Upmc
ent_019e07c59f5baee9301c74da217dfc3d
Disclosures
5
HHS OCR · 1 jurisdiction
Multi-filing incidents
—
no multi-filing incident in sample
Max affected reported
36,086
nationwide · HHS OCR PA
Leak-site claims
0
none in sample
Identity resolution
- Canonical name
- Upmc
- Normalized
- upmc— dedupe via name-norm; Microsoft / MSFT collapse to one row
- GLEIF LEI
- 5493001YCBUGKVU74S74
- SEC EDGAR CIK
- None — not an SEC registrant
- Domain
- upmc.com
Disclosure history (5)newest first
- PENNSYLVANIAHHS OCRas victim2026-03-14
UPMC (Pennsylvania) reported to HHS OCR on 2026-03-14 an Unauthorized Access/Disclosure breach affecting 687 individuals. Breached information was located in an 'Other' location type. No business associate was involved. No further detail is available from the HHS web description.
- PENNSYLVANIAHHS OCRas reporting2023-06-26
University of Pittsburgh Medical Center reported to HHS on 2023-06-26 a Hacking/IT Incident affecting 1533 individuals. Breached information located on Network Server. A business associate was the victim of a ransomware attack affecting PHI including names, DOBs, addresses, and SSNs.
- PENNSYLVANIAHHS OCRas reporting2021-02-05
The University of Pittsburgh Medical Center reported to HHS on 2021-02-05 a Hacking/IT Incident affecting 36,086 individuals. Breached information located on Email. Employees of a business associate were victims of an email phishing scheme, exposing ePHI including names, DOB, addresses, driver's license info, SSNs, financial info, and diagnoses.
- PENNSYLVANIAHHS OCRas victim2015-05-15
UPMC (PA) reported to HHS OCR on 2015-05-15 a Theft/insider-disclosure breach affecting 2,259 individuals. A business associate employee disclosed patients' PHI — including names, dates of birth, and Social Security numbers — to outside parties. The covered entity terminated its relationship with the business associate following the incident. OCR reviewed UPMC's risk analysis for Security Rule compliance. Breached information location: Other.
- PENNSYLVANIAHHS OCRas victim2013-11-27
UPMC (PA) reported to HHS on 2013-11-27 an Unauthorized Access/Disclosure breach affecting 1,279 individuals. An employee impermissibly accessed PHI stored in Electronic Medical Records, including names, dates of birth, Social Security numbers, addresses, and clinical information. UPMC notified HHS, affected individuals, and the media. The employee was sanctioned and law enforcement was notified. OCR reviewed UPMC's risk analysis for Security Rule compliance.
Subsidiary disclosures (2)filed by group companies
◈ These filings were made by or about subsidiaries of Upmc — not by Upmc itself. Corporate relationships are mapped from GLEIF relationship records and SEC Exhibit 21 filings.
- Massachusetts State AGvia UPMC HEALTH PLAN, INC.2023-12-09
UPMC Health Plan reported a data breach to the Massachusetts Office of Consumer Affairs and Business Regulation. The breach was reported on 2023-12-09. 1 Massachusetts residents were affected. The report records the breach type as electronic.
- PENNSYLVANIAHHS OCRvia UPMC HEALTH PLAN, INC.2015-07-02
UPMC Health Plan reported to HHS on 2015-07-02 an Unauthorized Access/Disclosure affecting 722 individuals. Breached information located on Email. An employee inadvertently sent unsecure email with PHI to an incorrect third-party address.