University of Utah Health

Disclosed Mar 21, 20203,670 affectedConfirmed

University of Utah Health, the covered entity (CE), reported that multiple employees were the subjects of an email phishing scheme affecting the protected health information (PHI) of 18,317 individuals. The PHI involved included names, birthdates, lab results, medications, and diagnoses. The CE notified HHS, affected individuals, and the media. In response to the breach, the CE implemented additional administrative, technical, and security safeguards.

What is known

People affected	3,670 (as reported to HHS)
Disclosed	Mar 21, 2020
Attack	Hacking
Data exposed	NamesHealth
Sector	Healthcare · US
Status	Confirmed

Sources

Official noticeocrportal.hhs.gov

HHS OCR breach report (archive, resolved): University of Utah Health (Healthcare Provider, UT)

Notices filed

TotalMar 21, 2020

HHS archive3,670 people

Other breaches at University of Utah Health

Hacking breachHacking exposed names and health records. Reported to the HHS archive.8,606 affectedInsuranceUSAug 15, 2023 Lost or stolen device breachLost or stolen device exposed names and health records. Reported to the HHS archive.607 affectedHealthcareUSJun 2, 2018

History of this record

Added2026-09-25

First recordedby backfillSource

First seen 2026-09-25 (HHS archive), confirmed by HHS OCR. Record counts are as reported. Not legal advice.

Everything about University of Utah Health