UCLA Health Data Breach

UCLA Health says patient records were disclosed to an outside healthcare provider against its own privacy policies. The disclosures ran for about 16 months before they stopped.

UCLA Health reported the incident to the U.S. Department of Health and Human Services (HHS) in August 2026. The report lists 6,050 people affected. UCLA Health also filed with the California Attorney General on August 4, 2026.

According to UCLA Health, the disclosures took place between December 27, 2024 and April 21, 2026. UCLA Health determined what happened on July 2, 2026. Its notice says patient information was “accessed and disclosed” to an outside healthcare provider “in a manner inconsistent with UCLA Health policies governing protected health information.”

Why This Is Different From a Typical Hack

This incident does not read like a typical outside cyberattack. UCLA Health describes records moving to a healthcare provider outside the organization. It has not publicly named that provider. It also has not explained why the disclosures continued for so long.

The timeline raises its own questions. About 16 months passed from the first disclosure to the last. Another 10 weeks passed before UCLA Health identified the problem on July 2, 2026.

UCLA Health states that it has not identified evidence that the information was further disclosed or otherwise misused. That statement reflects what UCLA Health knows so far.

What Information Was Exposed?

UCLA Health says the information came from patient medical records and varied by person. It may have included:

• Name
• Address
• Date of birth
• Health insurance information
• Clinical information, such as referral orders
• The last four digits of a Social Security number, for some individuals

UCLA Health says the incident did not involve full Social Security numbers, financial account numbers, or payment card information.

What Is UCLA Health Offering Affected Patients?

UCLA Health offered 12 months of complimentary Experian IdentityWorks. The sample notice set an enrollment deadline of October 31, 2026, which has now passed. Patients who received a letter should review it and contact Experian with questions about their options.

UCLA Health also says it has deployed additional monitoring and enhanced system controls.

Your Medical Information Is at Risk

Medical records are personal in a way few other records are. Referral orders can reveal a patient’s health conditions and care. Unlike a credit card number, that history cannot be changed.

Health insurance details can also be misused to file false claims or obtain care in another person’s name.

Affected patients can take these steps:

• Review statements from health plans and providers
• Request free credit reports at www.annualcreditreport.com
• Report unfamiliar charges or services right away
• Save the notice letter

Do You Have Legal Options?

Healthcare organizations have a duty to safeguard patient information and follow privacy laws. When that duty is not met, affected patients may have legal rights and remedies.

Contact the Data Breach Attorneys at Emery | Reddy today for a Free Case Review. No Fee Unless We Recover.

Your Personally Identifiable Information (PII) includes information that can be used to identify you, such as your name and other personal details. Organizations that manage healthcare data are legally required to safeguard this information. When PII is exposed in a data breach, it can potentially be used by cybercriminals to commit identity theft, financial fraud, or other misuse.

Much of the information involved in this incident may also qualify as Protected Health Information (PHI). PHI includes medical or healthcare-related data protected under federal and state privacy laws. When PHI is compromised, it can be misused for medical identity theft or insurance fraud.

Residents of California may be entitled to additional protections under the California Consumer Privacy Act (CCPA), which provides enhanced rights regarding the collection, use, and safeguarding of personal information.

FAQ

How many people were affected?

UCLA Health reported 6,050 people to HHS.

What information was involved?

It varied by person. It may have included:

• Name, address, and date of birth
• Health insurance information
• Clinical information, such as referral orders
• The last four digits of a Social Security number for some people

Was this a hack?

UCLA Health describes a disclosure to an outside healthcare provider. It has not described an outside cyberattack.

How long did it last?

UCLA Health says the disclosures ran from December 27, 2024 to April 21, 2026.

Can I still enroll in credit monitoring?

The sample notice lists an October 31, 2026 deadline. Check your letter and contact Experian with questions.

What should I do with my notice letter?

Keep it. The letter may include an enrollment code, deadlines, and details about your information. Save the envelope too.

Could scammers use this breach to contact me?

Yes, it is possible. Be careful with calls, texts, or emails that mention this incident and ask for money or personal details. Contact the company directly using a number you trust.

Do I have a legal claim?

You may. UCLA Health had a duty to protect your medical information and follow its own privacy rules. When that duty is not met, affected individuals may have legal rights and remedies. Contact Emery | Reddy at 916.995.5968 or visit emeryreddy.com for a Free Case Review to see what you may qualify for. No Fee Unless We Recover.