An employee of UC Irvine Medical Center unethically viewed thousands of patient records over a four-year period. The incident compromised the personal health information including names, dates of birth, gender, medical record numbers, height, weight, medical center account numbers, allergy information, home address, medical documentation, diagnoses, test orders and results, of 4,859 patients . The center investigated the incident with the help of external security experts and notifies the affected patients.

The University of California, Irvine experienced a data breach reported on May 14, 2014, involving unauthorized access to its systems. The breach occurred due to computers being infected with a keystroke logger between February 14 and March 27, 2014, which potentially compromised personal and unencrypted medical data of individuals. The exact number of affected individuals remains unknown, raising concerns about the exposure of sensitive health information. The attack method suggests a targeted intrusion aimed at harvesting confidential data, likely through malicious software designed to capture keystrokes—including login credentials, medical records, or other personally identifiable information (PII). The breach underscores vulnerabilities in the university’s cybersecurity defenses, particularly in protecting high-risk data like medical records, which are subject to strict regulatory protections (e.g., HIPAA). The incident highlights the risks of unauthorized data access in academic institutions handling sensitive information, with potential long-term repercussions for trust, legal compliance, and individual privacy.

In June 2015, the California Office of the Attorney General disclosed a data breach at the University of California Irvine Medical Center, where an employee improperly accessed patient records over an extended period—from June 2011 to March 2015. The unauthorized access exposed personal health information (PHI) of an unknown number of patients, though investigations found no evidence of sensitive data being stolen or misused. The breach stemmed from internal misconduct, highlighting vulnerabilities in employee access controls and monitoring protocols. While the exposed data included patient details, the lack of confirmed theft or external exploitation mitigated some risks. However, the prolonged duration of the breach (nearly four years) raised concerns about compliance with healthcare privacy regulations (e.g., HIPAA) and the potential for reputational damage due to the mishandling of confidential medical records. The incident underscored the need for stricter audit trails, access restrictions, and employee training to prevent similar internal breaches in healthcare institutions.