UCLA Health Data Breach

UCLA Health is a large academic medical system based in Los Angeles, California, that provides hospital, clinical, and specialty care services to patients across the region. The health system recently notified affected individuals that their protected health information was involved in a security incident.

Healthcare organizations that maintain detailed patient records have a responsibility to safeguard that information and to promptly notify anyone affected when a breach occurs.

UCLA Health’s Data Breach Investigation

According to a notification letter filed with the California Attorney General’s Office, UCLA Health determined that patient information was accessed and disclosed to an outside healthcare provider in a manner inconsistent with the health system’s policies governing protected health information. UCLA Health stated that it promptly investigated the incident upon discovery and, at the time of notification, had not identified any evidence that the information had been further disclosed or otherwise misused.

Breaches involving protected health information are a persistent concern across the healthcare industry, in part because medical records often combine identifying details with sensitive clinical and financial data in a single record, making them a valuable target for those seeking to commit fraud or identity theft. When information such as a patient’s name, address, date of birth, and health insurance details is exposed together, it can be used to file fraudulent insurance claims, open new accounts in a victim’s name, or craft convincing phishing attempts that reference real treatment details to appear legitimate.

Notification timelines for healthcare data breaches are governed by federal HIPAA regulations as well as state-level breach notification laws, which generally require covered entities to notify affected individuals and regulators within a defined window after discovering an incident. UCLA Health’s filing with the California Attorney General reflects this regulatory notification process, which is a standard part of how such incidents become public.

When Did This Breach Occur?

UCLA Health’s filing references breach dates of December 27, 2024, and April 21, 2026, with the incident reported to the California Attorney General on August 4, 2026. The notification letter indicates that patient information was disclosed to an outside healthcare provider on a specific date connected to the underlying incident.

What Information Was Breached?

UCLA Health stated that the information involved was contained in patients’ medical records and varied by individual. It may have included a patient’s name, address, date of birth, and health insurance information, as well as clinical information such as referral orders. For some individuals, the affected information may have also included the last four digits of a Social Security number. UCLA Health noted that no full Social Security numbers, financial account numbers, or payment card information were involved in this incident.

What You Can Do

Individuals who received a notification letter from UCLA Health should take steps to protect themselves, including:

• Reviewing statements from health plans and providers for any unfamiliar activity
• Monitoring credit reports for signs of fraud, available for free at annualcreditreport.com
• Enrolling in any complimentary identity monitoring services offered in the notification letter
• Remaining alert to phishing attempts referencing UCLA Health or recent medical care
• Reporting any suspected fraud promptly to relevant financial institutions or credit bureaus

File a Data Breach Lawsuit Against UCLA Health

If you received a notice from UCLA Health about this data breach, you may be entitled to compensation. Affected patients may be able to pursue legal action to recover damages related to the exposure of their personal and health information.

Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.