Providence Healthcare System Reports Data Breach Affecting 22,701 Individuals Providence, a faith-based, not-for-profit healthcare network based in Renton, Washington, has disclosed a data breach impacting 22,701 individuals across the U.S. The incident was reported to the U.S. Department of Health and Human Services (HHS) on January 16, 2026, as required under federal health data protection laws. Key Details of the Breach At this time, Providence has not publicly released specifics on: - The type of cyberattack (e.g., ransomware, phishing, unauthorized access). - The timeline of the breach, including when it occurred, when it was discovered, or how long unauthorized access persisted. - The types of exposed data, which may include personal or protected health information (PHI). Further details may emerge as the investigation progresses, through individual notifications, or additional disclosures from Providence. Response and Regulatory Compliance Providence filed a mandatory breach report with HHS, making the incident part of the public record. The healthcare system has not yet provided guidance on next steps for affected individuals, though those who suspect they were impacted may contact Providence directly for updates. The full scope and impact of the breach remain under review.

Providence Reports Data Breach Affecting 1,200 California Patients Due to Health Information Exchange Issue Providence, a major hospital system, disclosed a data breach on February 11, 2026, impacting approximately 1,200 patients across California. The incident stemmed from a "technology issue" within Health Gorilla, a health information exchange (HIE) platform used by Providence to share patient data with other healthcare providers for coordinated care. The breach occurred between August 30, 2024, and December 8, 2025, when certain HIE participants may have accessed or shared patient information without a legitimate business need. Providence emphasized that there was no evidence of hacking or theft by third parties, including Health Gorilla. However, exposed data could include sensitive details such as full names, dates of birth, addresses, insurance information, medical diagnoses, test results, and medications. All affected patients are being offered one year of identity protection services through IDX, with enrollment available by contacting 1-888-202-1558. Providence stated that the delay in public notification nearly a month after discovery complied with legal timelines, as the organization conducted internal investigations and arranged support services. The hospital system reiterated its commitment to patient privacy, noting ongoing reviews of data-sharing protocols and collaboration with technology partners to prevent future incidents. No further details on the specific cause of the HIE malfunction were provided.