Cleveland Clinic Foundation
Disclosed Dec 14, 20187 years ago604 affectedConfirmed
Cleveland Clinic Foundation, the covered entity (CE), reported that a password-protected and encrypted hard drive was lost or misplaced. The hard drive contained the protected health information (PHI) of 604 individuals. The PHI involved included names, addresses, Social Security numbers, and treatment information. The CE notified HHS, affected individuals, and the media. The CE also conducted an exhaustive search in an effort to locate the missing hard drive. In its mitigation efforts, the CE sanctioned the responsible employee and implemented additional administrative safeguards to better protect its data.
What is known
| People affected | 604 (as reported to HHS) |
|---|---|
| Disclosed | Dec 14, 2018 |
| Happened | Feb 23, 2018 |
| Attack | Lost or stolen device |
| Data exposed | Names, Health |
| Sector | Healthcare · US |
| Status | Confirmed |
Sources
| Source | |
|---|---|
| Indiana Attorney General 2019 data breach report: Cleveland Clinic Foundationin.gov · Official notice | Official notice |
| HHS OCR breach report (archive, resolved): Cleveland Clinic Foundation (Healthcare Provider, OH)ocrportal.hhs.gov · Official notice | Official notice |
Notices filed
| Where | Filed | People |
|---|---|---|
| Indiana AGresidents of IN | Dec 14, 2018 | 2 |
| HHS archivetotal | Aug 19, 2019 | 604 |
History of this record
- 2026-09-25 · attack: unknown to lost-device · backfill source
- 2026-09-25 · data_types: [] to ["names","health"] · backfill source
- 2026-09-25 · records_basis: organization to hhs · backfill source
- 2026-09-25 · records: 104 to 604 · backfill source
- 2026-09-25 · summary: empty to Cleveland Clinic Foundation, the covered entity (CE), reported that a password-protected and encrypted hard drive was lost or misplaced. The hard drive contained the protected health information (PHI) of 604 individuals. The PHI involved in · backfill source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (Indiana AG), confirmed by Indiana AG. Record counts are as reported. Not legal advice.