HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Feb. 14, 2014.
- Organization as reported
- UC Davis Medical Center, Privacy Manager Breach, CA
- Entity type as reported
- Healthcare Provider
- Category as reported
Hacking/IT Incident
- Location of information as reported
- Submission date
- Feb. 14, 2014
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 15175, row:6314)
- Archived copy
- Held in the private archive (provenance)
The covered entity (CE), University of California, Davis Medical Center, reported that on December 13, 2013, a fraudulent phishing email was sent to employees. The email instructed employees to go to a fraudulent website and input authentication credentials. Three employee email accounts were impacted by the phishing scam. The email accounts contained the electronic protected health information (ePHI) of approximately 2,269 individuals. The types of ePHI potentially affected by the incident included patient names, medical record numbers, and limited health information. The CE determined that there was a low probability that specific email content was accessed during this event. The CE provided breach notification to HHS, affected individuals, and the media. Immediately following its discovery of the breach incident, the CE took steps to mitigate harm including blocking further access to the initiating IP address, deleting all similar phishing emails from employee accounts, and immediately notifying staff of the pending threat. In response to this incident, the CE implemented a new procedure to help guard against, detect, and report malicious software. OCR obtained assurances that the CE implemented the corrective action described above.