Corewell Health

Corewell Health is a healthcare organization that provides medical services to patients. It operates within the United States, with its headquarters situated in the United States of America. The organization collaborates with third‑party vendors to support various aspects of patient care, including communication and outreach. One such vendor is Welltok, which supplies patient communication services for Corewell Health. Through these partnerships, Corewell Health aims to improve patient engagement and streamline administrative processes. As a health‑focused entity, it adheres to applicable federal and state regulations governing patient data protection. Corewell Health emphasizes quality care and patient safety as central components of its mission. It serves patients across the communities where it operates. The organization seeks to expand access to healthcare services while maintaining high standards. Its operational activities are guided by a commitment to ethical and responsible practices.

In May 2023, a cybersecurity incident affecting Welltok, the vendor that provides patient communication services for Corewell Health, was disclosed. The breach originated from a vulnerability in the MOVEit file transfer tool used by Welltok. Approximately one million patients of Corewell Health had their personal and health information exposed. The compromised data included names, dates of birth, Social Security numbers, and health insurance details. Corewell Health reported that the vendor conducted an investigation and found no evidence of fraudulent activity resulting from the exposure. As a precautionary measure, Welltok offered credit monitoring services to the affected individuals. Corewell Health communicated the incident to patients and provided guidance on steps they could take to protect their information. The organization reiterated its commitment to safeguarding patient data and working with vendors to strengthen security controls. Following the event, Corewell Health reviewed its vendor management practices to mitigate similar risks in the future. The incident highlights the ongoing challenges healthcare organizations face in protecting sensitive information within their supply chains.