University of Miami

# University of Miami Healthcare Data Breach Report ## Incident Overview On July 29, 2025, the University of Miami reported a significant data breach involving unauthorized access to its Electronic Medical Record (EMR) system. The breach compromised the protected health information (PHI) of approximately 2,928 individuals who received care through University of Miami healthcare facilities. This incident represents a serious violation of patient privacy and triggers mandatory notification requirements under the Health Insurance Portability and Accountability Act (HIPAA). The unauthorized access occurred within the institution's electronic medical record infrastructure, a critical system containing some of the most sensitive patient health information. ## Discovery and Response Timeline The University of Miami discovered the unauthorized access to its EMR system and initiated an immediate investigation to determine the scope and nature of the breach. Upon discovery, the institution took steps to secure the affected systems and prevent further unauthorized access. The organization notified affected individuals as required by HIPAA Breach Notification Rule, which mandates notification without unreasonable delay and no later than 60 calendar days after discovery of a breach affecting unsecured PHI. The submission date of July 29, 2025, indicates the breach was reported to the Department of Health and Human Services (HHS) Office for Civil Rights (OCR) within the required timeframe. The University of Miami's response included a comprehensive investigation to identify all affected individuals and the specific data elements that may have been accessed. ## Breach Mechanics and Technical Details The breach involved unauthorized access to the Electronic Medical Record system, which typically houses comprehensive patient health information including clinical notes, test results, medication histories, and treatment plans. EMR systems are frequently targeted by threat actors because they contain consolidated, high-value patient data that can be exploited for identity theft, insurance fraud, or sold on underground markets. The unauthorized access classification suggests that an individual or group gained entry to the system without proper authorization, potentially through compromised credentials, exploitation of system vulnerabilities, or inadequate access controls. Unlike theft or loss incidents, unauthorized access breaches often indicate either an insider threat or external compromise of system security. The fact that no business associate was involved suggests the breach originated from within University of Miami's own infrastructure or systems rather than through a third-party vendor relationship. ## Organizational Context The University of Miami is a major private research university located in Miami, Florida, with significant healthcare operations through its Miller School of Medicine and affiliated clinical facilities. The institution operates multiple healthcare delivery points serving the South Florida region, including hospital facilities, outpatient clinics, and specialty care centers. As an academic medical center, University of Miami provides comprehensive healthcare services ranging from primary care to complex specialty and surgical services. The organization maintains extensive electronic health information systems to support patient care, research, and administrative functions across its healthcare enterprise. The breach's impact on a university-affiliated healthcare system is particularly significant given the institution's role as a major regional healthcare provider and its responsibility to protect patient information across multiple clinical settings. ## Patient Impact and Affected Population Approximately 2,928 individuals were affected by this unauthorized access incident. These patients likely include individuals who received care at University of Miami healthcare facilities during a specific timeframe when the unauthorized access occurred. The affected population may span various patient demographics and clinical specialties served by the institution's healthcare operations. Each affected individual received notification of the breach in accordance with HIPAA requirements, informing them of the unauthorized access, the types of information potentially compromised, and recommended protective measures. The notification process included information about the breach discovery, the University of Miami's response, and guidance on steps patients should take to monitor their health and financial information for potential misuse. ## Exposed Protected Health Information Given the breach location within the Electronic Medical Record system, the following categories of protected health information may have been accessed: - **Patient Demographics**: Names, addresses, dates of birth, contact information - **Medical Record Numbers**: Unique identifiers used within the healthcare system - **Clinical Information**: Medical histories, diagnoses, treatment plans, and clinical notes - **Laboratory and Imaging Results**: Test results, imaging reports, and diagnostic findings - **Medication Information**: Prescription histories, medication lists, and dosing information - **Insurance Information**: Health insurance policy numbers and coverage details - **Social Security Numbers**: Potentially included in patient registration records - **Financial Information**: Billing records and payment information - **Psychological or Behavioral Health Data**: Mental health records if applicable to affected patients The specific combination of data elements exposed depends on the scope of the unauthorized access and which EMR records were compromised during the incident. ## HIPAA Compliance and Regulatory Context This breach triggers obligations under the HIPAA Breach Notification Rule (45 CFR §§ 164.400-414), which requires covered entities to notify affected individuals, the media, and the HHS Secretary when unsecured PHI is accessed without authorization. The University of Miami, as a covered entity under HIPAA, must demonstrate that it conducted a thorough risk assessment to determine whether the unauthorized access constitutes a reportable breach. The fact that the breach was reported to HHS OCR indicates that the risk assessment concluded the breach posed a significant risk of harm to affected individuals. Unauthorized access incidents to EMR systems are among the most common breach types reported in healthcare, accounting for a substantial portion of annual breach notifications. These incidents often result from inadequate access controls, insufficient monitoring of system activity, or exploitation of security vulnerabilities.

# University of Miami Healthcare Data Breach Report ## Incident Overview The University of Miami, a major academic medical institution located in Miami, Florida, experienced an unauthorized access incident involving its email systems in late 2022. The breach resulted in the exposure of protected health information (PHI) belonging to approximately 973 individuals. The breach was formally reported to the U.S. Department of Health and Human Services Office for Civil Rights on December 22, 2022, indicating that the institution discovered and investigated the unauthorized access to email accounts containing sensitive patient and employee health information. This incident represents a significant security event for the institution's healthcare operations and affected patients who had entrusted their medical information to the university's care. ## Discovery and Response Timeline The University of Miami identified the unauthorized access to its email systems through its security monitoring and incident response procedures. Upon discovery, the institution initiated a comprehensive investigation to determine the scope of the breach, identify which individuals were affected, and assess what specific information may have been accessed or disclosed. The institution worked to secure affected email accounts, implement remedial measures to prevent further unauthorized access, and prepare notifications for affected individuals as required under the Health Insurance Portability and Accountability Act (HIPAA). The submission date of December 22, 2022, indicates the institution met its obligation to report the breach to HHS within 60 days of discovery, as mandated by HIPAA Breach Notification Rule requirements. ## Technical Details of the Breach The breach occurred through unauthorized access to email systems, which typically indicates either compromised credentials, exploitation of email server vulnerabilities, or successful phishing attacks that allowed threat actors to gain access to legitimate user accounts. Email systems are particularly valuable targets for healthcare data breaches because they often contain unstructured data including patient communications, medical records, appointment information, billing details, and other sensitive health information that may not be encrypted or subject to the same access controls as dedicated electronic health record (EHR) systems. The fact that no business associate was involved suggests this was a direct compromise of the University of Miami's own infrastructure rather than a third-party vendor incident. Email-based breaches typically allow attackers extended access periods before detection, as email accounts can be monitored for sensitive information over time, and forwarding rules can be established to exfiltrate data without triggering immediate alerts. ## Organizational Context The University of Miami is a private research university with a significant healthcare presence in South Florida, operating through its Miller School of Medicine and affiliated healthcare facilities. The institution provides clinical services, conducts medical research, and trains healthcare professionals, making it a repository for substantial amounts of patient health information. As an academic medical center, the University of Miami maintains electronic health records for patients seen at its clinics, hospitals, and specialty care centers throughout the Miami-Dade County region and beyond. The institution's size and complexity, combined with its role as a teaching hospital and research facility, means it manages health information for thousands of patients and maintains extensive email communications related to patient care, clinical research, and healthcare operations. ## Impact on Affected Individuals Approximately 973 individuals were affected by this breach, representing patients and potentially employees whose health information was accessible through compromised email accounts. The individuals affected may have included patients who received care at University of Miami healthcare facilities, research study participants, and possibly healthcare workers whose employment health records were stored in email systems. These individuals were notified of the breach in accordance with HIPAA requirements, which mandate that covered entities notify affected individuals without unreasonable delay and no later than 60 days after discovery of a breach. The notification process would have included information about the nature of the breach, the types of information exposed, steps the institution was taking to address the incident, and recommendations for individuals to monitor their personal information and credit reports for signs of misuse. ## HIPAA Compliance and Industry Context Under the HIPAA Breach Notification Rule, healthcare organizations must notify affected individuals, the media (if more than 500 residents of a state are affected), and the HHS Secretary of any breach of unsecured PHI. Email-based breaches represent a significant category of healthcare data incidents, accounting for a substantial portion of reported breaches in the healthcare sector. These incidents often result from human factors such as credential compromise through phishing, weak password practices, or accidental misconfiguration of email forwarding and sharing settings. The University of Miami's breach falls within the medium severity range due to the number of affected individuals and the typical sensitivity of health information accessible through email systems. Healthcare organizations have increasingly implemented email security controls including multi-factor authentication, advanced threat protection, data loss prevention tools, and employee security awareness training to mitigate the risk of email-based breaches. The fact that this breach was discovered and reported demonstrates the institution's compliance with HIPAA's breach detection and notification requirements, though it also highlights the ongoing vulnerability of email systems as a vector for healthcare data exposure.