AllCare Health, Inc. is a physician-led health coverage organization in Grants Pass, Oregon, serving Medicare- and Medicaid-eligible residents of Southern Oregon. The company has announced a privacy incident in which a limited amount of member health information ended up on an outside website that was not approved to handle it. Even a limited exposure of health plan data raises fair questions about how it happened and who could see it.
AllCare Health’s Data Breach Investigation
AllCare Health publicly announced the incident on October 8, 2026, in a press release addressed to the public and to the members affected. The company describes it as a privacy incident involving a limited amount of protected health information that was uploaded to a third-party website. AllCare says that website was not approved by its coordinated care organization for use with protected health information. In other words, the company’s account is that the information left approved systems because it was placed on a site that should not have received it, and not because of an outside attack on AllCare’s network.
According to AllCare, it learned of the potential privacy incident on August 6, 2026, and began an investigation on August 17, 2026. The company says it took steps to have the information removed from the third-party site, and that it worked with the website to have the information deleted. It has not said how long the information was accessible there, who could view it, or whether anyone did.
The Oregon Department of Justice’s public breach listing records 782 people as affected by the incident. AllCare’s own announcement describes the group as just under 800 impacted members, which is consistent with that listing. The Oregon listing reflects the figure given in the company’s initial report, and the state notes that later updates are not reflected in its public database, so the number could change.
AllCare states that the information involved was limited health plan information and did not include names, Social Security numbers, dates of birth, addresses or other demographic information. The company has not publicly listed which specific health plan data elements were involved. Even so, it chose to send letters directly to all members whose information may have been involved, saying it did so in the interest of transparency and out of an abundance of caution. Based on the limited nature of the information, AllCare says it is not aware of any specific steps members need to take to protect their financial or personal information.
The company says that going forward it is reviewing its privacy policies and procedures and reinforcing with staff the requirements for handling protected health information and using approved systems. It also says it will continue reviewing the incident and taking steps to strengthen its privacy practices. Members with questions can reach the company through its customer line.
Incidents of this kind, where information is placed in an unapproved online tool or service, are a recognized category of privacy problem in healthcare. They often involve employees using convenient outside software such as file sharing, transcription, analytics or document services without confirming it meets the legal and contractual requirements for protected health information. Federal health privacy rules require covered organizations to use vendors that have agreed in writing to safeguard such data, and an unapproved site generally has no such agreement in place. These points describe the general nature of this type of incident and are not additional facts about what happened at AllCare.
Because the company’s description is brief, many questions remain open, including the exact data fields involved, the name and nature of the third-party site, and the period during which the information was available. This page reflects only what AllCare and the state of Oregon have made public. Where a detail has not been disclosed, we say so rather than speculate.
If you are a member and receive a letter from AllCare, keep it. It is the most reliable source for how the incident applies to you. If you believe you may be affected but have not received a notice, you can contact the company directly to ask.
When Did This Breach Occur?
AllCare says it learned of the potential privacy incident on August 6, 2026, and began its investigation on August 17, 2026. The company announced the incident publicly on October 8, 2026. AllCare has not stated the date on which the information was uploaded to the third-party website or how long it remained there.
What Information Was Breached?
AllCare describes the information as limited health plan information. The company states that it did not include names, Social Security numbers, dates of birth, addresses or other demographic information. AllCare has not published a list of the specific health plan data elements involved. Members should rely on the letter they receive from the company for the specifics of their own situation.
What You Can Do
If you received a notice from AllCare Health, consider these steps:
- Keep the notification letter and read what it says about your information.
- Review the explanation-of-benefits statements from your health plan for services you did not receive.
- Contact AllCare Health with questions about how the incident applies to you.
- Monitor your financial accounts and credit reports as a routine precaution.
- Report suspected fraud to the Federal Trade Commission and your state Attorney General.
File a Data Breach Lawsuit Against AllCare Health
If you received notice that your information may have been exposed in the AllCare Health privacy incident, you may be entitled to compensation. Health plans that hold sensitive member information are expected to keep it on approved, secure systems, and people affected by a privacy incident can face lasting concerns about how their information is used.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
