Health Center Data Breach Settlement Offers Payouts Up to $5,000

A federal judge has given preliminary approval to a $3.9 million settlement over a 2022 data breach at ArCare, a health center network in Arkansas, Kentucky and Mississippi. About 345,000 people may have had their information exposed. Those affected can claim money or free medical data monitoring, but the claim deadline is January 7, 2027.

What happened

ArCare is a non-profit community health center based in Augusta, Arkansas. It offers primary care, behavioral health services, pharmacies and community outreach. It found unauthorized access to its computer network on February 24, 2022, which briefly disrupted services. Its investigation found an outside party had network access from January 18 to February 24, 2022.

The information that may have been reached includes names, dates of birth, Social Security numbers, driver's license numbers, financial account details, medical information and health insurance information.

The lawsuit

Several class action lawsuits were combined into one case, Hale, et al. v. Arcare, Inc., in the U.S. District Court for the Eastern District of Arkansas. A class action is a lawsuit brought on behalf of a large group of people with the same complaint. The plaintiffs say ArCare was at fault and the breach should have been prevented.

ArCare says it did nothing wrong and disagrees with the claims. It asked the court to dismiss the case, but the court denied that request. The parties then went to mediation and reached a settlement.

What the settlement offers

ArCare will set up a $3.9 million fund. Attorneys' fees, expenses, administration costs and service awards for the plaintiffs come out first. The rest pays class members. A class member can choose one of two cash options:

• Reimbursement of documented losses from the breach that were not already repaid, up to $5,000 per person.
• A flat share of the fund, estimated at about $100 per person.

Either way, class members can also claim one year of medical data monitoring. That is a service that watches for misuse of health information.

Key dates

• December 8, 2026: last day to opt out or object.
• January 7, 2027: claims must be submitted.
• January 28, 2027: final fairness hearing.

Opting out means keeping the right to sue ArCare on your own, but you give up a payment from this settlement.

What to do

If you were an ArCare patient, look for a settlement notice and check whether you qualify. If you had losses tied to the breach, gather the records that show them. The material does not explain how to file a claim or how notices are sent. The $100 figure is an estimate, so the final amount could differ. The settlement also still needs final approval at the January hearing.