Bay Area Community Health
Disclosed Jan 16, 20268 months ago9,912 affectedConfirmed
The covered entity (CE), Bay Area Community Health, reported that a subcontractor of its business associate (BA) experienced a cyber-attack that affected the protected health information (PHI) of 9,912 individuals. The PHI involved clinical and demographic information. The CE and notified HHS, affected individuals, and the media, and the subcontractor will also be notifying individuals on the CE’s behalf. OCR provided technical assistance regarding the HIPAA Rules.
What is known
| People affected | 9,912 (as reported to HHS) |
|---|---|
| Disclosed | Jan 16, 2026 |
| Happened | Nov 1, 2024 |
| Attack | Hacking |
| Data exposed | Names, Health |
| Sector | Healthcare · US |
| Status | Confirmed |
Sources
| Source | |
|---|---|
| California Attorney General breach notice: Bay Area Community Healthoag.ca.gov · Official notice | Official notice |
| HHS OCR breach report (archive, resolved): Bay Area Community Health (Healthcare Provider, CA)ocrportal.hhs.gov · Official notice | Official notice |
Notices filed
| Where | Filed | People |
|---|---|---|
| California AGresidents of CA | Jan 16 | |
| HHS archivetotal | Jan 16 | 9,912 |
History of this record
- 2026-09-25 · attack: unknown to hacking · backfill source
- 2026-09-25 · data_types: [] to ["names","health"] · backfill source
- 2026-09-25 · records_basis: empty to hhs · backfill source
- 2026-09-25 · records: empty to 9912 · backfill source
- 2026-09-25 · summary: empty to The covered entity (CE), Bay Area Community Health, reported that a subcontractor of its business associate (BA) experienced a cyber-attack that affected the protected health information (PHI) of 9,912 individuals. The PHI involved clinical · backfill source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.