University of New Mexico Health Sciences Center

Anomalous activity occurred on a single computer server utilized to support clinical trial programs at the covered entity (CE), the University of New Mexico Cancer Center. The University of new Mexico is a component of the University of New Mexico Health Sciences Center. The electronic protected health information (ePHI) included the names, addresses, dates of birth, phone numbers, patient identification numbers, and/or social security numbers of approximately 2,365 individuals. Upon discovering the breach, the CE followed its investigative procedures. The CE provided breach notifications to HHS, affected individuals, and the media. The CE improved physical security and retrained staff. OCR obtained assurances that the CE implemented the corrective actions listed.