Bay Area Community Health
bd_9b9eeabec9b21f90 · schema v1 · pii pii-v1
Full breach record for Bay Area Community Health →Bay Area Community Health notified patients of a data breach involving a third-party vendor, TriZetto, which works with their electronic medical record system (OCHIN). An unauthorized individual gained access to TriZetto's systems. The breach window is listed as November 1, 2024, to October 2, 2025. Bay Area Community Health was notified on December 15, 2025. Affected data may include names, social security numbers, dates of birth, contact information, and health-related or insurance information. The organization is working with OCHIN to ensure security measures are in place and reviewing its own processes.
Source provenance
- Source URL
- https://oag.ca.gov/ecrime/databreach/reports/sb24-617255
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Jan 16, 2026
- Raw hash
- 20de045f9f8c3db1107d39628f06f7fee366546853dbf6b6e73384466ab92f52
Reporting entity
- Name
- Bay Area Community Healthnorm: bay area community health
Victim entity
- Name
- Bay Area Community Healthnorm: bay area community health
Incident
- Discovered
- Dec 15, 2025
- Materiality determined
- —
- Notification sent
- Jan 5, 2026
- Affected individuals
- Not disclosed
- Data types
- PHIIDENTITY_GOVERNMENTIDENTITY_BASICHEALTH_BASIC
- Attack vector
- Third-Party / Supply Chain
- MITRE ATT&CK
- T1195 Supply Chain Compromise
- Threat actor
- External
- Third party
- via TriZetto
- Initial access
- supply_chain
Compliance
- Time to disclose
- 5 weeks(32 days from discovery to filing)
- Compliance flags
- CA 60-day OK · 21dCA AG copy ≤15d · 11d
- Discovery-date grounding
- letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
- Clock breakdown
Statute Window Elapsed Threshold Status California Discovered: Dec 15, 2025→ Notified: Jan 5, 202621d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK California Consumers notified: Jan 5, 2026→ AG copy submitted: Jan 16, 202611d 15 calendar days CA AG copy ≤15d
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.