Skip to content

Trinity Health

Disclosed Mar 13, 20266 months ago5,905 affectedConfirmed

Official notice

The business associate (BA), Trinity Health, reported that an employee impermissibly forwarded work-related information containing the protected health information (PHI) of 5,905 individuals. The PHI involved included demographic, clinical, and financial information. The BA notified HHS, the affected individuals, the media, and provided substitute notice. In response to the breach, the BA provided complimentary credit monitoring services to the affected individuals and implemented additional technical safeguards to better protect PHI.

What is known

People affected5,905 (as reported to HHS)
DisclosedMar 13, 2026
AttackInsider
Data exposedNames, Health
SectorHealthcare · US
StatusConfirmed

Sources

Source
HHS OCR breach report: Trinity Health (Business Associate, MI)ocrportal.hhs.gov · Official notice
Vermont Attorney General: 2026-03-13 Trinity Health Data Breach Notice to Consumersago.vermont.gov · Official notice

Notices filed

WhereFiledPeople
HHS OCRtotalMar 132,740
Vermont AGresidents of VTMar 13
HHS archivetotalMay 135,905

Other breaches at Trinity Health

BreachAffected
Disclosed Aug 29, 2022Aug 29, 20224 years agoHacking47K
Disclosed Sep 14, 2020Sep 14, 20206 years agoHacking3.3M
History of this record
  • 2026-09-25 · records: 2740 to 5905 · backfill source
  • 2026-09-25 · summary: empty to The business associate (BA), Trinity Health, reported that an employee impermissibly forwarded work-related information containing the protected health information (PHI) of 5,905 individuals. The PHI involved included demographic, clinical, · backfill source
  • 2026-09-25 · source: empty to https://ago.vermont.gov/document/2026-03-13-trinity-health-data-breach-notice-consumers · backfill source
  • 2026-09-25 · added · backfill source

First seen 2026-09-25 (HHS OCR), confirmed by HHS OCR. Record counts are as reported. Not legal advice.

Everything about Trinity Health

New breaches by email

Wednesdays, only in weeks with newly disclosed breaches, the largest first.

Double opt-in. Unsubscribe any time.