Outcomes One Inc., a company that partners with health plans to deliver medication therapy management and medication adherence programs, has notified affected individuals that an employee’s email account was compromised in a phishing attack. According to the letter, the incident happened on July 1, 2025, when an employee spotted suspicious activity in his Outcomes email and reported it right away. The company’s security team locked down the account and brought in outside forensic specialists to figure out exactly what had been accessed during the roughly one-hour window the intruder had control of it. Outcomes states that no other employee accounts were involved.
The investigation didn’t move in a straight line. Outcomes says it first confirmed on July 17, 2025 that the compromised account held individuals’ personal information, but it wasn’t until September 10, 2025 that the specific health plan connected to your records confirmed your name and certain other details were among the files accessed. That gap is worth knowing about if you’re wondering why this notice is arriving months after the actual breach date.
What details from your health record were sitting in that email account?
- Full name
- Date of birth
- Gender
- Phone number
- State of residence
- Health plan name
- Service date
- Health care ID number
- Diagnosis information
- Other medication-related information
Outcomes explicitly notes that Social Security numbers were not part of this incident.
No credit monitoring or identity protection service is mentioned anywhere in the notification letter, so if you were hoping for a sign-up link or activation code, there isn’t one to report here.
Since medical and insurance details were exposed, here’s what to actually do next
- Watch your Explanation of Benefits statements and any bills from your health plan closely — Outcomes specifically flags that you should contact your health plan right away if you see charges for care or medications you never received.
- Ask your health plan whether it can flag your account for extra verification before processing new claims, since diagnosis and health care ID information can sometimes be used to submit fraudulent claims.
- Keep an eye out for phishing emails or calls that reference your real diagnosis or medication history — scammers sometimes use leaked medical details to make follow-up scams sound more convincing.
- Because your name, date of birth, and other identifying details were involved, consider signing up for a service like Aura or LifeLock, which can alert you if your information appears elsewhere or is being misused.
- Review your credit reports periodically even though Social Security numbers weren’t exposed here — it’s a reasonable habit if any of your personal data has recently changed hands without your control.
- Save this letter and any confirmation numbers if you call Outcomes, in case you need documentation later for insurance or medical record disputes.
Questions about this incident can be directed to Outcomes’ incident response line at 877-332-1681, available Monday through Friday from 9:00 AM to 9:00 PM Eastern Time, excluding major U.S. holidays.