St. Luke's Cornwall Hospital

The covered entity (CE), St. Luke’s Cornwall Hospital, reported that a USB thumb drive was stolen that contained the electronic protected health information (ePHI) of 29,156 individuals. The ePHI involved included names, radiographic information, and other treatment information. The CE notified HHS, affected individuals, the media, and provided substitute notice on its website. Following the breach, the CE sanctioned the responsible employee and strengthened its technical and security safeguards.