Noss & Russell, LLP Investigates UCLA Health Improper Access to California Patients' Medical Records
Noss & Russell, LLP is investigating a patient privacy incident at UCLA Health, one of the largest health systems in Southern California. According to notices UCLA Health began sending patients on July 20, 2026, patient medical records were accessed in a way that violated the health system's own privacy policies — and for some patients, that information was also disclosed to an outside healthcare provider. If you received one of these notices, this investigation may concern you.
UCLA Health's notices, issued by its Office of Compliance Services in Westwood, state that on July 2, 2026 the health system determined that a patient's information had been accessed in a manner inconsistent with UCLA Health policies governing protected health information.
The health system sent two versions of the notice. One tells patients their information was accessed improperly. The other tells patients their information was not only accessed but also disclosed to an outside healthcare provider. UCLA Health says it has no evidence, at this time, that the information was further used or misused beyond what it described.
According to the notices, the information involved came from patients' medical records and varied by individual. It may have included names, addresses, dates of birth, health insurance information, and clinical information such as referral orders. For some patients, it may also have included the last four digits of a Social Security number. UCLA Health states that no full Social Security numbers, financial account numbers, or payment card information were involved. The health system is offering twelve months of complimentary Experian IdentityWorks membership, with an enrollment deadline of October 31, 2026.
Several things the notices do not say are central to what the firm is examining. They do not say who accessed the records or why. They do not say how many patients were affected. And notably, each notice fills in an individual access date for each recipient — which raises the question of whether this was a single episode or access that occurred repeatedly over time before anyone caught it. The firm is investigating how the improper access happened, how long it continued, why it was not detected sooner, and how patient information came to be sent outside the health system.
WHAT HAPPENED?
wHY THIS MATTERS
A medical record is a record of a person's life. It can show a diagnosis someone has told no one about, a referral to a specialist that reveals what they are being treated for, a pregnancy, a mental health visit, a course of treatment they had every reason to believe was private.
UCLA Health claims that no financial account numbers were taken here. But that framing measures the wrong harm. The injury in a case like this is not a fraudulent charge that a bank can reverse — it is that private medical information was seen by someone who had no business seeing it, and in some instances handed to an outside provider entirely. Credit monitoring does not address that. It cannot un-share a diagnosis.
For patients who learned their records went to an outside healthcare provider, the concern is more immediate still: they are entitled to know who received their information, what was in it, and what has happened to it since.
wHO MAY BE AFFECTED
This investigation concerns UCLA Health patients — the great majority of them Californians across Los Angeles County and the surrounding region — who received a Notice of Breach of Protected Health Information dated on or about July 20, 2026 from the UCLA Health Office of Compliance Services.
Two groups of patients received notices, and the firm would like to hear from both:
-
Patients told their information was accessed in a manner inconsistent with UCLA Health policies.
-
Patients told their information was accessed and disclosed to an outside healthcare provider. If your notice contains that language, your experience is especially important to this investigation.
Your notice lists the specific date your information was accessed. That date, and the notice itself, are worth keeping.
Contact Noss & Russell, LLP
If you received a notice from UCLA Health about improper access to your medical records, Noss & Russell, LLP would like to hear from you. We are interviewing affected patients as part of an active investigation into how this happened and how far it extended.
We understand that medical privacy is exactly that — private. What you tell us stays with us. Consultations are free, confidential, and carry no obligation, and the firm handles these matters on a contingency basis: you pay nothing unless we recover compensation for you.
Matters involving public health systems can carry particularly short deadlines for taking action. If you received one of these notices, we encourage you not to wait to speak with someone.
To speak with an attorney, contact Noss & Russell, LLP at (619)678-1880 or request a consultation below.