THE CLEVELAND CLINIC FOUNDATION
ent_019e0d21fa047f6f5fbae2dfc08ccb51
Disclosures
4
State AG · HHS OCR · 4 jurisdictions
Multi-filing incidents
1
incidents joining 2+ filings here
Max affected reported
604
nationwide · HHS OCR OH
Leak-site claims
0
none in sample
Identity resolution
- Canonical name
- THE CLEVELAND CLINIC FOUNDATION
- Normalized
- the cleveland clinic— dedupe via name-norm; Microsoft / MSFT collapse to one row
- GLEIF LEI
- 5493005LGDPOFHUC6Z36
- SEC EDGAR CIK
- None — not an SEC registrant
- Domain
- my.clevelandclinic.org
Disclosure history (4)newest first
- New Hampshire State AGas victim2019-08-20
Cleveland Clinic Foundation reported the loss of an encrypted external hard drive containing patient PII (names, SSNs, DOBs) and limited PHI. The drive was lost by an employee on or after May 23, 2019. One New Hampshire resident was notified on August 19, 2019, and offered one year of credit monitoring. No evidence of improper access was found.
- Massachusetts State AGas victim2019-08-19
Cleveland Clinic Foundation reported a data breach to the Massachusetts Office of Consumer Affairs and Business Regulation. The breach was reported on 2019-08-19. 1 Massachusetts residents were affected. The report records the breach type as electronic.
- OHIOHHS OCRas victim2019-08-19
Cleveland Clinic Foundation (OH) reported to HHS on 2019-08-19 a Loss affecting 604 individuals. A password-protected and encrypted portable hard drive was lost or misplaced. PHI involved included names, addresses, Social Security numbers, and treatment information. The CE notified HHS, affected individuals, and media, conducted an exhaustive search, sanctioned the responsible employee, and implemented additional administrative safeguards.
- Illinois State AGas victim2019-01-01
CLEVELAND CLINIC FOUNDATION filed a data-breach notice with the Illinois Attorney General during 2019 (case 2019-336). The register records the breach as discovered on May 23, 2019. Illinois does not publish the number of people affected — 815 ILCS 530/10 permits the Attorney General to publish only the entity name, the types of personal information and the date range.