UNIVERSITY OF KENTUCKY

University of Kentucky disclosed a data breach involving its OTIS Digital Driver’s License database. An unknown party exploited a website vulnerability between January 8 and February 6, 2021, acquiring a copy of the database containing usernames, passwords, and government-issued driver's license data. The breach was discovered during a penetration test in June 2021. The university fixed the vulnerability, disabled compromised passwords, and engaged forensic investigators.

A laptop computer containing the protected health information (PHI) of approximately 2,027 individuals was stolen from the University of Kentucky's Department of Pediatrics. The breach, reported to HHS on June 18, 2010, involved a laptop from the New Born Screening Program. The compromised data included names, addresses, dates of birth, social security numbers, and clinical information. In response to an OCR investigation, the university enhanced its encryption, conducted staff training on security and facility procedures, improved physical safeguards, and updated its policies on disclosure accounting.