Providence (Health Gorilla) data breach

Clerk's notes

A data security incident involving Providence, in conjunction with Health Gorilla, was formally reported to the Washington Attorney General on April 16, 2026. The specifics of how the breach occurred remain under analysis, but the filing indicates a compromise of patient data. The current status of the investigation is monitoring by the Attorney General's office.

The reported exposed data categories include Full Name, Date of Birth, Social Security Number, Medical Record Number, Health Insurance ID Number, Diagnosis and Treatment Information, Prescription Information, and Provider and Treatment Dates. This combination of identifying and deeply personal health details carries significant risks for affected individuals.

Exposure of such comprehensive medical and personal information can lead to medical identity theft, where unauthorized parties might use compromised details to obtain medical services in another person's name. This can corrupt official health records and lead to serious errors in future care. Furthermore, the exposure of Social Security Numbers and other identifiers increases the risk of financial fraud and targeted phishing schemes.

As healthcare entities handling sensitive patient data, Providence and Health Gorilla are obligated under federal laws like HIPAA and Washington state regulations to implement robust security measures. The occurrence of this data breach raises questions regarding the sufficiency of the safeguards in place to protect patient confidentiality and personal data integrity.

If you have received a notification letter from Providence or Health Gorilla concerning this data breach, it is important to understand your rights. This letter formally confirms that your confidential information was compromised in the incident. Receiving such a notice establishes the foundation for considering your legal options.

Our firm is actively evaluating the Providence (Health Gorilla) data breach. We are offering free case reviews for individuals affected by this incident. There is no out-of-pocket cost to you, and we only recover attorney's fees if we successfully secure a recovery.

If a notification letter about this breach reached you, see every Washington data breach on file or browse all cases.