One Community Health

One Community Health notified patients of a security incident involving its third-party clearinghouse, TriZetto Provider Solutions. An unauthorized individual accessed historical eligibility transaction reports containing PHI (including SSNs and health insurance info) between November 2024 and October 2, 2025. TriZetto discovered the activity on October 2, 2025, engaged Mandiant, and contained the threat. No payment card data was involved. Credit monitoring is being offered.

The covered entity (CE), One Community Health, reported that a subcontractor of its business associate (BA) experienced a hacking incident that compromised the protected health information (PHI) of 4,309 individuals. The PHI involved included demographic and clinical information. The CE notified HHS, affected individuals, the media, and published substitute notice on its website. The subcontractor notified law enforcement. OCR provided technical assistance regarding the HIPAA Breach Notification Rule.

One Community Health experienced a ransomware cyber-attack between April 19 and April 20, 2021. Abnormal activity was detected on April 20, 2021. Investigation concluded on October 6, 2021, revealing that Social Security numbers, full names, dates of birth, addresses, insurance information, diagnosis information, and treatment information were removed from the network. The organization offered one year of complimentary credit monitoring via Experian IdentityWorks and implemented enhanced cybersecurity defenses including endpoint detection and managed detection and response.

One Community Health reported a data breach to the Massachusetts Office of Consumer Affairs and Business Regulation. The breach was reported on 2021-11-22. 12 Massachusetts residents were affected. The report records the breach type as electronic.

One Community Health reported a ransomware attack occurring April 19-20, 2021, affecting 7,945 Washington residents. PHI and PII (SSN, DOB, DL) were exfiltrated. Notification sent Nov 22, 2021. Remediation included enhanced cybersecurity defenses and credit monitoring offers.

One Community Health reported a data breach to the Oregon Attorney General. The breach was reported on 2021-11-22. The breach occurred during 4/19/2021 - 4/20/2021. The breach was discovered on 10/6/2021. 39,865 individuals were affected. Notice was sent on 11/22/2021.

One Community Health (Oregon) reported to HHS OCR on 2021-11-22 a Hacking/IT Incident affecting 39,865 individuals. A cybersecurity attack compromised PHI stored on a Network Server, including names, dates of birth, driver's license numbers, Social Security numbers, diagnoses, and other treatment information. The CE notified HHS, affected individuals, and the media, and implemented additional administrative and technical safeguards in response.

One Community Health experienced a ransomware attack between April 19-20, 2021. The incident was discovered on April 20, 2021, when abnormal network activity was detected by an information systems partner. The investigation concluded on October 6, 2021, confirming the exfiltration of SSNs, names, DOBs, addresses, and PHI (diagnosis/treatment info). No identity fraud was reported. The organization engaged cybersecurity experts, isolated systems, and offered one year of Experian IdentityWorks credit monitoring.