Clinical Practices of the University of Pennsylvania Data Breach Report

Incident Overview

On June 30, 2025, Clinical Practices of the University of Pennsylvania reported a data breach affecting 1,432 individuals to the U.S. Department of Health and Human Services. The breach involved unauthorized access to and disclosure of protected health information (PHI) stored in paper records and films maintained at the organization's facilities. This incident represents a significant privacy violation under the Health Insurance Portability and Accountability Act (HIPAA) and required mandatory notification to affected patients, the media, and federal regulators within 60 days of discovery.

Discovery and Response Timeline

While the specific discovery date was not disclosed in the breach submission, the June 30, 2025 submission date indicates that Clinical Practices of the University of Pennsylvania identified the unauthorized access and initiated their breach response protocol within the required timeframe. The organization's response included a comprehensive investigation to determine the scope of the breach, identification of affected individuals, and preparation of notification materials. As a covered entity under HIPAA, the organization was obligated to conduct a thorough risk assessment to determine whether notification was required and to notify all affected individuals without unreasonable delay and in no case later than 60 calendar days after discovery of the breach.

Breach Mechanics and Specific Details

The breach involved unauthorized access to paper records and films—physical documents rather than electronic systems. This classification suggests the breach may have resulted from physical security vulnerabilities such as unsecured storage areas, missing or misfiled documents, theft of physical records, or unauthorized personnel accessing paper-based patient files. Paper and film-based breaches typically occur through one or more of the following vectors: inadequate access controls to medical records storage areas, insufficient employee training on document handling procedures, lack of surveillance or monitoring of sensitive areas, or failure to implement proper document destruction protocols. The fact that this breach affected physical media rather than networked systems indicates that Clinical Practices of the University of Pennsylvania may need to reassess its physical security infrastructure, including locked storage cabinets, restricted access areas, and inventory management systems for sensitive documents.

Organizational Context

Clinical Practices of the University of Pennsylvania operates as part of the University of Pennsylvania Health System, one of the largest academic medical centers in the United States. The organization provides clinical services across multiple specialties and maintains extensive patient records spanning decades of care. As an academic medical center, UPenn's clinical practices serve a diverse patient population including local Philadelphia residents, regional referral patients, and individuals traveling from across the country for specialized care. The organization's size and complexity—with multiple clinical locations, numerous healthcare providers, and thousands of employees—creates significant challenges in maintaining consistent physical security protocols across all facilities and departments.

Patient Impact and Notification

Approximately 1,432 individuals had their protected health information potentially compromised in this breach. The specific types of information contained in the affected paper records and films likely included names, addresses, dates of birth, medical record numbers, insurance information, and clinical notes or diagnostic imaging. Patients were notified of the breach through written correspondence sent to their last known addresses on file, as required by HIPAA Breach Notification Rule. The notification letters explained the nature of the breach, the types of information involved, steps the organization was taking to prevent future incidents, and recommended actions patients should take to protect themselves. No indication was provided that a Business Associate was involved in this breach, meaning the responsibility for notification and remediation rested entirely with Clinical Practices of the University of Pennsylvania.

HIPAA Compliance and Industry Context

Under 45 CFR §§ 164.400-414 (the HIPAA Breach Notification Rule), covered entities must notify affected individuals of breaches of unsecured PHI. Paper records and films are considered "unsecured" unless they are encrypted or destroyed, making this breach reportable. Physical security breaches of paper records represent a persistent vulnerability in healthcare organizations despite decades of HIPAA enforcement. According to HHS Office for Civil Rights data, breaches involving paper records and physical documents account for a significant percentage of reported incidents annually, often resulting from inadequate access controls, employee negligence, or theft. The University of Pennsylvania, as a major academic medical center, is subject to heightened scrutiny and has previously addressed security concerns through institutional policies and training programs. This incident underscores the ongoing challenge healthcare organizations face in protecting patient information across both digital and physical environments, particularly as organizations balance accessibility of medical records for clinical care with security requirements.