HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Nov. 14, 2015.
- Organization as reported
- UC Health, LLC, OH
- Entity type as reported
- Healthcare Provider
- Category as reported
Unauthorized Access/Disclosure
- Location of information as reported
- Submission date
- Nov. 14, 2015
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14668, row:5807)
- Archived copy
- Held in the private archive (provenance)
On September 16, 2015, the covered entity (CE), UC Health, discovered a breach of electronic protected health information (ePHI) when it received a security malware alert associated with the domain name of “uchelath.com”, which was similar in spelling to UC’s authorized domain name of “uchealth.com”. The breach affected approximately 1,064 individuals and the types of ePHI involved included patients’ names, addresses, phone numbers, medical record number, diagnoses, procedures, admission and discharge dates, visit dates, surgery dates, birthdates, physicians’ name, account numbers, and one email included a patient’s social security number. Following the breach, the CE blocked all Web traffic to and from the suspicious domain. The CE also analyzed emails that may have been sent from the suspicious domain to the CE. The CE provided breach notification to HHS, affected individuals, and the media. It also contacted the FBI about the breach. OCR obtained documented assurances that the CE implemented the corrective actions steps noted above.