Health Gorilla Data Breach Exposes Sensitive Patient Information Health Gorilla, a Silicon Valley-based healthcare interoperability platform founded in 2014, is under investigation following a data breach that may have exposed sensitive patient information. The incident, disclosed on January 13, 2026, involved an unauthorized disclosure of health data through its health information exchange (HIE) network. The breach potentially compromised a wide range of personally identifiable information (PII) and medical records, including: - Names, dates of birth, and addresses - Driver’s license and insurance card details - Financial information - Clinical data (diagnoses, conditions, lab results, medications, and care plans) Health Gorilla reported that the data may have been accessed for treatment purposes, but investigators have not confirmed whether the requests or authorizations were legitimate. In response, the affected health organizations Mosaic, OCHIN, Reid Health, Trinity Health, and UMass Memorial Health were temporarily suspended from the HIE while the investigation continues. Class action law firm Shamis & Gentile P.A. is examining potential legal claims for affected individuals, who may be eligible for compensation. The full scope and impact of the breach remain under review.

Trinity Health Data Breach Exposes Sensitive Patient Information Trinity Health, one of the largest not-for-profit Catholic healthcare systems in the U.S., reported a data breach involving unauthorized access to sensitive patient information. The incident, discovered on January 5, 2023, occurred on December 16, 2022, and was linked to an automated Health Information Exchange (HIE). The breach stemmed from a request by Health Gorilla, an HIE member, for patient data under the guise of treatment purposes. However, Trinity Health’s HIE partner could not verify whether Health Gorilla or the recipient entities had proper authorization to access the information. Exposed data included driver’s licenses, medical records, clinical care details, insurance information, patient names, and other personally identifiable information (PII). The breach affected at least 51 individuals in Massachusetts, with potential impacts across Trinity Health’s network of 92 hospitals in 25 states. Trinity Health, headquartered in Livonia, Michigan, employs over 133,000 staff and serves millions of patients. The organization reported the breach to the Massachusetts and Vermont attorneys general in March 2026, though the delay between discovery and notification remains unclear. Legal firm Shamis & Gentile P.A. is investigating the incident, noting that affected individuals may be eligible for compensation. The breach highlights vulnerabilities in third-party data-sharing systems within healthcare.

Trinity Health Corp. experienced a data breach in January 2021 due to a vulnerability in the Accellion File Transfer Appliance, exposing sensitive patient data. The compromised information included names, addresses, emails, dates of birth, Social Security numbers, medical records (healthcare providers, services, lab results, medications, immunization types), payment details, credit card information, and claims data. Approximately 18,153 California residents were affected, leading to a $450,000 class-action settlement. Victims could claim up to $1,000 for out-of-pocket losses (e.g., identity theft, credit monitoring, card replacements) and a pro rata cash payment (ranging from $11 to $231, depending on claim participation). The breach stemmed from unauthorized access to patient files, raising concerns over inadequate data protection measures. While Trinity Health denied liability, the settlement addressed financial and reputational damages, including potential fraud risks for affected individuals.

The Maine Office of the Attorney General reported a data breach involving Trinity Health on October 23, 2020. The breach, reported to have occurred between April 18, 2020, and May 16, 2020, was due to a cyber-attack on Blackbaud's network, affecting 6,288 individuals, including at least 6 Maine residents, and compromising financial account details among other types of information.