OneTouchPoint Printed and Mailed for Health Plans, and Its 2022 Breach Was Reported at 2.65 Million People. The Settlement Pays $75 Without Receipts or Up to $5,000 With Them — but Only to People OTP Confirmed Were Hit. Claim Deadline: November 16, 2026.

OneTouchPoint is not a health plan. In the words of its own 2022 notice letter, it is “a vendor who provides printing and mailing services to various health insurance carriers and medical providers” — the company behind member mailings, which, according to the settlement agreement, also holds “other medical information provided during health assessments.” On April 28, 2022, OTP “discovered encrypted files on certain computer systems”; its investigation found “unauthorized access to certain of our servers beginning on April 27, 2022.” OTP told its business customers on June 3, 2022, letters to individuals began going out on or about July 27, 2022, and the company filed its notice with the California Attorney General on August 12, 2022.

That is why your letter may have come from either of two senders. Some came from OneTouchPoint itself — the sample filed in California is signed by the company’s chief information officer, gives OTP’s address in Hartland, Wisconsin, and carries the return address of a “Return Mail Processing Center” in Portland, Oregon. Others came from your health plan. HIPAA Journal reported in September 2022 that “OneTouchPoint is notifying certain individuals about the breach on behalf of some of its customers, but some customers have chosen to issue notifications themselves.” The same report put the count at 2,651,396 people, up from an initial 1.1 million, across “at least 34 organizations,” naming Kaiser Permanente, Geisinger, Health First, UPMC Health Plan, Humana, Aetna ACE, Anthem, other Blue Cross Blue Shield affiliates, Blue Shield of California Promise Health Plan and Matrix Medical Network, as well as Common Ground Healthcare Cooperative, which said 133,714 of its members were affected. The settlement documents themselves name no client, and we have not seen a complete client list.

What was exposed varied from letter to letter. The California sample lists the items as a mail-merge field and states: “Your social security number and financial information were not impacted by this event.” Health plans reported names, subscriber ID numbers, diagnoses, medications, addresses, dates of birth, sex, physician information, family and social histories, allergies, vitals and immunizations, according to HIPAA Journal. The settlement agreement describes what OTP holds in general — including Social Security numbers and member IDs — without saying which items sat in the breached files. If your plan is Kaiser, Anthem or a Blue Cross plan, our pages on the Kaiser Permanente lawsuits, the Anthem BCBS settlement and the BCBS settlement payout cover different cases; this settlement is the one about the OTP breach.

The settlement splits everyone into two groups. The Monetary Settlement Class is “all persons in the United States and its territories whose Private Information was determined by OTP’s investigation to have been impacted in the Data Incident in or about April 2022,” plus the named plaintiffs. The Injunctive Relief Settlement Class is everyone “who were sent notice by OTP of potential impact to their Private Information in the April 2022 Data Incident, but for whom the impact could not be confirmed.” The FAQ is blunt about the second group: its members “cannot file a claim for monetary compensation or credit monitoring.” What they get is OTP’s security commitment, and what they give up is narrow — only claims for injunctive or declaratory relief; they “retain their rights to other claims.”

The practical test is how the settlement reached you. Under the agreement, money-class members get the short-form notice “by U.S. mail and/or email”, while the injunctive class is reached by “media publication.” If a postcard or email from the administrator arrived with a Claim Number and PIN, you are in the money class — the site asks you to file “using the Claim Number and PIN found in the email we sent you or the postcard notice you received in the mail.” If you only have the 2022 letter and nothing arrived in 2026, you may be in the injunctive class, or your notice may have gone to an old address. The agreement covers the second case: anyone who “loses or does not receive a unique identifier may call the Claims Administrator” and have it reissued once their status is validated, or may file a paper claim form without one. Neither the site nor the documents say how many people are in each class. Because the 2022 letter itself said OTP was “unable to say definitively if your information was accessed,” do not assume a 2022 letter alone puts you in the money class; the administrator will check for free.

Claimants choose one of two routes. The simple one is the Alternative Cash Payment: “a one-time $75 payment without the need to document losses or attest to time spent.” The other route combines three reimbursements: ordinary losses up to $500 (bank fees, per-minute phone or metered data charges, postage, gas for local travel, and credit reports or monitoring bought between April 28, 2022 and the end of the claims period); extraordinary losses up to $5,000 for proven monetary losses, professional fees and credit-repair costs; and lost time at $25 an hour for up to four hours, $100 at most. The ceiling for the whole route is $5,000: a claimant “may not receive more than $5,000, not including Credit Monitoring.” On either route, a money-class claimant can add two years of one-bureau credit monitoring with at least $1 million in fraud protection.

The paperwork bar is real. Ordinary and extraordinary losses need “reasonable third-party documentation”; handwritten receipts and other self-prepared papers are “by themselves, insufficient.” An extraordinary loss must be actual and unreimbursed, “more likely than not caused by the Data Incident,” and incurred between April 28, 2022 and November 16, 2026, and the claimant must have tried to recover it first, including by exhausting any credit-monitoring or identity-theft insurance. Lost time needs only an attestation with a short description of how the time was spent. Nothing is paid for emotional distress, bodily injury or punitive damages. A claimant who disputes the administrator’s decision can ask for review by a third-party claims referee, whose decision is final.

There is no fixed fund to be divided. The agreement says the money portion “shall be administered on a claims-made basis”: the administrator tallies the approved claims and OTP pays that amount. We found no overall cap and no pro-rata reduction clause in the agreement, so the $75 is a set amount, not an estimate. Attorneys’ fees and costs of up to $1,500,000, the administration costs and service awards of $1,000 per class representative are paid by OTP on top, not out of claimants’ payments. The security changes are valued at approximately $2 million and must stay in place for at least five years. Payment can come by PayPal, Venmo, Zelle, virtual prepaid card or physical check. Checks are void 90 days after issuance, and money from uncashed checks goes back to OTP — not to other claimants.

Claims are filed online through the official site, whose File Claim button leads to the administrator’s portal, or on the paper form mailed to OTP Data Incident Settlement, c/o Analytics Consulting LLC, PO Box 2005, Chanhassen, MN 55317-2005; a scanned form can also be emailed to OTPDataIncident@noticeadministrator.com. The deadline is November 16, 2026 online, or postmarked by that date on paper.

Before filing, know what staying in means. The release covers OTP and a long list of related parties — including, in the agreement’s words, “any customer on whose behalf Defendant provided notice on behalf of in the Data Incident.” If OTP sent your letter for your health plan, staying in also gives up breach claims against that plan. To opt out — the only way to keep a separate lawsuit — a money-class member must mail a signed request, postmarked by October 16, 2026, to the same PO box marked “ATTN: Exclusion Request.” Each person signs their own; “mass or class opt-outs will not be permitted.”

Objections, due the same day, go by mail to class counsel — Lynch Carpenter, LLP in Pittsburgh and Milberg, PLLC in Chicago, appointed as interim co-lead counsel — and to OTP’s counsel, Mullen Coughlin LLC in Devon, Pennsylvania; the addresses are in question 17 of the notice. An objection must include the case name, your name, address and phone number, and the legal and factual grounds. Injunctive-class members may object too. The final approval hearing is set for November 18, 2026 at 10:00 a.m. at the Waukesha County Circuit Court, 515 W Moreland Blvd, Waukesha, WI 53188; the notice warns the date “may change without further notice.” There is no payment date yet: benefits go out only if the court grants final approval and after any appeals are resolved or the time to appeal has run. The notice also says, in capitals, not to contact the court or the clerk about the settlement.

Yes. The postcard or email points to OTPDataIncident.com, the site named in the court-authorized notice and run by Analytics Consulting LLC; its File Claim button links to dusterhoftonetouchpoint.claims-administrator.com, and the administrator’s email address ends in @noticeadministrator.com. The notice opens with the standard lines: “A court has authorized this notice. This is not a solicitation from a lawyer. You are not being sued.” Class counsel’s services cost you nothing, and nothing in the settlement documents asks a class member to pay anything to file.

One detail can trip people up: the phone number. The notice gives 866-996-3808, toll-free and around the clock, in the footer of every page; the website’s FAQ and contact page, and one line inside the notice, print it as 886-996-3808, which appears to be a typo. Use 866. The claim form asks for payment details only for the payout method you choose — a PayPal email, a Venmo or Zelle number, an email for a prepaid card, or a mailing address for a check.

Fourteen lawsuits followed the breach. On September 29, 2022, the U.S. District Court for the Eastern District of Wisconsin consolidated them as Dusterhoft v. OneTouchPoint, No. 22-cv-0882, and appointed Gary F. Lynch and Gary M. Klinger as interim co-lead counsel. A consolidated complaint followed on November 14, 2022. Three mediations failed — two all-day sessions with a JAMS mediator on April 27 and May 9, 2023, and one with a federal magistrate judge on October 5, 2023. OTP’s motion to dismiss, filed November 20, 2023, was granted in part and denied in part on September 23, 2024; OTP answered on October 7, 2024, discovery began, and the sides then reached a deal. OTP denies all wrongdoing.

The unusual part came last. The plaintiffs dismissed the federal case and re-filed in Waukesha County because, the agreement says, “after evaluating the size and makeup of the Settlement Classes, the Parties have deemed that federal court may not be an appropriate jurisdiction to seek Court approval of the Settlement.” The agreement does not explain further. The parties signed between July 2 and July 10, 2026. The notice also refers to an amendment to the settlement agreement that, as of September 30, 2026, is not posted on the site’s documents page.

The benefit menu mirrors other vendor and health-system breach settlements we have covered: Tift Regional also pays $75 without proof or up to $5,000 with it, and SitusAMC, another vendor most victims never hired, estimates $75 without proof. The difference here is the split class: for most people who got a 2022 letter, the question is not how much, but whether OTP confirmed their data was impacted. Our data breach settlement calculator shows what documented losses typically add up to, and our list of open settlements tracks this one’s deadlines.