TriZetto Provider Solutions (TPS), a healthcare technology subsidiary of the IT services giant Cognizant, experienced a significant cybersecurity incident involving unauthorised access to external systems affecting approximately 3.43 million individuals.
The intrusion occurred on 19 November 2024 and remained undetected until 28 November 2025, indicating an extended period of potential system compromise. The breach involved exposure of sensitive personal and healthcare-related data, including names and personal identifiers, addresses, birth dates, social security numbers and insurance details. This severe security dwell time allowed the malicious attackers to remain completely undetected within TPS’s external infrastructure for slightly over a year.
From a regulatory and compliance perspective
The breach triggered obligations under:
- US state-level data breach notification laws
- Health Insurance Portability and Accountability Act (HIPAA) and California Consumer Protection Act (CCPA) related breach notification requirements – where applicable
- Contractual obligations with healthcare clients and partners
It also highlights several key data protection learnings in the context of healthcare:
- Healthcare data ecosystems are high-risk by design. With multiple dependent parties (providers → vendors → sub-processors).
- Detection capability is as important as prevention. An 11-month dwell time is a major compliance red flag under modern security expectations.
- Processor accountability must become stricter. Regulators increasingly treat vendors as critical security nodes, not passive processors.
- Eligibility/claims systems are high-value targets. Often overlooked Electronic Health Record (EHR) systems that contain highly sensitive identity data must be audited regularly.
From a governance and compliance perspective
Irrespective of the industry organisations belong to, they must:
- implement 24/7 security monitoring systems
- have stronger privileged access management (PAM)
- perform a User and Entity Behaviour Analytics (UEBA) cybersecurity approach to analyse user and entity behaviours within a network, as well as detect anomalies and potential security threats
- establish a data segmentation framework which limits the exposure of eligible datasets, resulting in enhanced security and manageability
- execute vendor risk re-assessment across their supply chain
- conduct regular GDPR/HIPAA/CCPA-aligned Data Protection Impact Assessments (DPIAs) and audits
- regularly review and delete logs that exceed the defined retention period to ensure compliance and optimise storage
Data Protection Officers (DPOs) should also play a proactive role, working closely with cybersecurity, legal and operational teams to oversee privacy risk assessments, strengthen third-party risk management, ensure appropriate technical and organisational measures are in place, and coordinate regulatory breach responses, where required.
By taking a proactive role throughout the data lifecycle, DPOs can help reduce compliance risks, improve organisational resilience, and strengthen accountability across the organisation.
We’re here to help
TriZetto Provider Solutions’ incident represents a material healthcare data breach with prolonged undetected access, significantly increasing the risk of downstream identity misuse and regulatory impact. It underscores the need for stronger continuous monitoring, rapid detection capabilities, and robust third-party risk governance in healthcare data ecosystems.
As a global, outsourced DPO service provider, HewardMills supports organisations in every step of their compliance and cybersecurity journey. Our team of experts would be happy to discuss your requirements, so please get in touch.
