ARcare $3.9 Million Data Breach Class Action Settlement, Claim Up to $5,000 or an Estimated $100 by January 7, 2027

If ARcare, Inc. sent you a notice that your personal information may have been exposed in its 2022 data breach, you may be able to claim money from a $3.9 million class action settlement. You must file a valid claim by January 7, 2027.

Official settlement website: https://arcaredatasettlement.com/ File a claim online: https://veritaconnect.com/ARcareDataSettlement/Claimant Paper claim form (PDF): https://www.arcaredatasettlement.com/media/7496046/v4_arhl9_claim_091626_final-web.pdf

The settlement resolves Hale, et al. v. Arcare, Inc., No. 3:22-cv-117-BSM, in the U.S. District Court for the Eastern District of Arkansas. ARcare is an Arkansas healthcare provider based in Augusta. About 345,000 people were notified that their Social Security numbers, medical information, health insurance details and other data may have been affected. ARcare denies any wrongdoing.

You have three choices:

• Cash Payment A: reimbursement of up to $5,000 for documented, unreimbursed losses
• Cash Payment B: an estimated $100 cash payment with no proof of loss, which can go up or down
• Medical Data Monitoring: one year of free monitoring, which you can add to either cash option

The $100 is not guaranteed. The settlement is not final until the court grants final approval at a hearing on January 28, 2027.

ARcare Data Breach Settlement: Quick Facts

Item	Details
Defendant	Arcare, Inc.
Case name	Hale, et al. v. Arcare, Inc.
Case number	3:22-cv-117-BSM
Court and judge	U.S. District Court, Eastern District of Arkansas; Hon. Brian S. Miller
Settlement fund	$3,900,000
Breach period	January 18 to February 24, 2022; discovered on or about February 24, 2022
People notified	About 345,000
Who is included	Living individuals in the United States who were sent notice that their private information may have been affected
Official settlement website	https://arcaredatasettlement.com/
Claim form	Online at https://veritaconnect.com/ARcareDataSettlement/Claimant or PDF at https://www.arcaredatasettlement.com/media/7496046/v4_arhl9_claim_091626_final-web.pdf
Claim deadline	January 7, 2027 (online by 11:59 p.m. Central; mailed claims postmarked by that date)
Opt-out and objection deadline	December 8, 2026
Final approval hearing	January 28, 2027, 10:00 a.m., Little Rock, Arkansas
Settlement administrator	Verita Global, Inc. (ARHL9 Settlement)
Phone and email	1-888-808-1771; [email protected]
Mailing address	ARHL9 Settlement, Settlement Administrator, P.O. Box 301132, Los Angeles, CA 90030-1132
Class counsel	Jean Martin (Aylstock, Witkin, Kreis & Overholtz, PLC) and Bryan Bleichner (Chestnut Cambronne PA)
Notice date	October 9, 2026
Admission of liability	None. ARcare denies all wrongdoing.
Status	Preliminarily approved; final approval pending

What Happened in the ARcare Data Breach?

ARcare says it found unauthorized access to its computer systems between January 18 and February 24, 2022, and the incident disrupted services for a time. According to the settlement agreement, the information that may have been accessed included:

• Social Security numbers
• Driver’s license or state ID numbers
• Dates of birth
• Financial account information
• Medical treatment and prescription information
• Diagnosis or condition information
• Health insurance information

This lists categories that may have been involved. It does not mean every type was exposed for every person. The settlement class is defined by whether you received an ARcare notice that your information may have been affected, not by whether you were simply a patient.

Why Was ARcare Sued?

Greg Hale filed the first class action on May 10, 2022. Four more suits followed in the same court, brought by Jessica White, Alicia Gilmore, Michael Whitkanack and Melissa Johnson, and the cases were consolidated in March 2023. The consolidated complaint, filed June 2, 2023, claims:

• Negligence: failure to take reasonable steps to protect private information
• Breach of implied contract: an implied promise to protect information patients provided
• Unjust enrichment: keeping benefits that allegedly should have funded better security
• Breach of fiduciary duty: failing duties tied to safeguarding the information
• Declaratory and injunctive relief: court orders about the alleged conduct and protections

These are allegations. The court has not ruled for either side on the merits.

How the Case Reached a $3.9 Million Settlement

This case spent years on a side issue before it reached settlement talks. On July 26, 2023, ARcare asked the court to substitute the United States as the defendant or, alternatively, to dismiss the case. Motions like this typically rest on federal law that can treat certain federally supported health centers as federal actors for some claims (see 42 U.S.C. § 233 and the Federal Tort Claims Act below). The court denied the motion on March 8, 2024. ARcare appealed, the Eighth Circuit affirmed on February 13, 2026, and it denied rehearing on May 6, 2026.

The parties then moved quickly. They exchanged information about how many people were affected, what data was involved and what security changes ARcare made after the breach. They mediated with retired judge Wayne Andersen and, after nearly a full day, agreed to the main terms. The settlement agreement was filed on July 30, 2026.

Laws and Rules Behind the Case

HIPAA (45 C.F.R. Parts 160 and 164). The Privacy, Security and Breach Notification Rules require healthcare providers to protect patient information and to notify affected people, generally within 60 days of discovering a breach (45 C.F.R. §§ 164.400 to 164.414). HIPAA does not give individuals a private right to sue. Enforcement comes from the HHS Office for Civil Rights and state attorneys general (42 U.S.C. § 1320d-5(d)), which is why patients bring state-law claims like negligence instead.

Arkansas Personal Information Protection Act (Ark. Code Ann. § 4-110-101 et seq.). Arkansas requires businesses to use reasonable security for personal information and to notify residents of a breach, and to notify the Attorney General when more than 1,000 residents are affected (§ 4-110-105). The Arkansas Deceptive Trade Practices Act (Ark. Code Ann. § 4-88-101 et seq.) is often cited in similar cases, though this article does not claim it was pleaded here.

Common-law claims. Negligence, implied contract, unjust enrichment and fiduciary duty are state-law theories. Courts often struggle with whether a data breach caused a concrete harm, which is why settlements usually offer both loss reimbursement and a smaller flat payment.

Article III standing. To sue in federal court, plaintiffs must show a concrete injury (TransUnion LLC v. Ramirez, 594 U.S. 413 (2021)). The Eighth Circuit has addressed when data breach plaintiffs can show injury, for example in In re SuperValu, Inc., 870 F.3d 763 (8th Cir. 2017).

Public Health Service Act and Federal Tort Claims Act (42 U.S.C. § 233; 28 U.S.C. §§ 1346(b), 2671 et seq.). Certain federally funded health centers can be treated as federal employees for some malpractice-type claims, with the government substituted as defendant. The courts rejected ARcare’s effort to use this route here.

Federal Rule of Civil Procedure 23. Rule 23(b)(3) governs the class, 23(e) requires the court to find the settlement fair, reasonable and adequate, and 23(h) governs fee awards. The one-third fee request is within the range courts in the Eighth Circuit have approved under the percentage-of-the-fund method, but the judge decides.

Who Qualifies?

You are a class member if you are a living individual in the United States and ARcare sent you a notice that your private information may have been affected by the breach. Your notice carries a Class Member ID (on the mailed envelope or postcard, or in the email). The ID is optional on the claim form.

• Arkansas residents are not the only ones eligible. The class covers living individuals in the United States who received the notice.
• Being an ARcare patient is not enough. You must have received the notice.
• Excluded: ARcare’s directors and officers, government entities, and the judge assigned to the case along with the judge’s immediate family and court staff.

If you think you were affected but are not sure you got a notice, call 1-888-808-1771 or email [email protected]. The administrator can tell you whether you are on the list.

What the Settlement Pays

Benefit	What you get	Documentation needed
Cash Payment A: Documented Losses	Up to $5,000 for actual, unreimbursed losses more likely than not caused by the breach and incurred after it	Yes: account statements, correspondence with banks or agencies, invoices or receipts
Cash Payment B: Alternate Cash	Estimated $100, adjusted up or down pro rata	No
Medical Data Monitoring	One year of CyEx Medical Shield Complete	No, but an email address is required

Pick Cash Payment A or B, not both. Medical Data Monitoring can be added to either.

Cash Payment A: what can be reimbursed

The loss must be an actual monetary loss, supported by reasonable documentation, not reimbursed by another source, incurred after the breach, and more likely than not caused by it. A signed statement alone does not count as proof, though you can attach one to explain other documents. You cannot be repaid twice for the same expense, including credit monitoring you received elsewhere. Submitting a claim for $5,000 does not guarantee that full amount, and if the administrator rejects a claim for missing documents, you may get a chance to fix it through a notice of deficiency.

Medical Data Monitoring

CyEx Medical Shield Complete includes one-bureau credit monitoring, medical record and insurance ID monitoring, monitoring of provider identifiers, health savings account monitoring, dark web monitoring, $1 million in identity theft insurance, real-time alerts and victim assistance. It does not promise to prevent identity theft or show that your data has been misused.

Why the $100 is only an estimate

The administrator pays for Medical Data Monitoring first, then Cash Payment A claims, then Cash Payment B. Every cash payment is then raised or cut by the same percentage depending on how much money is left.

Class counsel can ask for up to $1,300,000 in fees (one-third of the fund), up to $50,000 in expenses and $2,500 each for five class representatives ($12,500 total). That is up to $1,362,500 before administration costs, which the notice does not put a figure on. It leaves at most about $2.5 million, enough for roughly 25,000 flat $100 payments against about 345,000 people notified. If more than a small share of them file valid claims, the $100 estimate will shrink. That is arithmetic from the settlement terms, not a prediction of how many will claim.

How to File a Claim

1. Find your notice. You will want your Class Member ID, though it is optional.
2. Pick your benefit. Choose Cash Payment A or B, and decide whether to add Medical Data Monitoring.
3. Gather proof if you choose Cash Payment A. Collect statements, receipts and bank or agency correspondence, and be ready to explain how each loss relates to the breach.
4. File online or by mail. Use the online portal, or mail the paper form to ARHL9 Settlement, Settlement Administrator, P.O. Box 301132, Los Angeles, CA 90030-1132.
5. Meet the deadline. Online claims are due by 11:59 p.m. Central on January 7, 2027. Mailed claims must be postmarked by that date.

Only one claim form per person is allowed. The form asks for your name, address, email and phone number and is signed under penalty of perjury. It does not ask for your Social Security number or bank login, so be wary of any message that asks for either. Filing is free, and you should not pay a third party to submit your claim. If you choose monitoring, an email address is required to receive your activation code.

How to Protect Yourself After a Data Breach

A claim does not protect your identity. Take these steps whether or not you file:

• Freeze your credit at all three bureaus (Equifax, Experian and TransUnion). Federal law makes freezes free (15 U.S.C. § 1681c-1).
• Place a fraud alert if you suspect misuse.
• Review your credit reports for free at annualcreditreport.com.
• Read every Explanation of Benefits from your health insurer and watch for services you did not receive. Medical identity theft can also corrupt your health records.
• Report identity theft at IdentityTheft.gov, the FTC’s official site, and keep the recovery plan and records. They can support a Cash Payment A claim.
• Be careful with unexpected messages claiming to be from ARcare or the settlement. Use only the official website and contact details above.

Your Options and Deadlines

Option	What it does	Deadline
Submit a claim	Makes you eligible for benefits. You give up the released claims.	January 7, 2027
Exclude yourself (opt out)	No benefits, but you keep your right to sue ARcare separately over the breach. Send a signed written request headed “Request for Exclusion” with your name, address, phone and email to the settlement P.O. Box.	Postmarked by December 8, 2026
Object	Tell the court why you oppose the settlement. File with the Clerk of Court and mail copies to class counsel, ARcare’s counsel and the administrator.	Filed and postmarked by December 8, 2026
Speak at the hearing	Ask permission through your objection.	January 28, 2027
Do nothing	No benefits, and you give up the right to sue ARcare over the breach.	N/A

Objections have a long checklist. Besides your contact details and reasons, they must say how many times you and your lawyer have objected to class settlements in the past five years, name any witnesses, and include a statement on whether artificial intelligence was used to prepare the objection. The objector must sign personally; an attorney’s signature is not enough. Objecting is not the same as opting out: an objector who stays in the class can still claim benefits if the settlement is approved. You cannot both opt out and collect.

If you stay in, you release claims against ARcare and a broad list of related parties that arise from the breach, whether or not you file a claim. If you have a serious individual claim, read the agreement and consider legal advice before the December 8 exclusion deadline.

Settlement Timeline

Date	Event
January 18 to February 24, 2022	Unauthorized access to ARcare’s systems
February 24, 2022	ARcare discovers the incident
May 10, 2022	Greg Hale files the first class action
March 2023	Cases consolidated
June 2, 2023	Consolidated amended complaint filed
March 8, 2024	Court denies ARcare’s motion to substitute the United States or dismiss
February 13, 2026	Eighth Circuit affirms
May 6, 2026	Eighth Circuit denies rehearing
July 30, 2026	Settlement agreement filed in court
October 9, 2026	Class notice date
December 8, 2026	Opt-out and objection deadline
January 7, 2027	Claim deadline
January 28, 2027, 10:00 a.m.	Final approval hearing, 500 West Capitol Avenue, Little Rock

When Will Payments Be Sent?

Not before final approval, and there is no confirmed date. After the January 28, 2027 hearing, if the court approves the settlement and there are no appeals, the administrator has 30 days after the effective date to send benefits. If someone appeals, that can be pushed back by a year or more. If the court denies final approval, the settlement is void and the case continues.

After approval, the administrator will email you to choose between electronic payment and a paper check. You get 90 days to choose, and paper checks must be cashed within 90 days of issue. If money remains unclaimed after the payment process, the agreement directs it to Legal Aid of Arkansas, subject to court approval. Settlement payments may be taxable, so ask a tax professional how to report yours.

How Much Will Class Counsel Be Paid?

Class counsel will ask for up to one-third of the fund, or $1,300,000, plus up to $50,000 in litigation expenses and $2,500 for each of the five class representatives. The court decides. The amounts come out of the settlement fund, and you do not pay them separately. The settlement does not depend on the court granting those amounts.

Frequently Asked Questions

How much is the ARcare data breach settlement?

 $3,900,000, covering class member benefits, administration costs, and any fees, expenses and service awards the court approves.

What is the claim deadline? January 7, 2027.

Who is eligible? 

Living individuals in the United States whom ARcare notified that their private information may have been affected.

How much can I get? 

Up to $5,000 with documented losses, or an estimated $100 without proof. Both can be adjusted pro rata. You can add one year of free medical data monitoring to either.

Do I need proof for the $100 payment? 

No, but you must still file a valid claim form.

Can I claim both the $5,000 and the $100? No. Pick one. Monitoring can be added to either.

Do I need to live in Arkansas?

No. The class covers eligible people anywhere in the United States.

Do I need a lawyer to file?

 No. The court appointed class counsel, and you are not charged. You can hire your own lawyer at your own expense.

Does ARcare admit wrongdoing?

 No. The agreement says it is not an admission of liability or wrongdoing.

What if I did not get a notice? 

Call 1-888-808-1771 or email [email protected]. The class is defined by receipt of the notice, so the administrator can tell you whether you are on the list.

What is the deadline to opt out? 

December 8, 2026, postmarked.

When is the final approval hearing?

 January 28, 2027, at 10:00 a.m. at the U.S. District Court for the Eastern District of Arkansas, 500 West Capitol Avenue, Little Rock. You do not have to attend.

When will checks arrive? 

No date is confirmed. Final approval and any appeals must come first.

Bottom Line

If ARcare notified you about the 2022 breach, file a claim by January 7, 2027. Take Cash Payment A only if you can document real losses, otherwise Cash Payment B, and add the free medical data monitoring either way. Payments will not go out until the court grants final approval after the January 28, 2027 hearing, and the cash amounts may come in below the estimates.

Related Reading

• $4M ALN Medical Management Data Breach Class Action Settlement, File Your Claim By April 3, 2026 For Up To $5,000
• Brockton Health Center $825K Data Breach Settlement
• Covenant Health $2 Million Data Breach Settlement, Who Qualifies for Up to $5,000 or $75, and How to File a Claim by December 30, 2026

Sources and Primary Documents

1. Official ARcare Data Settlement website, administered by Verita Global. https://arcaredatasettlement.com/
2. Settlement Agreement, Hale, et al. v. Arcare, Inc., No. 3:22-cv-117-BSM (E.D. Ark.), Doc. 63-2, filed July 30, 2026. https://arcaredatasettlement.com/media/7477981/arcare_signed_settlement_agreement.pdf
3. Official Claim Form, ARHL9 Settlement. https://www.arcaredatasettlement.com/media/7496046/v4_arhl9_claim_091626_final-web.pdf
4. Frequently Asked Questions. https://arcaredatasettlement.com/frequently-asked-questions.aspx
5. Important Dates and Deadlines. https://arcaredatasettlement.com/important-dates-and-deadlines.aspx
6. Online claim portal. https://veritaconnect.com/ARcareDataSettlement/Claimant
7. Federal court order in Hale v. ARcare on the motion to substitute the United States or dismiss. https://www.govinfo.gov/content/pkg/USCOURTS-ared-3_22-cv-00117/pdf/USCOURTS-ared-3_22-cv-00117-1.pdf
8. Bloomberg Law, “ARCare’s $3.9 Million Data Breach Deal Wins Initial Court Nod.” https://news.bloomberglaw.com/litigation/arcares-3-9-million-data-breach-deal-wins-initial-court-nod
9. HIPAA Rules, 45 C.F.R. Parts 160 and 164 (including §§ 164.400 to 164.414); 42 U.S.C. § 1320d-5(d); Ark. Code Ann. § 4-110-101 et seq. and § 4-88-101 et seq.; 42 U.S.C. § 233; 28 U.S.C. §§ 1346(b), 2671 et seq.; 15 U.S.C. § 1681c-1; Fed. R. Civ. P. 23.
10. TransUnion LLC v. Ramirez, 594 U.S. 413 (2021); In re SuperValu, Inc., 870 F.3d 763 (8th Cir. 2017).

Editorial note: This settlement remains subject to final court approval, the allegations have not been decided on the merits, and individual payment amounts are not guaranteed. Always confirm deadlines and instructions on the official settlement website or in your notice. This article is not affiliated with the administrator, class counsel or ARcare. It is general legal information, not legal advice, and the author is a legal content researcher, not a practicing attorney. For advice about your situation, consult a qualified attorney.