California Child Care Company Discovers 9-Year Employee Data Leak

Posted by Steve Alder

A data breach has recently been announced by Child Care Resource Center that shows how even well-intentioned employee practices can result in the exposure of sensitive data. Child Care Resource Center is a California-based non-profit organization, and while it does not appear to be a HIPAA-covered entity, similar data breaches have occurred at entities subject to the HIPAA Rules.

Child Care Resource Center recently learned that one of its employees had been forwarding internal files containing personal data to an external email account. While sending emails containing internal data outside the organization could indicate data theft, in this case, Child Care Resource Center was satisfied that the files were being emailed in an effort to fulfil tasks associated with the employee’s role.

The employee had been emailing data to the external email account for many years before their actions were discovered. The investigation determined that the first instance occurred on October 4, 2016, and continued until October 15, 2025. It took until June 3, 2026, to complete the investigation and review the data involved. The affected individuals are now being notified and have been offered complimentary credit monitoring and identity theft protection services.

The breach notification letter sent to the California Attorney General does not state the exact types of data involved, nor the number of affected individuals; however, considering the practice spanned 9 years, it could be an extensive data breach. When files are forwarded to an external email account, the company loses control of the data and is unable to protect the information against unauthorized access.

In this case, the company found no evidence to suggest unauthorized data access, nor that any information had been misused. Since unauthorized data access cannot be ruled out in these circumstances, breach notifications are required. Child Care Resource Center said it has implemented additional safeguards to prevent similar incidents in the future.

Healthcare organizations can reduce the risk of incidents such as this by providing regular security awareness and HIPAA training, emphasizing the risks associated with emailing or otherwise copying data to complete work duties out of the office. Technical security measures should be configured to either block the emailing of internal data to external email accounts or, if not practical, to ensure that email security solutions are configured to flag anomalous behavior and closely monitor alerts for potential data security incidents.

The post California Child Care Company Discovers 9-Year Employee Data Leak appeared first on The HIPAA Journal.

Data Breaches Announced by Loma Linda University Health & UCLA Health

Posted by Steve Alder

Data security incidents have recently been announced by Loma Linda University Health and UCLA Health.

Loma Linda University Health

Loma Linda University Health has recently announced a data breach involving an external AI platform. The incident involved patient information from an Institutional Review Board-approved research study. During the course of the study, A dataset including limited patient information was inadvertently uploaded to an AI platform.

When the incident was identified, an investigation was launched to determine the extent of data exposure. The investigation determined that the dataset included medical record numbers, dates of birth, and limited clinical information related to orthopedic care.  The breach did not include complete treatment records, nor Social Security numbers, financial information, or insurance information.

The academic medical center said it takes the privacy and security of patient information seriously and is reviewing its policies, procedures, and workforce training on the use of external technologies such as AI platforms. The number of affected individuals has yet to be publicly disclosed.

UCLA Health

UCLA Health is notifying an unspecified number of patients about an improper disclosure of some of their personal and protected health information. According to the breach notice provided to the California Attorney General, UCLA Health determined on July 2, 2026, that patient information was accessed and disclosed to an outside healthcare provider in a manner inconsistent with its HIPAA policies.

The notice indicates that the disclosures occurred between December 27, 2024, and April 21, 2026. The investigation confirmed that the information involved was limited to names, dates of birth, health insurance information, and clinical information, such as referral orders. For a limited number of individuals, the last four digits of their Social Security numbers were also included.

UCLA Health said it has implemented additional measures to prevent similar breaches in the future, including enhanced system controls and increased monitoring. UCLA Health said it is unaware of any actual or attempted misuse of patient data as a result of the incident.

The post Data Breaches Announced by Loma Linda University Health & UCLA Health appeared first on The HIPAA Journal.