Trinity Health & UPMC Notify Patients About Potential Unauthorized Data Access via HIE
Trinity Health and the University of Pittsburgh Medical Center are notifying patients about potential unauthorized access to patient data by third parties via a Health Information Exchange (HIE).
Trinity Health, a not-for-profit Michigan-based Catholic health system that operates more than 92 hospitals in 22 states, has informed state attorneys general that some of its patients may have had their protected health information accessed without authorization. Trinity Health participates in automated electronic data exchanges with Health Information Exchanges (HIEs), which ensure that patient data can be easily accessed by other healthcare providers for treatment purposes, regardless of where the provider is located.
On January 13, 2026, Trinity Health was informed by its HIE partner that there had potentially been unauthorized access to the protected health information of certain Trinity Health patients. The incident involves an HIE member called Health Gorilla, which provides an interoperability platform and manages data access requests for client companies. Health Gorilla grants access to its network to companies that require access to patient data for treatment purposes. The HIE partner warned Trinity Health that Health Gorilla claimed that health information was required for treatment purposes; however, the HIE partner said it was unable to verify whether the statements made by Health Gorilla were accurate, and whether the recipient companies had authorizations for the information they obtained via the HIE.
Data potentially accessed without authorization included clinical care details, demographic information, insurance information, and potentially driver’s license numbers. Health Gorilla has suspended access to the HIE for the companies concerned. Trinity Health is providing the affected individuals with complimentary credit monitoring and identity theft protection services for 24 months. The HHS’ Office for Civil Rights was informed that the protected health information of 2,740 individuals was involved.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
University of Pittsburgh Medical Center (UPMC) patients have also been affected and are in the process of being notified about the potential unauthorized access. Data potentially accessed without a valid authorization included names, ages, diagnoses, and other information from patients’ medical histories. UPMC said it was informed about the potential unauthorized access by its electronic medical record vendor (Epic), and similarly, the unauthorized access occurred through an HIE via Health Gorilla. The incident has been reported to the HHS’ Office for Civil Rights as affecting 687 individuals.
Further healthcare providers are expected to issue similar notices in the coming days and weeks.
Legal Action Taken Over Alleged Unauthorized Access and Disclosures
Legal action is being taken over the alleged impermissible disclosures by Epic, OCHIN, and several healthcare providers who allege that Health Gorilla and others enabled “sham” companies to access their platforms to obtain patient data from national HIEs. While not stated in the breach notice, the information accessed by the sham companies may have been disclosed to third parties, such as law firms. One of the companies named as a defendant has admitted to making fraudulent claims that data was required for treatment purposes, when the data was disclosed to law firms. The lawsuit is proceeding against the other named defendants. Health Gorilla, a Qualified Health Information Network (QHIN), denies any wrongdoing, and so far, only one of the defendants has admitted wrongdoing. You can read more about the lawsuit in this post.
