HIPAA Journal reports ArCare $3.9M data breach settlement approved

What happened

According to HIPAA Journal, a District Court judge has granted preliminary approval to a settlement resolving claims over a 2022 security incident at ArCare. HIPAA Journal describes ArCare as a non-profit, federally qualified community health center providing care across Arkansas, Kentucky, and Mississippi. The settlement terms below are as reported by HIPAA Journal. No court document, ArCare statement or settlement notice was among the sources, so they are not independently verified.

HIPAA Journal reports that ArCare first identified unauthorized access to its network on February 24, 2022, which caused temporary disruption to services. Per the same article, a forensic investigation found that an unauthorized third party had access between January 18 and February 24, 2022, and potentially accessed the data of approximately 345,000 individuals. The data listed includes names, dates of birth, Social Security numbers, driver’s license numbers, financial account information, medical information, and health insurance information.

According to HIPAA Journal, multiple class actions were consolidated into one complaint, Hale, et al. v. Arcare, Inc., pending in the United States District Court for the Eastern District of Arkansas. The plaintiffs allege ArCare was at fault and the breach should have been prevented, and they assert claims including negligence and breach of implied contract. HIPAA Journal says ArCare maintains there was no wrongdoing and disagrees with the claims. It also says ArCare’s motion to dismiss was denied.

HIPAA Journal reports that ArCare agreed to establish a $3,900,000 settlement fund. Benefits are paid from it after attorneys’ fees and expenses, administration costs and plaintiff service awards are deducted.

Not confirmed in the sources: the attack method, the identity of the intruder, whether any data was misused, and the settlement administrator or claim website.

Am I affected?

Per HIPAA Journal, the settlement covers class members tied to the 2022 incident, and the data potentially accessed belonged to approximately 345,000 individuals. The source does not give the precise class definition. It also does not say how individuals are notified or how to check eligibility, so both are not confirmed. If ArCare or a settlement administrator sent you a notice, that notice is the authoritative source for eligibility.

What to do now

1. Find any notice you received about the ArCare settlement and use it to confirm whether you are a class member. The source does not name a claim website or administrator.
2. If you want a payment, submit a claim by January 7, 2027, according to HIPAA Journal. The reported options are:
   • Reimbursement of documented, unreimbursed losses due to the breach, up to $5,000 per class member.
   • A pro rata cash payment, estimated at approximately $100 per class member.
   • One year of medical data monitoring services, which class members may claim in addition to either cash payment.
3. If you wish to object to the settlement or opt out, do so by December 8, 2026, as reported by HIPAA Journal.
4. Note the final fairness hearing, reported as scheduled for January 28, 2027.

Sources

• HIPAA Journal: Judge Approves $3.9M ArCare Data Breach Settlement