Outcomes One
Disclosed Sep 23, 20251 year ago257,481 affectedConfirmed
The business associate (BA), Outcomes One, Inc., reported that an employee was the subject of an email phishing scheme that affected the protected health information (PHI) of 257,481 individuals. The PHI involved included names, dates of birth, medications, and other treatment information. The BA notified HHS, the affected covered entities, the affected individuals, the media, and provided substitute notice. In response to the breach, the BA implemented additional administrative, technical, and security safeguards, and retrained workforce members to better protect PHI.
What is known
| People affected | 257,481 (as reported to HHS) |
|---|---|
| Disclosed | Sep 23, 2025 |
| Discovered | Jul 1, 2025 |
| Happened | Jul 1, 2025 |
| Attack | Phishing |
| Data exposed | Health, Insurance, Names |
| Sector | Healthcare · US |
| Status | Confirmed |
Sources
| Source | |
|---|---|
| California Attorney General breach notice: Outcomes Oneoag.ca.gov · Official notice | Official notice |
| Washington Attorney General breach notice: Outcomes Oneatg.wa.gov · Official notice | Official notice |
| Oregon DOJ breach notice: Outcomes Onejustice.oregon.gov · Official notice | Official notice |
| Texas Attorney General data security breach report BR-0004623: Outcomes Oneoag.my.site.com · Official notice | Official notice |
| HHS OCR breach report (archive, resolved): Outcomes One (Business Associate, FL)ocrportal.hhs.gov · Official notice | Official notice |
Notices filed
| Where | Filed | People |
|---|---|---|
| California AGresidents of CA | Sep 23, 2025 | |
| Washington AGresidents of WA | Sep 23, 2025 | 3,477 |
| Oregon DOJresidents of OR | Sep 23, 2025 | 149,094 |
| HHS archivetotal | Sep 23, 2025 | 257,481 |
| California AGresidents of CA | Oct 23, 2025 | |
| Texas AGresidents of TX | Oct 24, 2025 | 18,299 |
History of this record
- 2026-09-25 · records_basis: organization to hhs · backfill source
- 2026-09-25 · records: 256031 to 257481 · backfill source
- 2026-09-25 · summary: empty to The business associate (BA), Outcomes One, Inc., reported that an employee was the subject of an email phishing scheme that affected the protected health information (PHI) of 257,481 individuals. The PHI involved included names, dates of bi · backfill source
- 2026-09-25 · data_types: [] to ["health","insurance","names"] · backfill source
- 2026-09-25 · records_basis: empty to organization · backfill source
- 2026-09-25 · records: empty to 256031 · backfill source
- 2026-09-25 · sector: other to health · backfill source
- 2026-09-25 · attack: unknown to phishing · backfill source
- 2026-09-25 · discovered: empty to 2025-07-01 · backfill source
- 2026-09-25 · disclosed: 2025-10-23 to 2025-09-23 · backfill source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.