A federal judge has granted preliminary approval to a $3.9 mn class-action settlement resolving litigation over a 2022 data breach at ArCare, a nonprofit healthcare provider serving patients across Arkansas, Kentucky and Mississippi.
The incident potentially compromised personal and protected health information belonging to approximately 345,000 individuals.
- ArCare agreed to a $3.9 mn settlement following a 2022 data breach that potentially exposed personal and medical information belonging to approximately 345,000 people.
- Eligible class members can claim up to $5,000 for documented losses or an estimated $100 cash payment, plus one year of medical data monitoring.
- The claims deadline is January 7, 2027, with a final fairness hearing scheduled for January 28.
Under the proposed settlement, eligible class members may seek reimbursement of documented losses or receive an alternative cash payment. They can also request one year of medical data monitoring.
The settlement remains subject to final court approval, with a fairness hearing scheduled for January 28, 2027.
How the ArCare data breach affected 345,000 individuals
ArCare, based in Augusta, Arkansas, operates as a federally qualified community health center providing primary care, behavioral health services, pharmacy services and community outreach programs.
The organization discovered unauthorized access to its computer network on February 24, 2022, after experiencing a disruption to its services.
A forensic investigation determined that an unauthorized third party had accessed the network between January 18 and February 24, 2022. Investigators found that files containing personal and protected health information may have been accessed during that period.
The potentially compromised information included:
- Names and dates of birth
- Social Security numbers
- Driver’s license numbers
- Financial account information
- Medical information
- Health insurance details
Approximately 345,000 individuals were potentially affected.
Class-action lawsuits filed against ArCare
Multiple lawsuits followed the disclosure of the breach. The cases were consolidated into Hale, et al. v. Arcare, Inc., pending before the US District Court for the Eastern District of Arkansas.
The plaintiffs alleged that ArCare failed to implement adequate safeguards and that the security incident could have been prevented.
Their claims included negligence, breach of implied contract, unjust enrichment and breach of fiduciary duty, alongside requests for declaratory and injunctive relief.
ArCare denied wrongdoing and disputed the allegations. The healthcare provider filed a motion to dismiss the litigation, but the court rejected the motion. The parties subsequently entered mediation and reached an agreement on the material settlement terms.
ArCare establishes $3.9 mn settlement fund
Under the agreement, ArCare will establish a $3.9 mn fund to compensate eligible class members and cover settlement-related expenses.
The fund will also pay court-approved attorneys’ fees, litigation costs, settlement administration expenses and service awards to the plaintiffs.
After those deductions, the remaining funds will be available for class-member benefits.
Eligible individuals have two alternative cash compensation options. They may submit a claim for documented, unreimbursed losses attributable to the data breach, up to a maximum of $5,000 per person.
Alternatively, class members may request a pro rata cash payment currently estimated at approximately $100. The final amount of the alternative payment will depend on the available settlement funds and the number of valid claims.
In addition to either cash option, eligible individuals may claim one year of medical data monitoring services.
ArCare settlement claim deadlines and payment options
The settlement establishes three important dates for affected individuals.
| Date | Deadline |
|---|---|
| December 8, 2026 | Deadline to object to the settlement or request exclusion |
| January 7, 2027 | Deadline to submit a settlement claim |
| January 28, 2027 | Final fairness hearing |
Individuals wishing to exclude themselves from the settlement or formally challenge its terms must act by December 8. Those seeking compensation or medical data monitoring must submit their claims by January 7, 2027. The court will consider final approval of the agreement at the January 28 hearing.
