BACH's January notice confirms a TriZetto vendor incident

Bay Area Community Health's January 5 substitute notice says the incident occurred at third-party company TriZetto, which works with its electronic-record provider OCHIN. BACH said OCHIN notified it on December 15, 2025 that an unauthorized individual had gained access to one TriZetto system.

Based on information BACH received from the two vendors, involved data may have included a name, Social Security number, date of birth, contact information, and certain health-related or insurance information. The notice expressly says not every patient's information was affected and that there was no evidence of misuse at that time.

It does not publish an affected-person count, say that BACH's own systems were accessed, establish later misuse, or support a class-action or sector-wide workforce claim. Privacy, security, and procurement leaders should use the incident as a tabletop prompt: identify every business-associate and subcontractor handoff, assign notification and evidence-preservation responsibilities, verify current vendor facts through counsel-approved channels, and test how patient questions reach the privacy office.

Workforce and communications leaders should give staff a short routing script for suspicious bills, insurer statements, or requests for personal information without naming affected people. Candidates may discuss vendor-governance controls as a de-identified scenario, not speculate about BACH.

Never place a notice, patient identifier, insurance statement, breach-response artifact, credential, vulnerability, or investigation detail in FQHC Talent.