UCHealth, the Colorado health system, is mailing letters to about 129,000 people after someone got into two employee accounts in its Microsoft cloud system and may have taken files stored there. UCHealth says its electronic health record was not accessed. The files were the issue: documents sitting in the cloud side of everyday work accounts. Every medical and dental practice that runs on Microsoft 365 has the same kind of files in the same kind of place, which is why this one is worth a staff meeting.
What UCHealth has said
In a notice dated November 13, 2026, also issued as a press release, UCHealth says that "on July 27, 2026, UCHealth discovered that an unauthorized third party gained access to two employee accounts in UCHealth's Microsoft cloud system." It says it launched an internal investigation, secured the affected accounts and environment, and notified law enforcement.
According to the notice, the investigation "determined that the unauthorized activity was limited to certain services within the cloud system and that the unauthorized third party may have acquired certain files stored there. Importantly, UCHealth's electronic health record was not accessed." Depending on the person, the files may include name, Social Security number, driver's license number, health information and billing information.
UCHealth says its security team and outside experts "have monitored for any subsequent leak or use of this data and have not found any evidence that it was inappropriately used or further disclosed." It is mailing letters to about 129,000 people "for whom it has a valid address," says its review "remains ongoing," and is offering a one-year Medical Shield Total membership to people whose Social Security or driver's license numbers were involved.
What we are not claiming: UCHealth hasn't said how the attacker got into the two accounts, so we are not saying it was phishing, a stolen password, a missing MFA setting or anything else. We are not saying this was ransomware, that any systems went down, or that patient data has been misused; UCHealth says it has found no evidence of misuse or further disclosure. The 129,000 figure is UCHealth's count of letters to people with valid addresses, and its review is still going. Which data was involved varies by person.
Why this matters to medical and dental practices
When practices think about protecting patient data, they usually think about the EHR or practice-management system. That system has its own logins, audit trails and vendor security. But patient information also ends up in Outlook, OneDrive, SharePoint and Teams: referral letters, insurance spreadsheets, scanned intake forms, billing exports, a front-desk "temp" folder that has been there for six years. UCHealth's notice is a reminder that two ordinary work accounts can be enough to reach files with Social Security numbers and health information, even when the EHR isn't touched.
The other detail worth noticing is the gap between July 27 and November 13. Working out which files were in an account and whose information is in them takes months when nobody knows what's stored where. A small practice with a clean, organized Microsoft 365 tenant will get through that review much faster than one with years of unsorted attachments.
What to do this week
- Require MFA on every Microsoft 365 account. That includes doctors, part-time staff, the billing contractor and shared mailboxes people log into directly. Prefer an authenticator app or security key over text messages.
- Turn on and check sign-in logs. Ask your IT provider to review Microsoft 365 sign-ins for logins from unusual countries, impossible travel and new devices, and to set alerts for them.
- Find patient data outside the EHR. Search OneDrive, SharePoint and mailboxes for exported reports, intake scans and spreadsheets with Social Security or insurance numbers. Move what you need into the right system and delete what you don't.
- Clean up sharing and old accounts. Remove "anyone with the link" sharing on folders with patient files, and disable accounts for people who have left.
- Look for mailbox rules and connected apps. Attackers in email accounts often add forwarding rules or grant permissions to outside apps. Have your provider check every mailbox, not just the ones you suspect.
- Write down who calls whom. If a staff account is compromised, know who resets it, who checks what it touched, and who decides whether patients and regulators need to be told.
The takeaway for IT decision-makers
Your patient data isn't only in the EHR. It's in the email and cloud storage your staff use every day, and those accounts are a target on their own. You can't control how a large health system secures its tenant, but you can make sure your own practice has MFA everywhere, someone watching sign-ins, and far less patient data sitting in inboxes and shared folders than it does today.
Sources
- UCHealth: UCHealth Notifies Individuals of Data Security Incident (Nov 13, 2026; checked Nov 14, 2026)
- GlobeNewswire: UCHealth Notifies Individuals of Data Security Incident (Nov 13, 2026, 2:09pm ET)