed

Jun 17, 2015

To disclose

14 weeks

Affected

Not disclosed

Confidence

66%

Full breach record for University of California Irvine Medical Center →3 incidents on file

UC Irvine Medical Center discovered on March 13, 2015, that an employee accessed patient records without a job-related purpose between June 2011 and March 2015. The accessed data included names, dates of birth, medical record numbers, diagnoses, and employment status. Forensic investigation found no evidence of data removal. The employee's access was revoked, and law enforcement was notified. Credit monitoring was offered to affected patients.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 1381 days

discovery → filing · 14 weeks / 96 days

Jun 1, 2011

Begins

Mar 13, 2015

Discovered

Jun 17, 2015

Filed

vs. sector median

+3 wks slower

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: University of California Irvine Medical Center
norm: university of california irvine medical center
Domain: ucihealth.org

Name: University of California Irvine Medical Center
norm: university of california irvine medical center
Domain: ucihealth.org
Industry: Healthcarellm

Discovered: Mar 13, 2015
Breach occurred: Jun 1, 2011 – Mar 6, 2015
Undetected for: 1,381 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: PHIHealth (basic)Identity (basic)Employment
Attack vector: Insider
Threat actor: Internal
Regulator citations: Informed local law enforcement
Initial access: insider_action

During the incident: Hired independent experts in computer forensics to conduct a thorough investigation
Informed local law enforcement
Removed the employee’s access to medical center computer systems and imposed disciplinary action
Changes made: Contracted with ID Experts to provide one year of FraudStop credit monitoring and recovery services at no charge
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 14 weeks(96 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-56428
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 17, 2015
Raw hash: c422e296dc49678cb6cab3a82cb1345697d890199e59b640b117b0488c7563aa

Reporting entityUniversity of California Irvine Medical Center

Victim entityUniversity of California Irvine Medical Center

Incidentdiscovered Mar 13, 2015

Stated responseHired independent experts in computer forensics to conduct a thorough investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov