Providence
bd_86f27f95fb99cb4b · schema v1 · pii pii-v1
Full breach record for Providence →Providence notified patients of a data breach involving Health Gorilla, a health information network connected to Providence's Epic EHR system. Between August 30, 2024, and December 8, 2025, patient health information may have been accessed or shared by HIE participants without a defined business need. Providence was notified of the issue on February 11, 2026. Affected data includes names, dates of birth, addresses, insurance policy numbers, test results, medications, and diagnoses. Social Security numbers were not involved. Providence is reviewing data-sharing practices and offering one year of identity protection services.
Linked disclosures
Why this link?Regulatory filings (1) · sorted by filing gap
- bd_7401dea24e1b6896Washington State AGfiled 2026-04-16Candidate
Source provenance
- Source URL
- https://oag.ca.gov/ecrime/databreach/reports/sb24-621858
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Apr 16, 2026
- Raw hash
- 26e045e482f3dc8d874cd9dfd8982de873d5408ef54bfa2c670fc71a3f0e219c
Reporting entity
- Name
- Providence St. Joseph Health Investment Trustnorm: providence st joseph health investment
Victim entity
- Name
- Providencenorm: providence
- Domain
- providence.org
Incident
- Discovered
- Feb 11, 2026
- Materiality determined
- —
- Notification sent
- Apr 9, 2026
- Affected individuals
- Not disclosed
- Data types
- PHIHEALTH_BASICIDENTITY_BASICFINANCIAL_ACCOUNT
- Attack vector
- Third-Party / Supply Chain
- Third party
- via Health Gorilla
- Initial access
- trusted_relationship
Compliance
- Time to disclose
- 9 weeks(64 days from discovery to filing)
- Compliance flags
- CA 30-day late · 57dCA AG copy ≤15d · 7d
- Discovery-date grounding
- letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
- Clock breakdown
Statute Window Elapsed Threshold Status California Discovered: Feb 11, 2026→ Notified: Apr 9, 202657d 30 calendar days CA 30-day late California Consumers notified: Apr 9, 2026→ AG copy submitted: Apr 16, 20267d 15 calendar days CA AG copy ≤15d
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.