Option Care Health Data Breach 2026 (February): 2,086 Home Infusion Patients Exposed via Email Compromise. What To Do

What happened

Option Care Health, Inc. (NASDAQ: OPCH) is the largest independent US provider of home and alternate-site infusion services, headquartered in Bannockburn, Illinois with approximately 8,000+ employees. The company’s patient base is unusually high-acuity: total parenteral nutrition (TPN), intravenous immunoglobulin (IVIG), specialty biologics, antibiotic therapy, and other complex infusion regimens.

Between February 6 and February 9, 2026, an unauthorized actor accessed a single employee email account. Option Care Health discovered the unauthorized access on February 9, 2026 and filed with HHS OCR on February 20, 2026 — confirming 2,086 affected individuals. The document review completed on February 26, 2026, and individual notification letters were mailed on April 7, 2026, along with a California AG filing.

The vector is consistent with business email compromise (single mailbox, short access window, no lateral movement claims). No ransomware group has publicly claimed responsibility.

Note: A separate Option Care Health OCR filing on April 6, 2026 covers a distinct second incident affecting 1,891 additional individuals — that is documented on its own page.

Why infusion treatment records carry hidden re-identification risk

Option Care Health’s exposure profile is uniquely sensitive even for HIPAA terms. “Treatment information” for an infusion patient population identifies specific infused drugs: HIV antiretrovirals, oncology chemotherapy agents, immune-modulators, hemophilia clotting factors, IVIG for autoimmune conditions, and others. Drug-name-level treatment data can effectively re-identify the underlying diagnosis even when ICD-10 codes are not in the dataset.

For patients on antiretroviral therapy, hemophilia factor replacement, or chemotherapy regimens, this exposure carries employment, insurance, and personal-relationship consequences far beyond typical PHI breaches.

What was stolen

Per Federman & Sherwood’s reading of the notification letter (superset across affected individuals):

• Full name
• Date of birth
• Social Security number (per Federman & Sherwood; HIPAA Journal’s summary omits SSN — verify against your specific letter)
• Medical record number
• Treatment information
• Health insurance information
• Other sensitive information

What Option Care Health is offering

Public sources confirm Option Care Health “took steps to secure email systems” and is enhancing controls. Credit-monitoring vendor, term length, and enrollment deadline are not visible in publicly summarized reporting — read your specific notification letter for these details, or call the dedicated response line listed in the letter.

Securities investigations — separate matter

Kirby McInerney LLP and the Law Offices of Frank R. Cruz announced securities-fraud investigations of OPCH in May 2026 — those target the company’s financial performance disclosures, not this data breach. Do not conflate.

What to do

1. Read your specific notification letter to confirm exactly what data elements were involved and whether your SSN was in scope.
2. Enroll in credit monitoring if offered, through the activation code in your letter.
3. Place free credit freezes at Equifax, Experian, TransUnion if your SSN was in scope.
4. File IRS Form 14039 if SSN exposed.
5. If you are on TPN, IVIG, antiretroviral therapy, oncology infusions, or hemophilia factor, recognize that your specific therapy could be inferred from the exposed records. Consider whether you need to make proactive disclosures to employers, insurers, or close contacts.
6. Stop the ongoing flow of your infusion therapy data. HealthConsent files HIPAA restriction requests so the high-cost specialty drug, IVIG, and infusion treatment data exposed in this breach is not continuously re-shared with pharmacy benefit managers and specialty pharmacy networks.

Continue reading

• Your eight HIPAA rights, in plain English
• Option Care Health Data Breach 2026 (April) — separate second incident
• Other 2026 healthcare data breaches