OCHIN Inc. and Baltimore City Health Department: Baltimore City Health Department investigating data breach involving third-party system

Baltimore City Health Department Investigates Third-Party Data Breach

The Baltimore City Health Department (BCHD) is investigating a data breach involving its third-party electronic medical records system, which handles insurance and eligibility processing. The breach, linked to vendor OCHIN Inc., exposed files containing patients’ insurance eligibility verification data.

BCHD confirmed that its internal systems remain unaffected and that the incident was isolated to the third-party platform. OCHIN Inc. is collaborating with a fraud assistance provider to address the breach and will offer free credit monitoring services to impacted individuals. Notifications to affected patients are expected to begin around February 9, 2026.

A dedicated helpline (410-545-6674) has been established for inquiries. In a statement, Baltimore City Health Commissioner Dr. Michelle Taylor expressed regret over the breach, emphasizing the department’s commitment to patient privacy and vendor security compliance. BCHD is working with TriZetto and other experts to mitigate the breach’s impact and provide support to those affected.

Source: http://www.wbaltv.com/article/baltimore-city-health-department-data-breach-ochin/70112954

OCHIN, Inc. cybersecurity rating report: https://www.rankiteo.com/company/ochin

Baltimore City Health Department cybersecurity rating report: https://www.rankiteo.com/company/baltimore-city-health-department

"id": "OCHBAL1769200436",
"linkid": "ochin, baltimore-city-health-department",
"type": "Breach",
"date": "1/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"

{'affected_entities': [{'customers_affected': 'Patients (number not specified)',
                        'industry': 'Healthcare',
                        'location': 'Baltimore, Maryland, USA',
                        'name': 'Baltimore City Health Department (BCHD)',
                        'type': 'Government Health Department'},
                       {'industry': 'Healthcare IT',
                        'name': 'OCHIN Inc.',
                        'type': 'Third-Party Vendor'}],
 'customer_advisories': 'Notifications to affected patients expected to begin '
                        'around February 9, 2026; dedicated helpline '
                        '(410-545-6674) established',
 'data_breach': {'personally_identifiable_information': 'Yes',
                 'sensitivity_of_data': 'High (personally identifiable '
                                        'information related to healthcare)',
                 'type_of_data_compromised': 'Insurance eligibility '
                                             'verification data'},
 'description': 'The Baltimore City Health Department (BCHD) is investigating '
                'a data breach involving its third-party electronic medical '
                'records system, OCHIN Inc., which handles insurance and '
                'eligibility processing. The breach exposed files containing '
                'patients’ insurance eligibility verification data. BCHD '
                'confirmed that its internal systems remain unaffected and '
                'that the incident was isolated to the third-party platform.',
 'impact': {'data_compromised': 'Insurance eligibility verification data',
            'identity_theft_risk': 'Potential',
            'systems_affected': 'Third-party electronic medical records system '
                                '(OCHIN Inc.)'},
 'investigation_status': 'Ongoing',
 'references': [{'source': 'Baltimore City Health Department Statement'}],
 'response': {'communication_strategy': 'Notifications to affected patients '
                                        'expected to begin around February 9, '
                                        '2026; dedicated helpline '
                                        '(410-545-6674) established',
              'remediation_measures': 'Free credit monitoring services for '
                                      'impacted individuals',
              'third_party_assistance': 'Fraud assistance provider, TriZetto, '
                                        'and other experts'},
 'title': 'Baltimore City Health Department Third-Party Data Breach',
 'type': 'Data Breach'}