Outcomes One $1.7M Data Breach Settlement, Your Medical Information Was Exposed, Here Is How to Claim Up to $3,500
Outcomes One Inc. has agreed to pay $1.7 million to settle a class action lawsuit stemming from a July 1, 2025 data breach that gave a criminal third party unauthorized access to an employee’s email account. The breach potentially exposed the names, demographic details, medical provider information, health insurance data, and medication information of affected individuals.
This is a healthcare data breach — which means the information exposed is among the most sensitive a person can have. If you received a notice from Outcomes One saying your data may have been affected, you can claim up to $3,500 in documented losses or a flat $75 payment with no paperwork required. The deadline to file your claim is May 5, 2026.
Quick Facts
- Company: Outcomes One Inc.
- Breach date: July 1, 2025
- What was exposed: Names, demographic details, medical provider info, health insurance data, medication information
- Settlement amount: $1,700,000
- Maximum cash payment: Up to $3,500 for documented losses
- No-proof payment: $75 flat cash payment — no documentation needed
- Bonus benefit: 1 year of free medical data monitoring for all claimants
- Claim deadline: May 5, 2026 ⚠️
- Opt-out deadline: April 20, 2026
- Final approval hearing: May 20, 2026
- Official settlement website: outcomesonedataincident.com
- Settlement administrator: P.O. Box 2769, Portland, OR 97208-2769
Who Is Outcomes One and What Happened?
Outcomes One is a healthcare data and analytics company that works with insurers, health plans, and pharmacy benefit managers to manage patient medication data. Because of what they do, the information they hold on individuals is deeply personal — not just names and addresses, but details about your medications, your health conditions, your insurance coverage, and your medical providers.
On July 1, 2025, a criminal third party gained unauthorized access to an employee’s email account at Outcomes One. The lawsuit alleged Outcomes One failed to adequately protect this information.
When a hacker gets into an employee email account at a company like this, the damage is not just about spam or phishing. Your medication list, your insurer, your doctor’s name — that data can be used to commit medical identity theft, fraudulent insurance claims, or targeted scams. Healthcare breaches are treated more seriously than standard data breaches precisely because of how that information can be weaponized.
Outcomes One denies any wrongdoing but agreed to pay $1.7 million to resolve the lawsuit.
Do You Qualify?
Eligibility for this settlement is straightforward. You qualify if both of the following apply:
1. You are a living US resident.
2. You received a notice from Outcomes One stating that the July 1, 2025 data incident may have impacted your private information.
If you received a notice stating the Outcomes One data incident may have impacted your private information, you are eligible to file a claim.
That notice is your confirmation. If you received it — whether by mail or email — do not ignore it. It also contains your unique ID and PIN, which you will need to file your claim online. If you lost or never received your notice, contact the settlement administrator immediately through outcomesonedataincident.com before the May 5 deadline.
How Much Can You Claim? Choose One of Two Options
This is where you need to make a decision. The settlement offers two cash payment tracks — and you can only choose one.
Option A — Documented Loss Payment: Up to $3,500
Choose this if you have experienced actual financial harm you can connect to this breach — things like unauthorized charges, identity theft costs, credit monitoring fees you paid out of pocket, or time and expenses spent dealing with fraud.
Class members filing a documented losses claim must submit reasonable documentation showing their loss is actual, documented, unreimbursed, most likely caused by the data incident, and incurred after July 1, 2025. Examples include bills, invoices, receipts, account statements, or correspondence related to the loss. Self-prepared documents alone are not sufficient.
Option B — Flat Cash Payment: $75 (estimated)
Choose this if you do not have documentation or simply want a straightforward payment without paperwork. Class members filing an alternate cash payment claim do not need to submit documentation but must select the appropriate option on the claim form.
The $75 is an estimate — the final amount depends on how many people file and what the net fund looks like after attorney fees and administration costs are deducted.
Which option should you choose?
If you have had any suspicious financial activity, received unexpected medical bills, or spent time and money protecting yourself after receiving the breach notice — gather your documentation and go with Option A. The $3,500 ceiling is meaningful and worth the extra effort if your losses are real and provable.
If nothing happened to you financially but you want to be compensated for the exposure of your private medical data, Option B gives you $75 for about 10 minutes of your time.
Bonus for everyone: Free Medical Data Monitoring
In addition to either cash payment, all claimants may claim one year of free medical data monitoring. Given that medication and health insurance data was exposed, this monitoring is worth enrolling in regardless of which payment option you choose. Medical identity theft can take months or years to surface, and free monitoring catches it early.
How to File Your Claim Before May 5, 2026
Step 1: Locate your notice. Find the settlement notice mailed or emailed to you by Outcomes One. It contains your unique ID and PIN — required to file online.
Step 2: Choose your payment option. Decide between Option A (documented losses, up to $3,500) or Option B ($75 flat, no proof required).
Step 3: File your claim using one of these methods:
- Online: Visit outcomesonedataincident.com — you will need your unique ID and PIN
- By mail: Download the PDF claim form from the settlement website, complete it with your unique ID, and mail to:
Outcomes One Inc. Data Incident Settlement Administrator P.O. Box 2769 Portland, OR 97208-2769
Lost your notice or need help? Contact the settlement administrator through outcomesonedataincident.com. Do not assume you cannot file just because you misplaced your notice.
Payment options once approved: PayPal, Venmo, Zelle, ACH direct deposit, or check by mail.
Settlement Fund Breakdown
The $1.7 million fund covers attorneys’ fees of up to $600,000, service awards of up to $3,000 each for five class representatives ($15,000 total), settlement administration costs, the cost of medical data monitoring, and payments to eligible class members from whatever remains.
Documented loss claims (Option A) are paid out first from the net fund. Flat cash payments (Option B) are distributed from what is left after documented claims are satisfied. If total claims exceed the available fund, payments are reduced proportionally.
When Will You Get Paid?
The settlement administrator will distribute payments no later than 30 days after it completes its validity review or the court grants final approval to the settlement, whichever is later.
The final approval hearing is May 20, 2026. Assuming no appeals, payments could go out as early as late June or July 2026 — one of the faster timelines for a settlement of this size.
What to Do If Your Medical Data Was Misused
If you have already noticed signs that your information was used fraudulently — unexpected medical bills for services you never received, insurance claims filed in your name, or providers contacting you about accounts you did not open — take these steps right now, in addition to filing your claim:
- File a report with the FTC at identitytheft.gov — this generates a recovery plan specific to your situation
- Contact your health insurer and request a copy of your benefits statement to check for fraudulent claims
- Notify your pharmacy so they can flag your account for suspicious prescription activity
- Place a fraud alert or credit freeze with all three credit bureaus — Equifax, Experian, and TransUnion
Medical identity theft is one of the hardest forms of fraud to clean up because it involves your health records — not just your finances. Our detailed guide on the 23andMe $30M data breach settlement covers what long-term medical data monitoring protects against and why enrolling in free monitoring offered through settlements like this one is worth doing immediately. If you have received multiple data breach notices over the past year, our breakdown of the AT&T $177M data breach settlement explains exactly how documented loss claims work across different breach types and what evidence qualifies — the same standards that apply here.
Key Terms Explained
Medical Data Monitoring: A service that watches for unauthorized use of your medical information — such as prescriptions filed in your name, fraudulent insurance claims, or medical records tampering. Different from standard credit monitoring, which only covers financial accounts.
Documented Loss Claim: A claim supported by real evidence — receipts, bank statements, correspondence — showing financial harm directly caused by the breach. Pays up to $3,500 here.
Alternate Cash Payment: A flat payment available to class members who cannot document specific losses but want compensation for the exposure of their data. No proof required — estimated at $75.
Net Settlement Fund: The amount left in the $1.7 million fund after attorney fees, administration costs, service awards, and monitoring costs are deducted — this is what gets distributed to claimants.
This article is for informational purposes only and does not constitute legal advice. For questions about eligibility or your claim, visit outcomesonedataincident.com or contact the settlement administrator directly.Sources: Outcomes One Inc. Data Incident Settlement | Official settlement website: outcomesonedataincident.com | ClaimDepot.com settlement report, March 6–8, 2026 | Settlement agreement and class notice available at outcomesonedataincident.com
About the Author
Sarah Klein, JD, is a licensed attorney and legal content strategist with over 12 years of experience across civil, criminal, family, and regulatory law. At All About Lawyer, she covers a wide range of legal topics — from high-profile lawsuits and courtroom stories to state traffic laws and everyday legal questions — all with a focus on accuracy, clarity, and public understanding.
Her writing blends real legal insight with plain-English explanations, helping readers stay informed and legally aware.
Read more about Sarah