UC San Diego Health health.ucsd.edu

UC San Diego Health data breach: what happened and what to do

A vendor's analytics tools on UC San Diego Health websites sent patient data to third parties without permission. UC San Diego Health reported 22,971 people to HHS. Names, birth dates, addresses, emails, IP addresses and insurance details were involved.

View all 13,177 breaches
Breach date
13 Sept 2022
Affected
22,971
Data exposed
Names, Dates of birth, Physical addresses, Email addresses, IP addresses, Health insurance information
Last updated

Reviewed by Anthon Wansland

Head of Product & Co-Founder

Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.

What happened

UC San Diego Health reported to the U.S. Department of Health and Human Services that a business associate (a vendor that handles patient data for it) used analytics tools on its websites without a valid agreement. The tools captured information and sent it to third-party service providers. This was not a hack: the data went out through tracking technology on the sites.

Press coverage names the vendor as Solv Health, which ran scheduling for the Urgent Care and Express Care booking pages. HHS lists 22,971 people as affected. Letters went to patients in March 2023.

Sources checked: scworld.com, jdsupra.com, healthitsecurity.com

Last verified against the official page:

How we research this Report an error

What was exposed

HHS says the information included names, dates of birth, addresses, email addresses, IP addresses and health insurance information. Coverage of the notice says Social Security numbers, medical record numbers and payment card or bank details were not collected.

What that means for you

An email address and a date of birth are enough to make a phishing message look legitimate, especially one that refers to a recent clinic visit or your insurer. Nothing here suggests stolen passwords, but a message that asks you to log in or pay a bill after a breach notice deserves suspicion.

The health system's response

UC San Diego Health ended its relationship with the vendor, put new policies in place and retrained staff, according to its HHS filing. It notified HHS, patients and the media, and published a substitute notice.

What to do if you were in it

  1. 1

    Treat messages about your care as suspect

    Expect emails and texts that mention a visit, an appointment or your insurer. Don't click links in them. Go to the health system or insurer site yourself.

  2. 2

    Read your insurance statements

    Check explanation of benefits statements from your insurer and question any treatment or claim you don't recognize.

  3. 3

    Consider a credit freeze

    Social Security numbers weren't reported as exposed, so a freeze isn't urgent. It is still free and works well, as the FTC explains.

  4. 4

    Report misuse

    If someone uses your details, report it at IdentityTheft.gov to get a recovery plan.

  5. 5

    Check whether your email or phone is in this and other breaches

    Run a free Serus scan. Serus monitors breach databases and the dark web and alerts you when your details show up. It can't remove breach data, so the steps above are what protect you.

Official filings

Timeline

  1. Reported to U.S. Department of Health and Human Services

  2. The breach happened

  3. Reported to U.S. Department of Health and Human Services

Frequently asked

Was I affected by the UC San Diego Health breach?

The health system mailed notices to affected patients. If you got one, your information was involved. Patients who used the vendor's Urgent Care or Express Care booking pages are the group press coverage describes.

Were Social Security numbers exposed?

Coverage of the notice says Social Security numbers, medical record numbers and payment card or bank details were not collected.

Was this a hack?

No. A vendor's analytics tools sent patient information to third parties without a valid agreement, according to the HHS description.

Do I need to change my password?

No passwords were reported as exposed. Changing one is still a good habit if you reuse it across sites.

Sources

Something wrong or out of date? Tell us and we'll re-check it.

Serus

Check if you're exposed in a breach with Serus

Find your leaks. Get alerted to new ones.

Run a free scan

Related guides

All guides
How to stop spam emails consumer.ftc.gov How to opt out of prescreened credit card offers (OptOutPrescreen) optoutprescreen.com How to stop junk mail dmachoice.org Remove yourself from Equifax equifax.com

Related articles

All articles

What Happens If Your Email Is on the Dark Web – And What to Do Next

How to Get My Information Off the Dark Web

How to Spot a Phishing Email – and Check If an Email Is Legit

Cookie preferences

Choose which categories we may use. Full details for every cookie are in our Cookie Policy.

Strictly necessary

Authentication, session management, security and fraud prevention, and saving your consent choice. Always active. The site cannot function without them.

Functional

Remember preferences such as language and settings that improve your experience.

Analytics

Help us understand how the site is used, like pages visited, interactions, and performance, so we can improve it.

Marketing & advertising

Measure our marketing and deliver more relevant ads through partners such as Google, Meta, TikTok, X, and Reddit. Used only with your consent.

Your choice is saved for 12 months and applies across serus.ai, including the app. You can change it anytime from the cookie widget or the "Cookie settings" link in the footer. Withdrawing consent does not affect processing that happened before withdrawal.