Covenant Health, Inc.

Covenant Health, Inc., also known as Covenant HealthCare, is a healthcare provider headquartered in the United States. The organization delivers medical services to patients, including inpatient hospital care, outpatient clinic visits, and diagnostic testing. It manages a broad range of personal health information, such as names, dates of birth, medical record numbers, Social Security numbers, health insurance details, and treatment data. This information is collected, stored, and transmitted to support clinical decision‑making, billing, and administrative operations. Covenant Health serves individuals residing in its geographic service area, providing care across multiple facilities. As a health system, it offers integrated care options to the communities it serves. The provider’s mission centers on improving health outcomes while maintaining compliance with applicable healthcare laws. Its operations are subject to federal privacy standards, notably the Health Insurance Portability and Accountability Act (HIPAA).

In May 2025, Covenant Health detected unusual activity in its IT environment and confirmed that an unauthorized third party had accessed its network and exfiltrated patient data affecting up to 478,188 individuals. The compromised data included names, dates of birth, medical record numbers, Social Security numbers, health insurance details, and treatment information. The Qilin ransomware group claimed responsibility for the incident, alleging the theft of numerous files. After initial regulator notifications indicated a smaller impact, further analysis revealed the larger scale, prompting the organization to mail breach notices and offer complimentary credit monitoring and identity theft protection. A prior incident in May 2021 involved unauthorized access to two employee email accounts, exposing personal data of approximately 45,000 patients and employees. That breach was discovered months later, leading to a forensic review, mailed notifications to affected parties, and a public notice posted on the organization’s website. Both events highlight the organization’s role as a custodian of extensive protected health information and the ongoing challenges health entities face in securing digital assets. Headquartered in the United States, Covenant Health operates within the U.S. healthcare sector, though its exact ownership structure is not detailed in the publicly available sources.