C.A.R.E. Clinic Red Wing Data Breach 2026: 500 Minnesota Free Clinic Patients Exposed via Email Compromise. What To Do

What happened

C.A.R.E. Clinic is a volunteer-physician free clinic at 906 College Avenue in Red Wing, Minnesota (Mayo Clinic Seminary Professional Building). The clinic serves uninsured adults in Goodhue County and Lake City, founded in 2010. Operations are minimal — a Tuesday-evening clinic (4 to 8 p.m.) with 2 to 4 volunteer providers, eligibility-gated at ~275% Federal Poverty Level.

C.A.R.E. Clinic filed with HHS OCR on April 10, 2026 — Hacking/IT Incident at Email — confirming 500 affected individuals. The 500 count is exactly the HHS reporting floor and is consistent with near-total active patient panel exposure at this tiny volunteer-driven clinic.

A single compromised staff email at a one-evening-per-week clinic plausibly exposes the entire active panel.

Important entity disambiguation

There are two real “CARE Clinic” nonprofits in the US, both free clinics for uninsured adults:

1. C.A.R.E. Clinic in Red Wing, Minnesota (Goodhue County) — this filing
2. The CARE Clinic in Fayetteville, North Carolina (Cumberland County, serving Fort Liberty area, founded 1993)

Third-party legal-lead-gen sites (e.g., ClaimDepot) appear to have misidentified this OCR filing as the Fayetteville NC entity by name-matching alone, ignoring the HHS state field. The canonical state is Minnesota per the HHS OCR portal entry.

Why this page is sparse

As of mid-May 2026, no entity notice has been posted on careclinicrw.com. No HIPAA Journal, Star Tribune, or MinnPost coverage has surfaced. No Minnesota AG filing has been located. The only “coverage” is the misidentified ClaimDepot investigation page.

This is normal for a sub-1,000-individual rural free-clinic email incident — these don’t trigger major-media thresholds.

What was likely exposed

C.A.R.E. Clinic has not publicly enumerated specific PHI categories. For a free clinic providing primary care, the typical email account would contain a subset of:

• Full name, contact information, date of birth
• Health condition / diagnosis information
• Medication and prescription records
• Possibly insurance / Medicaid eligibility data

C.A.R.E. Clinic’s patient population is by definition uninsured low-income adults, so credit card and detailed financial account information is less likely to be in scope. SSN exposure is plausible but unconfirmed.

If you receive a notification letter, it will list the specific data elements involved in your case.

What to do

1. Call C.A.R.E. Clinic for guidance on whether you have been notified and what monitoring (if any) is offered.
2. Place free credit freezes at Equifax, Experian, TransUnion as a baseline precaution.
3. Watch for unfamiliar Medicaid or insurance enrollment activity in your name — uninsured-patient data is sometimes used to fraudulently enroll victims in coverage and bill claims.
4. If you are connected to volunteer or sliding-scale care networks, recognize that the breach is unlikely to be picked up by mainstream press given the clinic’s size, but the personal exposure can still be material.
5. Stop the ongoing flow of your free-clinic records. HealthConsent files HIPAA restriction requests covering safety-net and free-clinic data pathways.

Continue reading

• Your eight HIPAA rights, in plain English
• Other 2026 healthcare data breaches