Almeida Law Group is investigating a data breach at University of California Los Angeles Health. If you were affected, contact Almeida Law Group.
About University of California Los Angeles Health
UCLA Health is the public academic healthcare system affiliated with the University of California, Los Angeles. It operates multiple hospitals — including Ronald Reagan UCLA Medical Center, UCLA Mattel Children’s Hospital, UCLA Santa Monica Medical Center, UCLA West Valley Medical Center, and UCLA Resnick Neuropsychiatric Hospital — along with more than 280 medical practices throughout Southern California. The system employs over 2,700 physicians and 3,800 nurses and has been ranked number one in California and Los Angeles by U.S. News & World Report for 37 consecutive years.
What Happened?
University of California Los Angeles Health was listed in an HHS Office for Civil Rights breach portal report submitted on August 4th, 2026. The incident is classified as an unauthorized access and disclosure involving electronic medical records, and it affected 6,050 individuals.
According to UCLA Health’s own notice and a breach notification filed with the California Attorney General, UCLA Health discovered on July 2nd, 2026, that patient information had been accessed and disclosed to an outside healthcare provider in a manner inconsistent with its HIPAA policies. The unauthorized disclosures occurred between December 27th, 2024, and April 21st, 2026 — a window of approximately 16 months. This was not an external cyberattack; it centered on improper internal access and disclosure. UCLA Health stated it has not identified any evidence that the information was further disclosed or misused. Exposed data included names, dates of birth, health insurance information, and clinical information such as referral orders. For a limited number of individuals, the last four digits of their Social Security numbers were also included. UCLA Health is offering affected individuals 12 months of complimentary Experian IdentityWorks credit monitoring, with an enrollment deadline of October 31st, 2026.
UCLA Health has a documented history of prior data security incidents. In 2015, a major cyberattack exposed data of approximately 4.5 million patients and staff, resulting in a $7.5 million class-action settlement. Also in 2015, a stolen unencrypted laptop exposed 1,242 patient records. In January 2023, UCLA Health notified approximately 94,000 individuals that analytics tracking tools on its website and mobile app may have captured and shared appointment request data with third-party service providers. As of August 2026, at least two law firms — Dapeer Law, P.A. and The Lyon Firm — have publicly announced investigations into potential class action lawsuits related to this incident. No filed class action complaint specific to this breach has been confirmed.
Key Facts at a Glance
- Company or Organization: University of California Los Angeles Health
- Industry: Healthcare Provider (Academic Medical System)
- Location: Los Angeles, California
- Incident type: Unauthorized Access/Disclosure
- Date of breach: December 27th, 2024
- Date breach discovered: July 2nd, 2026
- Date of consumer notification: August 4th, 2026
- Total persons affected: 6,050
- Identity theft protection offered: 12 months of complimentary Experian IdentityWorks credit monitoring
- Enrollment deadline: October 31st, 2026
- Prior breach: Yes — 2015 cyberattack (approx. 4.5 million individuals; $7.5 million settlement), 2015 stolen laptop (1,242 individuals), and 2023 tracking pixel incident (approx. 94,000 individuals)
- Litigation status: Class action investigations announced by Dapeer Law, P.A. and The Lyon Firm; no filed complaint confirmed as of August 2026
- Source: HHS Office for Civil Rights Breach Portal, UCLA Health Official Notice, HIPAA Journal, Dapeer Law, The Lyon Firm
What Should You Do?
If you received a notice from UCLA Health, enroll in the complimentary Experian IdentityWorks credit monitoring before the October 31st, 2026 deadline. You should also consider placing a fraud alert or credit freeze with the three major credit bureaus — Equifax, Experian, and TransUnion — and monitor your credit reports regularly through AnnualCreditReport.com. Because health insurance information and clinical data were involved, review your Explanation of Benefits statements and request copies of your medical records to check for any unfamiliar charges or services. If you spot signs of identity theft, report them at IdentityTheft.gov.
Your Legal Rights
If your personal or health information was involved in this breach, you may have legal rights depending on the facts of the incident and the law in your state. Almeida Law Group represents consumers in data breach and privacy litigation and can help you evaluate whether you may have a claim. Contact us at (708) 529-5418 or through our contact page for a free case evaluation.
