Providence Data Breach Exposes Sensitive Info of 22,701 Patients

Providence, a not-for-profit healthcare system headquartered in Renton, Washington, disclosed a potential compromise of patient data involving Health Gorilla, a health information exchange (HIE) vendor. The incident affected approximately 22,701 individuals in the United States, including 838 residents of Washington.

Many healthcare organizations, including Providence, participate in electronic health information exchanges. These networks allow different healthcare providers to securely share certain patient data to improve care coordination, quality and efficiency.

Health Gorilla manages these connections and was responsible for linking Providence's electronic health record system called Epic.

On Feb. 11, 2026, Providence was notified of a problem related to how some patient information was potentially being accessed and shared by certain participants in the exchange. The issue involved data exchange activity that took place between Aug. 30, 2024, and Dec. 8, 2025.

The types of protected health information that may have been exposed included full name, date of birth, address, phone number, insurance information and policy number, emergency contact information, dates of service, places of service, test results, medications, diagnoses and other clinical records used by care teams.

Social Security numbers were not included in the exposed information.

The breach was disclosed to the U.S. Department of Health and Human Services and to the California Attorney General starting on Jan. 16, 2026. Providence began mailing notification letters to consumers on April 9, 2026.

Providence's response to the breach

Providence is offering affected individuals one year of free identity protection services through IDX at no cost. To enroll, individuals can visit the IDX enrollment website or call 1-888-202-1558. IDX representatives are available Monday through Friday from 6 a.m. to 6 p.m. Pacific Time, excluding holidays.

The enrollment deadline for the free identity protection services is July 9, 2026. The identity protection membership includes credit monitoring, which must be activated separately to take effect, according to the notification.