Benton County Health Data Breach 2026: 1,476 Oregon Behavioral Health and Public Health Clients Exposed via Vendor (TriZetto Pattern). What To Do

What happened

Benton County Health Services is the public health and behavioral health agency for Benton County, Oregon (Corvallis area, home of Oregon State University). The agency has four divisions:

• Behavioral Health — mental health and substance use treatment
• Public Health — epidemiology, communicable disease, immunizations
• Healthy Communities — prevention and community health
• Developmental Diversity — DD services

Benton County also operates Community Health Centers, a Coordinated Homeless Response program, and the Benton County Crisis Center.

Benton County Health posted a vendor-incident banner on its homepage on February 19, 2026 stating: “One of Benton County Health’s vendors was impacted by a security incident, which affected some of the patients’ or their primary insureds’ protected health information.”

This is consistent with the TriZetto Provider Solutions / Cognizant breach pattern — the insurance-eligibility verification vendor where unauthorized access between November 2024 and October 2, 2025 exposed ~3.4 million individuals nationwide. The Oregon notification wave covered multiple county health agencies: Deschutes County Health Services (~1,300), La Pine Community Health Center (~1,200), Best Care (~1,650), and Benton County Health.

Filings:

• HHS OCR: 1,476 affected (filed January 16, 2026)
• Oregon AG: 1,464 Oregonians (filed February 7, 2026)
• Public notice on Benton’s website: February 19, 2026

The HHS OCR filing date (January 16) predates the public Oregon AG report by 3 weeks and the public website banner by ~5 weeks — Benton appears to have filed federal notice as soon as the vendor (TriZetto) provided the impacted-individual list.

No ransomware leak-site post or claim against Benton County government has been identified.

What was potentially exposed

Benton has not enumerated specific PHI categories in machine-readable form on its website (the vendor-incident text appears on the homepage banner only). Per the TriZetto pattern affecting other Oregon county health agencies:

• Full name
• Date of birth, address
• Member ID number
• Insurer name, coverage details
• Social Security number (in some cases)

Because Benton routes claims through eligibility verification for clients across behavioral-health, addictions, public-health, and DD-services programs, the affected population likely cuts across these sensitive program lines, including mental health and substance-use service users.

No public confirmation of vaccine-record exposure.

What is being offered

Benton’s full notification letter and call-center details are not publicly indexed. If TriZetto is confirmed as the upstream vendor, the standard package routed through Kroll has been 12 months of credit monitoring and identity protection.

Read your specific notification letter for activation details.

What to do

1. Watch for a Benton County Health notification letter if you are a behavioral health, addictions, public health, or DD services client.
2. Read your letter carefully to confirm the vendor name and the data elements involved in your case.
3. Place free credit freezes at Equifax, Experian, TransUnion as a baseline precaution.
4. If your behavioral health or substance use treatment was in scope, consider whether 42 CFR Part 2 (federal protections for SUD records) gives you stronger re-disclosure protections than HIPAA.
5. Stop the ongoing flow of your county health data through claims intermediaries. HealthConsent files HIPAA restriction requests covering insurance eligibility and claims-routing pathways.

Continue reading

• Your eight HIPAA rights, in plain English
• Other 2026 healthcare data breaches