Providence, a not-for-profit healthcare system, experienced a data breach related to a third-party vendor, Health Gorilla. The incident involved Health Gorilla's exchange environment and was not a direct hack of Providence's core systems. The breach occurred between August 30, 2024, and December 8, 2025. Providence began sending consumer notification letters on April 9, 2026, and also offered one year of identity protection through IDX.
The breach affected approximately 22,701 individuals in the U.S. Exposed data included name, date of birth, address, phone number, insurance information/policy number, emergency contact details, dates and places of service, test results, medications, diagnoses, and other clinical records. No Social Security numbers, financial account data, or medical billing information were reported as exposed. The breach was disclosed to the U.S. Department of Health and Human Services and the California Attorney General.
Additional details about the incident, such as specific state-by-state affected counts, are not yet publicly available. Consumers should be aware that notifications can be delayed.