A security breach of an Allegheny County-based health care boutique law firm may have compromised the personal information of more than 36,000 UPMC patients during the initial months of the COVID-19 pandemic, according to a notice on the Pittsburgh-based health care chain’s website.

Charles J. Hilton & Associates, a seven-lawyer firm whose attorneys handle billing-related legal services for hospital accounts greater than $8,000 in expected reimbursement, discovered “suspicious activity” in its employee email system in June 2020, according to UPMC’s Feb. 5 alert.