One Community Health

The covered entity (CE), One Community Health, reported that a subcontractor of its business associate (BA) experienced a hacking incident that compromised the protected health information (PHI) of 4,309 individuals. The PHI involved included demographic and clinical information. The CE notified HHS, affected individuals, the media, and published substitute notice on its website. The subcontractor notified law enforcement. OCR provided technical assistance regarding the HIPAA Breach Notification Rule.

Affected (this filing): 4,309

One Community Health notified patients of a security incident involving its third-party clearinghouse, TriZetto Provider Solutions. An unauthorized individual accessed historical eligibility transaction reports containing PHI (including SSNs and health insurance info) between November 2024 and October 2, 2025. TriZetto discovered the activity on October 2, 2025, engaged Mandiant, and contained the threat. No payment card data was involved. Credit monitoring is being offered.