OnePoint Patient Care
Disclosed Oct 14, 20241 year ago1,741,152 affectedConfirmed
The covered entity (CE), OnePoint Patient Care, reported that it experienced a hacking attack that compromised the protected health information (PHI) of 1,741,152 individuals. The PHI involved included names, social security numbers, addresses, diagnoses/conditions, medications, treatment information, and other identifiers. The CE notified HHS, affected individuals and the media. In response to the breach and OCR’s investigation, the CE has updated its technical safeguards. OCR also provided technical assistance to the CE regarding the HIPAA Security Rule.
What is known
| People affected | 1,741,152 (as reported to HHS) |
|---|---|
| Disclosed | Oct 14, 2024 |
| Discovered | Aug 8, 2024 |
| Happened | Aug 3, 2024 |
| Attack | Ransomware |
| Data exposed | Names, Health |
| Sector | Healthcare · US |
| Status | Confirmed |
Sources
| Source | |
|---|---|
| California Attorney General breach notice: OnePoint Patient Careoag.ca.gov · Official notice | Official notice |
| Washington Attorney General breach notice: OnePoint Patient Careatg.wa.gov · Official notice | Official notice |
| Oregon DOJ breach notice: OnePoint Patient Carejustice.oregon.gov · Official notice | Official notice |
| HHS OCR breach report (archive, resolved): OnePoint Patient Care (Healthcare Provider, AZ)ocrportal.hhs.gov · Official notice | Official notice |
Notices filed
| Where | Filed | People |
|---|---|---|
| HHS archivetotal | Oct 14, 2024 | 1,741,152 |
| California AGresidents of CA | Oct 23, 2024 | |
| Washington AGresidents of WA | Oct 23, 2024 | 34,394 |
| Oregon DOJresidents of OR | Oct 23, 2024 | 795,916 |
| California AGresidents of CA | Nov 22, 2024 | |
| Oregon DOJresidents of OR | Nov 22, 2024 | 1,741,152 |
| California AGresidents of CA | Feb 6, 2025 | |
| Oregon DOJresidents of OR | Feb 6, 2025 | 93,672 |
History of this record
- 2026-09-25 · data_types: [] to ["names","health"] · backfill source
- 2026-09-25 · records_basis: empty to hhs · backfill source
- 2026-09-25 · records: empty to 1741152 · backfill source
- 2026-09-25 · disclosed: 2024-10-23 to 2024-10-14 · backfill source
- 2026-09-25 · summary: empty to The covered entity (CE), OnePoint Patient Care, reported that it experienced a hacking attack that compromised the protected health information (PHI) of 1,741,152 individuals. The PHI involved included names, social security numbers, addres · backfill source
- 2026-09-25 · attack: unknown to ransomware · backfill source
- 2026-09-25 · discovered: empty to 2024-08-08 · backfill source
- 2026-09-25 · disclosed: 2024-11-22 to 2024-10-23 · backfill source
- 2026-09-25 · disclosed: 2025-02-06 to 2024-11-22 · backfill source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.