Optum optum.com Optum data breach: what happened and what to do
Optum reported to HHS that an employee of its vendor mailed the health information of 1,584 people to the wrong addresses. The data included names, addresses, claims information and treatment information. It wasn't a hack.
View all 13,115 breaches- Breach date
- 6 May 2022
- Made public
- 6 May 2022
- Affected
- 1,584
- Data exposed
- Names, Physical addresses, Claims information, Treatment information
- Last updated
Optum, the health services company, told the US Department of Health and Human Services that information on 1,584 people was sent to the wrong recipients. The report was listed on HHS's public breach portal on May 6, 2022. It's a mailing error, not a cyberattack.
What happened
According to HHS's summary of the report, an employee of Optum's vendor mailed the protected health information of 1,584 individuals to incorrect addresses. Optum acted as a business associate, a company that handles health data on behalf of a health plan or provider. HHS lists the cause as unauthorized access or disclosure. The summary doesn't say when the mailing took place.
What was exposed
The information included names, addresses, claims information and treatment information. Claims information describes what care was billed to an insurer, and treatment information describes the care itself.
This kind of exposure is narrower than a database theft. The data went to a small number of wrong addresses rather than to criminals, and no source reports it being misused. Still, claims and treatment details are sensitive, and anyone who received the letter could read them.
The company's response
Optum notified HHS, the affected individuals and the media. It offered free credit monitoring and added administrative and technical safeguards to better protect health information.
What to do if you were in it
- 1
Read your notice letter
Optum wrote to the people affected. It explains what was in the mailing and how to enroll in the credit monitoring it offered.
- 2
Take the free credit monitoring if it's offered
Optum offered complimentary credit monitoring. It alerts you to new credit activity but doesn't stop it, so pair it with a freeze.
- 3
Watch your statements and explanations of benefits
Check the explanations of benefits from your insurer and question any claim or treatment you don't recognize.
- 4
Expect scams that mention the breach
Emails, texts and calls that quote real details about you, or offer help with the breach, are a common follow-up. Don't click links in them. Go to the company's own site or phone number instead.
- 5
Check whether your email or phone is in this and other breaches
Run a free Serus scan. Serus monitors breach databases and the dark web for your details and alerts you when they show up in a new leak.
Frequently asked
Was I affected by the Optum breach?
If you were, Optum notified you directly. HHS lists 1,584 people.
Was this a hack?
No. HHS's summary describes an employee of Optum's vendor mailing health information to the wrong addresses.
What was exposed?
Names, addresses, claims information and treatment information.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
