OPTION CARE HEALTH, INC.

Option Care Health, Inc. discovered that an employee's email account was accessed without authorization between February 6–9, 2026. The incident was identified on February 26, 2026. Potentially accessed information included names, dates of birth, medical record numbers, and treatment information. A forensic security firm was engaged to assist. The notice was filed with the California AG.

Option Care Health, Inc. (IL) reported to HHS OCR on 2026-04-06 a Hacking/IT Incident affecting 1,891 individuals. Breached information was located on Email. No business associate was identified as present. No further detail is available from the HHS web description.

OPTION CARE HEALTH, INC. filed a data-breach notice with the Illinois Attorney General in April 2026 (case 26-04-1116). The register records the breach as discovered on February 26, 2026. Personal information types reported: medical information. Illinois does not publish the number of people affected — 815 ILCS 530/10 permits the Attorney General to publish only the entity name, the types of personal information and the date range.

Option Care Health, Inc. reported to HHS on 2026-02-20 a Hacking/IT Incident affecting 2086 individuals. Breached information located on Email.

OPTION CARE HEALTH, INC. filed a data-breach notice with the Illinois Attorney General in February 2026 (case 26-02-985). The register records the breach as discovered on December 29, 2025. Personal information types reported: medical information. Illinois does not publish the number of people affected — 815 ILCS 530/10 permits the Attorney General to publish only the entity name, the types of personal information and the date range.

Option Care Health reported to HHS on 2024-11-15 a Hacking/IT Incident affecting 2897 individuals. Breached information located on Email. An employee was the subject of an email phishing scheme that compromised PHI including SSNs, birthdates, addresses, and diagnoses.

Option Care Health notified Montana residents of a July 31, 2024 email inbox compromise affecting patient PHI. The incident was discovered on August 1, 2024. Notices were sent November 15, 2024, offering Kroll identity monitoring.

Option Care Health notified patients that an unknown party briefly accessed an employee's email inbox on July 31, 2024. The company became aware of the issue on August 1, 2024, and terminated access. Forensic analysis determined that Protected Health Information (PHI) and basic identity information may have been impacted. The company reset passwords, restricted access, and engaged Kroll for identity monitoring services.

OPTION CARE HEALTH filed a data-breach notice with the Illinois Attorney General in November 2024 (case 24-11-029). The register records the breach as discovered on July 31, 2024. Illinois does not publish the number of people affected — 815 ILCS 530/10 permits the Attorney General to publish only the entity name, the types of personal information and the date range.

Option Care Health, Inc. filed an 8-K disclosing that Change Healthcare, a subsidiary of UnitedHealth Group, experienced a cybersecurity incident on February 21, 2024. Option Care Health disconnected from Change Healthcare's systems on that date and has not identified any compromise of its own systems. The incident caused operational disruptions, preventing the processing of over half of the Company's claims, impacting cash flow and patient care operations.