UC Health, LLC

UC Health, LLC notified Montana DOJ of an incident where unauthorized access to employee email accounts occurred July 2-15, 2019, discovered July 6, 2019. Patient PII may have been accessible. No SSN involved. Forensic firm hired; accounts secured and passwords reset.

UC HEALTH LLC filed a data-breach notice with the Illinois Attorney General during 2020 (case 20-032). The register records the breach as discovered on July 6, 2019. Illinois does not publish the number of people affected — 815 ILCS 530/10 permits the Attorney General to publish only the entity name, the types of personal information and the date range.

UC Health (Ohio) reported to HHS OCR on 2019-09-04 a Hacking/IT Incident affecting 95,339 individuals. Several employees were victims of an email phishing scheme. PHI exposed included names, dates of birth, Social Security numbers, medications prescribed, and treatment information. Breached information was located on Email. The CE notified HHS, affected individuals, and the media, offered free credit monitoring, retrained all staff, and implemented additional administrative, technical, and security safeguards. OCR obtained assurances of corrective actions.

UC Health, LLC (OH) reported to HHS OCR on 2015-11-14 an Unauthorized Access/Disclosure breach affecting 1,064 individuals. Discovered on September 16, 2015, after a malware alert flagged the spoofed domain 'uchelath.com' mimicking the legitimate 'uchealth.com'. Exposed ePHI included names, addresses, phone numbers, medical record numbers, diagnoses, procedures, dates, birthdates, account numbers, and one SSN. Breached information was located in Email. CE blocked suspicious domain traffic, notified HHS, affected individuals, media, and the FBI. OCR obtained documented assurances of corrective actions.