Providence Health Services, a not-for-profit healthcare system, identified a data breach involving its health information exchange vendor, Health Gorilla. The incident occurred between August 30, 2024, and December 8, 2025, but was initially disclosed and reported to regulators on August 30, 2024, by Health Gorilla.
The breach affected 22,701 individuals. Exposed data types included names, dates of birth, addresses, phone numbers, insurance information, policy numbers, emergency contacts, dates and places of service, test results, medications, diagnoses, and clinical records. Social Security numbers were not involved. Providence began mailing notification letters to affected individuals on April 9, 2026, and offered one year of free identity protection services. The company stated there is no indication that patient medical records were hacked or stolen by a third party.
Details can emerge later and consumer notices may be delayed.