UC San Diego Health

UC San Diego Health Hillcrest-Hillcrest Medical Center reported that several employees were targeted by an email phishing scheme, compromising PHI of 1,642 individuals. Affected data included names, addresses, email addresses, DOBs, medical record numbers, health insurance information, treatment cost information, and clinical information. The entity notified HHS, affected individuals, and the media, provided credit monitoring, and implemented additional safeguards.

UC San Diego Health experienced a phishing attack on January 9, 2024, resulting in unauthorized access to two employee email accounts between January 9 and January 22, 2024. The breach exposed patient information including names, Social Security numbers, medical record numbers, and clinical data. The organization secured the accounts, enhanced security controls, and offered identity theft protection services to affected individuals.

The covered entity (CE), UC San Diego Health, reported that its business associate (BA) impermissibly used analytics tools on its websites that captured and transmitted the protected health information (PHI) of 22,971 individuals to its third-party service providers without a valid business associate agreement. The PHI involved included names, dates of birth, addresses, email addresses, IP addresses, and health insurance information. In its mitigation efforts, the CE terminated its business relationship with the BA, implemented new policies and procedures, and retrained workforce members to better protect PHI.

UC San Diego Health disclosed that its vendor, Solv Health, used unauthorized analytics tools on scheduling websites for Urgent Care and Express Care clinics between September 13 and December 22, 2022. The tools captured names, dates of birth, email addresses, IP addresses, cookies, reason for visit, and insurance type. UC San Diego Health discovered the issue in late December 2022, directed removal of the tools, transitioned to a new scheduling provider, and notified HHS and state regulators.

UC San Diego Health disclosed unauthorized access to employee email accounts between December 2, 2020, and April 8, 2021. The incident involved the acquisition of personal information including PHI, SSNs, financial account numbers, and credentials. The organization terminated access, engaged forensic experts, notified the FBI, and offered credit monitoring to affected individuals.

UC San Diego Health reported to HHS on 2021-06-08 a Hacking/IT Incident affecting 495,949 individuals. Breached information located on Email. An employee was subjected to an email phishing scheme compromising PHI including names, DOB, addresses, SSN, driver's license, claims, lab results, medications, and diagnoses. The entity implemented additional safeguards and retrained staff on email security.

UC San Diego Health notified patients that an unauthorized third party accessed medical information via a business associate, Nuance Communications, between Nov 20 and Dec 9, 2017. UCSD learned of the incident on Dec 22, 2017. Affected data included names, DOB, gender, MRNs, and clinical info. No SSNs or financial data were involved. Nuance took the platform offline and notified law enforcement. Identity protection services were offered.

UC San Diego School of Medicine discovered on September 7, 2016, that an electronic file containing personal information of Graduate Medical Education (GME) trainees was accessible on the internet. The file contained names, social security numbers, and internal index numbers. The breach occurred on August 3, 2016. UCSD removed the file immediately and is offering identity theft protection services to affected individuals.