How do I know if I am affected by the Amedisys data breach?

Amedisys is mailing notification letters directly to affected individuals. If you have received care or services from Amedisys (also operating as UnitedHealth Group / Optum (parent since Aug 2025)) in the period leading up to April 2026 and you have not received a letter, contact the entity directly. 9,111 individuals were confirmed affected in the HHS OCR filing.

What data was exposed in the Amedisys breach?

According to the notification letter and supporting filings, the compromised data included: Full name, Date of birth, Demographic information, Treatment plans, Diagnosis codes, Clinical summaries, Physician / provider information, Health insurance information.

Was Amedisys attacked by a ransomware group?

Yes — the Kazu Lone-actor data-theft / extortion (open-web forum); intrusion at Doctor Alliance vendor claimed responsibility for the attack on Amedisys. The stolen data was posted publicly on a dark-web leak site. Ransom demand: $200,000.

What is HealthConsent and how does it help with the Amedisys breach?

HealthConsent is an independent health-data privacy service. We help affected individuals stop the ongoing flow of their health information by filing HIPAA restriction requests, FTC Health Breach Notification Rule deletion requests, and state-law deletion requests across providers, insurers, Health Information Exchanges, prescription networks, and data brokers. Credit monitoring offered by Amedisys addresses identity-theft risk; HealthConsent addresses the longer-tail problem of your exposed health data continuing to be sold and shared by other entities downstream.

Active breach tracker Baton Rouge, LA HQ Disclosed April 15, 2026 Part of Doctor Alliance cluster

Amedisys Data Breach 2026 (Doctor Alliance Vendor): 9,111 Home-Health Patients Exposed. UnitedHealth/Optum Subsidiary. What To Do

Q: Should I file a lawsuit over the Amedisys data breach?

3 plaintiffs' firms have publicly announced investigations or filed complaints related to the Amedisys breach: Barnow & Associates (publicly investigating), Migliaccio & Rathod (publicly investigating), Potter Handy (publicly investigating). We are not a law firm and cannot give legal advice; consult your own attorney to evaluate your options.

Amedisys, a major US home health and hospice provider and UnitedHealth/Optum subsidiary, disclosed in 2026 that its third-party vendor Doctor Alliance suffered a November 2025 network intrusion. 9,111 Amedisys home-health patients exposed. Threat actor 'Kazu' claimed 353 GB / 1.24 million records stolen across all Doctor Alliance clients. Here is what to do.

You have options. Scroll for the exact action steps, what your provider’s response covers, and what your health data needs beyond credit monitoring.

By HealthConsent Editorial Last updated May 15, 2026 Sources & methodology

Timeline

Oct 31, 2025

Unauthorized actor begins accessing Doctor Alliance web portal

Nov 7, 2025

'Kazu' posts on underground forum; claims 1.24M files / 353 GB stolen; $200K ransom

Nov 12, 2025

Doctor Alliance discovers the incident

Jan 5, 2026

Doctor Alliance notifies Amedisys

Jan 5, 2026

Breach detected

Apr 15, 2026

Amedisys files with HHS OCR (9,111 affected)

Oct 31, 2025

Unauthorized actor begins accessing Doctor Alliance web portal

Nov 7, 2025

'Kazu' posts on underground forum; claims 1.24M files / 353 GB stolen; $200K ransom

Nov 12, 2025

Doctor Alliance discovers the incident

Jan 5, 2026

Doctor Alliance notifies Amedisys

Jan 5, 2026

Breach detected

Apr 15, 2026

Amedisys files with HHS OCR (9,111 affected)

Data exposed

High-risk identity

Enables financial + identity theft

Date of birth

Health records

Don't expire and can't be reissued

Treatment plans Diagnosis codes Clinical summaries

Contact & insurance

Phishing + targeted scams

Full name Demographic information Physician / provider information Health insurance information

Class actions filed by

These firms have publicly announced investigations. You may be eligible to join. We are not a law firm and cannot give legal advice.

Barnow & Associates (publicly investigating) Migliaccio & Rathod (publicly investigating) Potter Handy (publicly investigating)

If you received a letter

Your action plan, in five steps.

You have more rights than the notification letter explains. Each step below is a concrete thing you can do today. Full detail and timing in the sections that follow.

Accept credit monitoring

It’s the floor of the response. Take it.

Freeze your credit

Free at Equifax, Experian, TransUnion.

File IRS Form 14039

Prevent fraudulent tax return under your SSN.

Review your EOBs

Insurance statements catch medical identity theft early.

Stop the ongoing flow

Credit monitoring doesn’t cover your health records. HealthConsent does.

Jump to step 5: protect my health data

What happened

Amedisys is a major US home health, hospice, and high-acuity care provider operating across ~40 states. Following DOJ approval, Amedisys became a wholly-owned UnitedHealth Group / Optum subsidiary in August 2025. This is the third major Optum-portfolio PHI exposure in ~24 months (Change Healthcare 2024, Episource 2025, now Amedisys via Doctor Alliance 2026).

This breach did not originate at Amedisys’s own systems. It originated at Doctor Alliance, LLC (Dallas, TX), a third-party vendor that facilitates physician signatures on Home Health Certifications and Plans of Care. BAYADA, LHC Group, and other home-health providers are also affected.

Between October 31 and November 17, 2025, an unauthorized actor scripted access against Doctor Alliance’s web portal using stolen credentials. A threat actor using the handle “Kazu” posted on an underground forum on November 7, 2025, claiming theft of approximately 1.24 million files / 353 GB across all Doctor Alliance clients and demanding $200,000 ransom (deadline Nov 21). Doctor Alliance discovered the incident on November 12 and notified the FBI on November 16. Doctor Alliance formally notified Amedisys on January 5, 2026. Amedisys filed with HHS OCR on April 15, 2026 confirming 9,111 affected home-health patients.

What was stolen

Full name, date of birth
Demographic information
Treatment plans, diagnosis codes, clinical summaries
Physician / provider information
Health insurance information

Kazu’s sample posting included additional fields (addresses, phone, email, MRNs, Medicare numbers, medications) but those broader fields apply to the Doctor Alliance dataset overall, not necessarily every Amedisys-attributed record.

What Amedisys is offering

Public reporting describes monitoring guidance to “regularly monitor your healthcare and other statements” but no explicit complimentary credit monitoring or identity-protection program in the publicly available reporting. Read your specific notification letter carefully for any enrollment offer.

Class actions

Multiple plaintiffs’ firms are investigating the Doctor Alliance vendor breach. A federal class action against Doctor Alliance has been filed in the Northern District of Texas (Barbara Catabia v. Doctor Alliance). Class actions targeting Amedisys directly have not surfaced as of mid-May 2026; the suits are focused on Doctor Alliance as the business associate root-cause.

What to do

Watch your insurance Explanation of Benefits statements for unfamiliar claims.
If you receive an enrollment offer, take it.
Place free credit freezes at all three bureaus as a baseline precaution.
If you are a family member or guardian of an Amedisys home-health patient (elderly, terminally ill, medically vulnerable), monitor their statements and accounts on their behalf.
Stop the ongoing flow of your home-health data. HealthConsent files HIPAA restriction requests so the diagnosis and treatment data exposed in this breach is not continuously re-shared.

Continue reading

Stop your data from spreading further

Credit monitoring covers your wallet. HealthConsent covers your health records.

Your stolen diagnoses, test results, and medical record numbers don’t expire when the free credit-monitoring window ends. HealthConsent automates HIPAA restriction requests and opt-outs across providers, insurers, HIEs, and prescription networks so the data taken in this breach can’t keep being shared and sold by other entities downstream.

Protect my health data

Cancel anytime · Family plan covers spouses + dependents

Sources & further reading

Official HHS OCR Breach Portal: ocrportal.hhs.gov

About this page

This page is compiled from public regulatory filings, the breached entity’s own disclosures, and reporting from established healthcare-privacy outlets. Some sections are assembled with the help of automated research and may contain errors, summaries that lag the underlying source, or details that have since been revised. Treat it as a starting point, not legal advice or an authoritative record. If you spot something inaccurate, the linked sources above are the canonical record. For questions about your individual situation, contact the breached entity directly or consult a licensed attorney.