San Francisco Community Health Center (SFCHC) has disclosed a data breach involving patient health information after a cybersecurity incident at one of its vendors. Sensitive personal and insurance data may have been exposed, prompting notifications and response efforts.
San Francisco Community Health Center’s Data Breach Investigation
San Francisco Community Health Center (SFCHC) recently notified patients of a data breach involving protected health information tied to a third-party vendor. According to the notice, SFCHC was informed on December 12, 2025, by OCHIN, its business associate that supports SFCHC’s Epic electronic health record system, of a data security incident involving OCHIN’s subcontractor, TriZetto Provider Solutions, a healthcare eligibility and claims clearinghouse.
Although SFCHC’s own internal systems were not directly accessed, patient information belonging to SFCHC was involved due to unauthorized access to certain TriZetto systems. Based on information provided to SFCHC, the unauthorized access began as early as November 2024. TriZetto identified, contained, and secured the affected systems on October 2, 2025, following an investigation conducted with the assistance of cybersecurity experts.
The incident involved unauthorized access to historical eligibility reports stored on TriZetto’s web portal used for real-time health insurance eligibility verification. OCHIN became aware of the incident on December 9, 2025, and subsequently notified SFCHC, which then began its own investigation, mitigation efforts, and patient notification process.
SFCHC emphasized that it is working closely with OCHIN and TriZetto to fully understand the scope of the breach and ensure affected individuals receive accurate information. SFCHC also stated it will coordinate with TriZetto’s breach disclosure firm, Kroll Inc., to provide additional information and services to impacted patients.
Healthcare-related breaches are particularly concerning due to the sensitivity of medical and insurance data. At Class Action U, we believe patients deserve transparency and accountability when trusted healthcare providers and their vendors fail to safeguard private information.
When Did This Breach Occur?
-
Unauthorized Access Began: November 2024
-
Incident Contained: October 2, 2025
-
OCHIN Notified: December 9, 2025
-
SFCHC Notified: December 12, 2025
What Information Was Breached?
No payment card, bank account, or other financial account information was involved.
What You Can Do
If you received a notice from SFCHC, consider taking the following steps to protect yourself:
-
Review Health Insurance Statements: Check explanation of benefits (EOBs) for unfamiliar services or charges.
-
Contact Your Health Plan: Report any suspicious or incorrect activity immediately.
-
Monitor Credit Reports: Request your free annual credit reports and review them for unusual activity.
-
Keep Medical Records: Maintain copies of medical and insurance records for reference.
-
Stay Alert for Identity Theft: Watch for signs of fraud involving your personal or insurance information.
If you are unsure what steps to take next or want help understanding your legal rights, Class Action U is here to support you.
File a Data Breach Lawsuit Against San Francisco Community Health Center
If your personal or health information was exposed in the SFCHC data breach, you may be eligible to pursue compensation through a class action lawsuit. Even when a breach occurs through a vendor, healthcare providers can still be held accountable for failing to protect patient data.
Exposure of Social Security numbers and health insurance information can create long-term risks, including identity theft and medical fraud. Legal action allows affected individuals to seek accountability and demand stronger data protection practices.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
