St. Luke's Cornwall Hospital
Disclosed Dec 30, 201510 years ago29,156 affectedConfirmed
The covered entity (CE), St. Luke’s Cornwall Hospital, reported that a USB thumb drive was stolen that contained the electronic protected health information (ePHI) of 29,156 individuals. The ePHI involved included names, radiographic information, and other treatment information. The CE notified HHS, affected individuals, the media, and provided substitute notice on its website. Following the breach, the CE sanctioned the responsible employee and strengthened its technical and security safeguards.
What is known
| People affected | 29,156 (as reported to HHS) |
|---|---|
| Disclosed | Dec 30, 2015 |
| Attack | Lost or stolen device |
| Data exposed | Names, Health |
| Sector | Healthcare · US |
| Status | Confirmed |
Sources
| Source | |
|---|---|
| HHS OCR breach report (archive, resolved): St. Luke's Cornwall Hospital (Healthcare Provider, NY)ocrportal.hhs.gov · Official notice | Official notice |
Notices filed
| Where | Filed | People |
|---|---|---|
| HHS archivetotal | Dec 30, 2015 | 29,156 |
History of this record
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (HHS archive), confirmed by HHS OCR. Record counts are as reported. Not legal advice.