Upmc

UPMC (Pennsylvania) reported to HHS OCR on 2026-03-14 an Unauthorized Access/Disclosure breach affecting 687 individuals. Breached information was located in an 'Other' location type. No business associate was involved. No further detail is available from the HHS web description.

UPMC (PA) reported to HHS OCR on 2015-05-15 a Theft/insider-disclosure breach affecting 2,259 individuals. A business associate employee disclosed patients' PHI — including names, dates of birth, and Social Security numbers — to outside parties. The covered entity terminated its relationship with the business associate following the incident. OCR reviewed UPMC's risk analysis for Security Rule compliance. Breached information location: Other.

UPMC (PA) reported to HHS on 2013-11-27 an Unauthorized Access/Disclosure breach affecting 1,279 individuals. An employee impermissibly accessed PHI stored in Electronic Medical Records, including names, dates of birth, Social Security numbers, addresses, and clinical information. UPMC notified HHS, affected individuals, and the media. The employee was sanctioned and law enforcement was notified. OCR reviewed UPMC's risk analysis for Security Rule compliance.