A rural Arkansas hospital has won first-stage court approval for a class action settlement, and the money covers lost time, identity monitoring and out-of-pocket costs rather than a large per-patient payout. Final sign-off is scheduled for February 4, 2027.
Baptist Health Medical Center-Drew County stands accused of letting a cybercriminal sit in its systems from August 22, 2023, to July 8, 2024. The records taken were the usual clinical set at such facilities: patient identities, addresses, birth dates, diagnoses, care details and medical record numbers. The hospital’s filing with the HHS Office for Civil Rights put the count at 5,207 people.
What the class can claim
Credit monitoring runs for two years on a single bureau, sold alongside a $1 million identity theft insurance policy, and that pairing is the headline benefit. Lost time pays at four hours maximum, billed at $20 per hour. Receipts from April 22, 2024, through December 8, 2026, can be refunded up to $400 for unreimbursed ordinary losses. Proven fraud or identity theft opens a separate track worth as much as $4,000. The hospital has agreed to cover legal costs, claims processing, mailing costs and payments to the two representatives.
Latanya Frazier filed first in Pulaski County Circuit Court; a second case followed, and the pair were merged as Frazier and Chanta Ringo against Baptist Health, pending in Lincoln County Circuit Court. The plaintiffs faulted the hospital for falling short of industry security standards in violation of HIPAA, and asserted several related theories including privacy invasion. Baptist Health denies wrongdoing, and all sides say the agreement resolves the matter for everyone.
Claims close in December
Opt-outs and objections are due November 9, 2026, and claims are due December 8, 2026. A final fairness hearing follows on February 4, 2027.
