HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Oct. 8, 2014.
- Organization as reported
- UC Davis Medical Center, Privacy Manager Breach, CA
- Entity type as reported
- Healthcare Provider
- Category as reported
Hacking/IT Incident
- Location of information as reported
- Submission date
- Oct. 8, 2014
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14963, row:6102)
- Archived copy
- Held in the private archive (provenance)
The University of California, Davis Medical Center (UCDMC), the covered entity (CE), reported that on September 26, 2014, its information technology team detected abnormal activity in the email account of a UCDMC medical provider. UCDMC determined that the provider’s email account was compromised by an unknown source (i.e., a “hacker”) resulting in potential impermissible access to the account. UCDMC determined that the provider likely used a compromised computer with credential-stealing malware when logging on remotely to the UCDMC webmail site. In response, UCDMC immediately changed the email user’s credentials and took steps to secure its email system. UCDMC reviewed the entire content of the provider’s email account to ascertain whether any electronic protected health information was contained therein. UCDMC determined that clinical and demographic information pertaining to 1,326 patients resided in the email account. UCDMC audited the entire email system to ensure that no other email accounts were similarly impacted. UCDMC provided notification to the affected individuals and issued a press release to the media. OCR obtained assurances that UCDMC implemented the corrective action described above.