University of California Irvine Medical Center

UC Irvine Medical Center disclosed an insider breach where an employee accessed patient records without a job-related purpose between June 2011 and March 2015. The incident involved PHI and basic identity data. The employee was removed, law enforcement was notified, and credit monitoring was offered. No SSN or financial data was accessed.

University of California Irvine Medical Center (UCI) reported to HHS OCR on 2015-06-17 an unauthorized access/disclosure affecting 4,859 individuals. An employee impermissibly accessed patient medical records between June 2011 and March 2015. PHI exposed included names, addresses, claims information, dates of birth, gender, medical record numbers, account numbers, and clinical information, located in electronic medical records. UCI notified affected individuals and media, sanctioned staff, revised policies, and conducted a risk analysis per OCR investigation.

University of California Irvine notified affected individuals that a keystroke logger infected three computers in the Student Health Center between Feb 14 and Mar 27, 2014. The malware captured unencrypted medical info, names, IDs, and payment details. UC Irvine contained the incident, reported to law enforcement, and offered one year of credit/internet monitoring.