HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) with a submission date of Aug. 15, 2014.
- Organization as reported
- University Health, LA
- Entity type as reported
- Healthcare Provider
- Category as reported
Hacking/IT Incident
- Location of information as reported
- Network Server
- Submission date
- Aug. 15, 2014
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 15011, row:6150)
- Archived copy
- Held in the private archive (provenance)
On August 15, 2014, the covered entity (CE), University Health, reported a breach when a professor from City College of San Francisco notified them by email of security issues. Protected health information (PHI) from the E.A. Conway Medical Center was contained on an unsecured server that was accessible online. The types of PHI involved in the breach included financial and medical information and affected 6,075 individuals. The CE immediately took the server off-line, which discontinued any unauthorized access. The CE provided breach notification to HHS, affected individuals, and the media. Following the incident, the CE hired a third-party company to conduct and assess a thorough external penetration test. OCR obtained assurances that the CE implemented the corrective actions listed above.