The University of California – Irvine is notifying patients of a data security breach involving their medical information.
On March 26, UC Irvine discovered that one of the computers in the UC Irvine Student Health Center had been infected with a virus. They subsequently verified that two other computers also were infected.
“The three computers were infected with a keystroke logger that captured data as it was entered onto them and transmitted that data to unauthorized servers. This occurred between February 14 and March 27, 2014,” J. Patrick Haines, the Executive Director of the Student Health Center, wrote in a letter going out to those affected.
UC Irvine believes that the following types of patient information were captured and exfiltrated: name, unencrypted medical information (potentially including health or dental insurance number, CPT code(s), ICD9 code(s) and/or diagnosis), student ID#, non-student patient ID#, mailing address, telephone #, amount paid to the Student Health Center for services received, and bank name and check # (if payment was made by check).
The university has no indication that the data have been misused. The number of patients affected was not reported.
Upon discovery, the infected machines were immediately disconnected from the internet and UC Irvine remediated the incident.
Those patients who are being notified are being offered services through ID Experts.
You can read the template notification on the web site of the California Attorney General (pdf).