Judge Approves $3.9M ArCare Data Breach Settlement

A settlement that resolves claims related to a 2022 security incident and data breach at ArCare has been granted preliminary approval by a District Court Judge. ArCare is a non-profit, federally qualified community health center that provides primary care, behavioral health services, pharmacies, and community outreach programs across Arkansas, Kentucky, and Mississippi.

The Augusta, Arkansas-based healthcare provider first identified unauthorized access to its computer network on February 24, 2022, which caused temporary disruption to services. The forensic investigation determined that an unauthorized third party had access to its network between January 18 and February 24, 2022, and potentially accessed the personal and protected health information of approximately 345,000 individuals. Data compromised in the incident included names, dates of birth, Social Security numbers, driver’s license numbers, financial account information, medical information, and health insurance information.

Multiple class action lawsuits were filed in response to the data breach, which were consolidated into a single complaint – Hale, et al. v. Arcare, Inc . – which is pending in the United States District Court for the Eastern District of Arkansas. The plaintiffs allege that ArCare was at fault and the data breach should have been prevented, and the lawsuit asserts claims for negligence, breach of implied contract, unjust enrichment, breach of fiduciary duty, declaratory judgment, and injunction relief. ArCare maintains that there was no wrongdoing, disagrees with the claims in the lawsuit, and filed a motion to dismiss; however, the motion was denied by the court.

All parties agreed to attend mediation, and the material terms of a settlement were agreed. The settlement has now been finalized. Under the terms of the settlement, ArCare has agreed to establish a $3,900,000 settlement fund to pay benefits to the class members after attorneys’ fees and expenses, settlement administration, costs, and service awards for the plaintiffs have been deducted.

Class members may submit a claim for reimbursement of documented, unreimbursed losses due to the data breach up to a maximum of $5,000 per class member. Alternatively, a claim may be submitted for a pro rata cash payment, estimated to be approximately $100 per class member. In addition to one of those cash payments, class members may claim one year of medical data monitoring services. The deadline for filing an objection and opting out of the settlement is December 8, 2026. Claims must be submitted by January 7, 2027, and the final fairness hearing has been scheduled for January 28, 2027.

Judge Approves $3.9M ArCare Data Breach Settlement

Comments