University of California, Los Angeles Health

UCLA Health (CA) reported to HHS on 2022-09-08 a Loss affecting 2,190 individuals. An unencrypted USB drive containing PHI — including names, dates of birth, diagnoses, and other treatment information — was misplaced and not recovered. Breached information located on Other Portable Electronic Device. The CE notified HHS, affected individuals, and the media, and responded with additional technical safeguards, revised policies and procedures, and workforce retraining.

UCLA Health reported a data breach to the Montana Attorney General. The breach was reported on 2019-04-05. The breach occurred from 11/26/2018 to 4/4/2019. 1 Montana residents were affected.

On July 3, 2015, a password-protected but unencrypted laptop owned by UCLA Health was stolen from an employee's locked vehicle. The device contained ePHI (names, medical record numbers, diagnoses, conditions, and treatment information) of approximately 1,242 individuals. The laptop was not recovered. UCLA Health notified affected individuals, media, and provided substitute notice; sanctioned and re-trained the employee; and implemented additional safeguards including laptop encryption. OCR obtained assurances corrective actions were implemented.

UCLA Health Services reported a data breach to the Hawaii Office of Consumer Protection. The office was notified on 2015/07.22. Breach type: Hackers/Unauthorized Access. 5,446 Hawaii residents were affected. Recovered from the Internet Archive after the notice was removed from the OCP table.

UCLA Health reported a cyberattack in California affecting patient data including names, SSNs, DOBs, and medical records. The breach occurred as early as September 2014, discovered May 2015. FBI and forensic experts are investigating. ID Experts provided credit monitoring and identity theft recovery services.

UCLA Health reported to HHS on 2015-07-17 a Hacking/IT Incident affecting approximately 4,500,000 individuals. A hacker accessed parts of the covered entity's computer network containing clinical and demographic information. The incident was reported to the FBI and a forensic analysis was conducted. Breach notifications were sent to HHS, affected individuals, and the media. The CE implemented technical and administrative safeguards following the breach. OCR obtained assurances of corrective action. Breached information located on Network Server.