Option Care Health Data Breach 2026 (April Filing): 1,891 Home Infusion Patients — Likely Supplemental to February Incident. What To Do

What happened

This is Option Care Health’s second HHS OCR filing on the same underlying email compromise incident. The company’s first OCR filing on February 20, 2026 covered 2,086 individuals. This April 6, 2026 filing covers an additional 1,891 individuals — most likely a supplemental notification for the same root incident with finalized notification numbers, rather than a wholly new event.

Option Care Health is the largest independent US provider of home and alternate-site infusion services, headquartered in Bannockburn, Illinois (NASDAQ: OPCH). Services include TPN (total parenteral nutrition), IVIG, specialty biologics, and antibiotic therapy for chronic and complex conditions.

The underlying incident timeline:

• February 6-9, 2026: Unauthorized access to a single employee email account
• February 9, 2026: Detection
• February 26, 2026: Forensic confirmation of exposed data
• April 7, 2026: Individual notification letters mailed; California AG filing under SB446

Public reporting indicates a single Feb 6-9 email intrusion. The two OCR filings (2,086 in February, 1,891 in April) likely track the same event with the April figures representing the finalized affected-individual list after notification mailing.

What was stolen

Per Federman & Sherwood’s reading of the notification letter:

• Full name, date of birth
• Medical record number
• Treatment information
• Health insurance details
• Possibly Social Security number (Federman states yes; HIPAA Journal’s summary omits — read your specific letter to confirm)
• Other sensitive information

For an infusion patient population, “treatment information” identifies specific infused drugs (HIV antiretrovirals, oncology agents, IVIG, hemophilia factors) that effectively re-identify the underlying diagnosis even without ICD codes.

What Option Care Health is offering

Credit monitoring vendor, term length, and enrollment deadline are not visible in publicly summarized reporting. Read your specific notification letter for these details. If you do not see credit monitoring referenced in your letter, request it directly given the SSN exposure profile that Federman has flagged.

Securities investigations — separate matter

OPCH faces separate securities-fraud investigations announced May 6-12, 2026 by Kirby McInerney LLP and the Law Offices of Frank R. Cruz. These target the company’s Q1 2026 earnings miss (revenue $1.35B, stock down 24.3%) and FY2026 guidance cut — not this data breach. Do not conflate.

What to do

1. Determine which filing your letter relates to. Both February and April Option Care notifications stem from the same incident; you may have received either letter or both.
2. Read your specific notification letter to confirm exactly what data elements were involved in your case.
3. Enroll in any credit monitoring offered, through the activation code in your letter.
4. Place free credit freezes at Equifax, Experian, TransUnion if your SSN was in scope.
5. File IRS Form 14039 if SSN exposed.
6. If you are on TPN, IVIG, antiretroviral therapy, oncology infusions, or hemophilia factor, recognize that your specific therapy could be inferred from the exposed records.
7. Stop the ongoing flow of your infusion therapy data. HealthConsent files HIPAA restriction requests so the high-cost specialty drug, IVIG, and infusion treatment data exposed in this breach is not continuously re-shared.

Continue reading

• Your eight HIPAA rights, in plain English
• Option Care Health Data Breach 2026 (February) — first OCR filing
• Other 2026 healthcare data breaches