Arisa Health to pay $1.9 million in settlement over 2024 data breach affecting 375,000 patients

Arisa Health, a behavioral health system based in Arkansas, has agreed to a $1.9 million settlement to resolve a class action lawsuit arising from a data breach that exposed the personal and medical information of more than 375,000 patients.

The breach occurred between March 1 and March 18, 2024, during which time threat actors accessed Arisa Health’s network and obtained files containing names, contact information, Social Security numbers, health insurance details, medical histories, diagnoses, driver’s license numbers, and certifications of substance abuse program completion.

The class action lawsuit, Rebecca Miller et al. v. Arisa Health, Inc., was filed in the Circuit Court of Johnson County, Arkansas. Plaintiffs alleged that Arisa Health failed to implement reasonable cybersecurity measures, leading to unauthorized access to highly sensitive patient information.

Although Arisa Health denies all claims and any wrongdoing, the organization agreed to the settlement to avoid the costs and uncertainties of litigation. The $1.9 million settlement fund will cover attorneys’ fees, administrative costs, service awards for class representatives, and compensation to class members.

Eligible individuals will receive three years of credit monitoring and may submit claims for a one-time cash payment, estimated at approximately $70. Actual payment amounts may vary depending on the number of claims submitted. Additionally, class members can request reimbursement of out-of-pocket losses linked to the breach, up to a maximum of $5,000 per person.

The court has granted preliminary approval of the settlement. The final fairness hearing is scheduled for September 24, 2025. Individuals seeking to object to or exclude themselves from the settlement must do so by August 12, 2025. Claims must be submitted by August 27, 2025.