University of Utah Health

University of Utah Health (Health Plan, UT) reported to HHS OCR on 2023-08-15 a Hacking/IT Incident affecting 8,606 individuals. A software application used by a business associate exposed PHI including names, dates of birth, addresses, Social Security numbers, financial and claims information, and treatment information stored on a Network Server. The CE notified HHS, affected individuals, and media, and provided substitute notice and complimentary credit monitoring. Additional administrative, technical, and security safeguards were implemented.

University of Utah reported a data breach to the Montana Attorney General. The breach was reported on 2020-06-26. The breach occurred from 4/6/2020 to 4/7/2020. 43 Montana residents were affected.

University of Utah reported to HHS on 2020-06-08 a Hacking/IT Incident (email phishing) affecting 1,909 individuals. Multiple employees were victims of an email phishing attack that compromised PHI. Breached information was located in Email. No business associate was involved. This case was consolidated into an existing HHS OCR compliance investigation.

University of Utah reported a data breach to the Montana Attorney General. The breach was reported on 2020-05-19. The breach occurred on 2/3/2020. 10 Montana residents were affected.

University of Utah reported to HHS OCR on 2020-04-03 a Hacking/IT Incident (email phishing attack) affecting 5,096 individuals. Multiple employees were victims of a phishing attack that compromised PHI stored in email. This case was consolidated into an existing HHS OCR compliance investigation. No business associate was identified.

University of Utah Health (covered entity) reported an email phishing incident in which multiple employees' email accounts were compromised, exposing PHI. The HHS OCR breach portal lists 3,670 individuals affected for this entry; the narrative description references 18,317 individuals — the discrepancy likely reflects multiple related submissions. Exposed PHI included names, birthdates, lab results, medications, and diagnoses. The CE notified HHS, affected individuals, and the media, and implemented additional administrative, technical, and security safeguards. No business associate was indicated.

University of Utah Health (Moran Eye Center) reported to HHS on 2018-06-02 a Theft affecting 607 individuals. A laptop computer and an external hard drive were stolen on or about April 3, 2018. The stolen devices contained retinal scans, names, dates of birth, and medical record numbers. The CE identified the thief, reported to police, upgraded physical security, developed a facility security plan, and inventoried PHI-bearing devices. OCR obtained corrective action assurances.