Baptist Health Drew County Data Breach Settlement

Drew County hospital patients may claim. This settlement resolves claims over a criminal third party's unauthorized access to the IT network of Baptist Health d/b/a Baptist Health Medical Center - Drew County in Monticello, Arkansas, between approximately April 22 and July 8, 2024, discovered on about July 8, 2024. Four things are worth getting straight before you file. First, this is one hospital, not the Baptist Health name. The Settlement Agreement puts the whole class at approximately 6,886 people - those whose Private Information was potentially impacted in this incident, including everyone who received notice of it. Baptist Health's Arkansas system lists dozens of other facilities, and separate, unrelated organizations use the same name in Kentucky and Southern Indiana and in Jacksonville, Florida. Being a Baptist Health patient somewhere else does not qualify you here. Second, the benefits stack - except the two documented-loss tiers, which are either-or. The official claim page is explicit: you may claim Credit Monitoring Services, Lost Time, and either Ordinary Documented Out-of-Pocket Losses, up to $400, or Losses for Identity Theft or Fraud, up to $4,000. So two years of monitoring, plus up to $80 of lost time, plus one documented tier - a stacked cash maximum of $4,080, not $80 plus $400 plus $4,000. For most people with no documented fraud the realistic outcome is the monitoring plus up to $80. Third, the $4,000 caps one tier, not the settlement. There is no fund at all: Paragraph 53 of the agreement makes this a wholly claims-made settlement, so nothing is divided pro rata and nothing is guaranteed - every documented dollar has to be backed by proof such as receipts. Fourth, the online form will not open without the LoginID and PIN from your mailed notice, and there is no guest route past that login - but the printable Claim Form asks for a Notice ID only if known, and the court-authorized notice sets no ID requirement at all, so the mail route is open to you either way. The administrator will also re-send your codes if you email info@BHSettlement.com, and FAQ 9 says you can request a paper form at (866) 606-0682. Claims are due December 8, 2026. Opting out or objecting is due a month earlier, by November 9, 2026 - and under Paragraph 66, more than 25 opt-outs would let Baptist Health void the whole settlement.

Do I Qualify?

You may be eligible if:

• You are an individual whose Private Information was potentially impacted in the Data Incident at Baptist Health Medical Center - Drew County in Monticello, Arkansas, between approximately April 22 and July 8, 2024. Paragraph 48 of the Settlement Agreement defines the class to expressly include all those who received notice of the Data Incident, so a notice letter or Postcard Notice about this incident is the clearest sign you are in
• IT HAS TO BE THE DREW COUNTY HOSPITAL. The defendant is Baptist Health d/b/a Baptist Health Medical Center - Drew County, and the Settlement Agreement puts the whole class at approximately 6,886 people. Baptist Health's Arkansas system lists dozens of other facilities - Little Rock, Conway, Fort Smith, Arkadelphia, El Dorado, Heber Springs, Hot Spring County and more - and none of them is the defendant. Separate, unrelated organizations use the same name elsewhere, including Baptist Health serving Kentucky and Southern Indiana and Baptist Health in Jacksonville, Florida. Being their patient does not qualify you here
• The class carries NO STATE RESTRICTION - Arkansas residence is not a condition and benefits do not vary by state. In practice nearly everyone in a 6,886-person class tied to one Monticello hospital will be an Arkansan, but if you were treated there, or worked there, and have since moved away, you are not out
• YOU ARE EXCLUDED IF YOU ARE BAPTIST HEALTH ITSELF OR ONE OF ITS AFFILIATES, PARENTS, SUBSIDIARIES, DIRECTORS, OFFICERS OR AGENTS, or one of its respective subsidiaries and affiliated companies. Also excluded: governmental entities; the judge(s) assigned to the Action, their immediate family and court staff; anyone who perpetrated the Data Incident; and anyone who validly excludes themselves by November 9, 2026
• READ THAT EXCLUSION LIST AGAIN FOR WHAT IT LEAVES OUT: rank-and-file employees are not on it. It reaches directors, officers and agents, not ordinary staff, and the class covers everyone who received notice - so a hospital employee or a dependent who was sent a notice letter about this incident reads as inside the class rather than carved out of it. That is the opposite of how several other healthcare breach settlements are drafted. If that is your situation, call the administrator at (866) 606-0682 before you rule yourself out
• You submit a timely and valid Claim Form by December 8, 2026. Settlement Agreement Paragraph 53 makes this a wholly claims-made settlement: anyone who fails to submit a Valid Claim Form receives nothing and is still bound by the releases. Credit Monitoring, Lost Time and your documented-loss tier each have to be elected on the form - none of it is automatic

There are two separate questions here, and running them together is the easiest way to talk yourself out of a claim you could file. Question one: can you get a claim form at all? Yes - and the answer is clearer here than the online portal makes it look. The online form at bhsettlement.com opens on a login screen asking for the LoginID and PIN printed on the Notice mailed to you, and it offers no way to proceed without them. But the settlement website itself says that if you cannot locate your LoginID and PIN you can request them by emailing info@BHSettlement.com with your full name and mailing address, and official FAQ 9 says you may request a Claim Form by toll-free telephone at (866) 606-0682, by email, or by U.S. mail from Baptist Health Data Incident Settlement, c/o Settlement Administrator, P.O. Box 25226, Santa Ana, CA 92799-9958. More to the point, the printable Claim Form asks for a Notice ID only 'if known' - it is an optional field - and the court-authorized long-form notice imposes no ID or PIN requirement anywhere in it. The mail route is genuinely open: a completed paper form postmarked by December 8, 2026 is a valid claim. Question two: do you have to prove a loss? Only for the money tiers. Credit Monitoring takes no receipts - every class member is eligible for the two years of one-bureau monitoring, though it still has to be elected on the form. Lost Time takes an attestation, not receipts - you briefly describe how you spent the time, up to four hours at $20.00 an hour for a maximum of $80.00, and attest to it. Both documented-loss tiers require reasonable proof such as receipts showing what you spent or lost, for losses incurred between April 22, 2024 and December 8, 2026. Notes or papers you wrote yourself can support other proof but cannot stand alone as a Valid Claim. The identity-theft tier adds three showings the ordinary tier does not: that the theft or fraud was probably caused by the Data Incident, that the losses are not already covered as out-of-pocket expenses, and that you tried to prevent the loss or get your money back, for example through insurance you already have. Watch for administrator mail after you file. Paragraph 53 of the Settlement Agreement says the administrator may require additional information to validate a claim, and that failing to respond to a Notice of Deficiency may result in a determination that the claim is not a Valid Claim. Unlike some data breach settlements, there is no stated fallback here that converts a thin documented claim into a flat payment - so if the administrator writes to you, answer it.

What Happened?

Baptist Health d/b/a Baptist Health Medical Center - Drew County is a hospital in Monticello, Arkansas, operating as part of the Baptist Health system in Arkansas. Settlement Agreement Paragraph 19 names it as the sole Defendant.

Paragraph 18 of the Settlement Agreement defines the Data Incident as the unauthorized access to the Defendant's IT network between approximately April 22, 2024 and July 8, 2024, discovered by the Defendant on approximately July 8, 2024, which may have resulted in the unauthorized access to the Private Information of approximately 6,886 individuals. The official settlement website describes it as a criminal third party's unauthorized access.

Paragraph 34 defines Private Information narrowly: some combination of names, addresses, dates of birth, diagnoses and treatment information, and/or provider names. Social Security numbers and financial account information are NOT in that definition. Secondary reporting on this case says the original Class Action Complaint, filed June 23, 2025, quoted a separate notice letter sent to employees and their dependents that also listed Social Security numbers, driver's license numbers, bank account information and health insurance information, and that Baptist Health reported a figure of 5,207 to federal health regulators. Those details come from the complaint and the reporting, not from the settlement agreement's own definitions.

The lawsuit alleged that Baptist Health failed to adequately protect that information. Baptist Health denies that it did anything wrong and denies all allegations, claims, wrongdoing and liability, and the Court has not decided who is right. The parties agreed to settle to avoid the costs, risks, disruptions and uncertainties of continuing the litigation.

The court-authorized notice states that the Court appointed Sean Short and Samuel Brown of Ellzey Kherkher Sanford Montgomery, LLP in Little Rock as Class Counsel. Keeley Onna Cronin of Baker & Hostetler LLP in Denver is listed as counsel for the Defendant. Simpluris is the Settlement Administrator.

The case is Latanya Frazier & Chanta Ringo v. Baptist Health, Case No. 40CV-25-62, in the Circuit Court of Lincoln County, Arkansas, Civil Division. The Court has granted preliminary approval and the Final Approval Hearing is set for February 4, 2027 at 10:00 a.m. CT in Star City. No benefits are paid unless the Court grants Final Approval and any appeals are resolved in favor of it - and Settlement Agreement Paragraph 66 separately gives Baptist Health the right to void the Settlement entirely if more than 25 requests for exclusion arrive within 10 days after the November 9, 2026 Opt-Out Deadline.

How to File Your Claim

1. FILE AT BHSETTLEMENT.COM - the official settlement website, run by the court-appointed administrator, Simpluris. Your Claim Form must be submitted online by December 8, 2026, or mailed with a postmark no later than December 8, 2026. Settlement Agreement Paragraph 53 makes this a wholly claims-made settlement: nothing here is automatic, and anyone who fails to submit a Valid Claim Form receives no benefits and is still bound by the releases
2. THE ONLINE FORM WILL NOT LET YOU PAST THE LOGIN WITHOUT YOUR CODES. The online claim form opens on a login screen asking for the LoginID and PIN printed on the Notice that was mailed to you, and it offers no way to proceed without them
3. THAT IS NOT A DEAD END - AND THE PAPER ROUTE HAS NO CODE REQUIREMENT AT ALL. The settlement website says that if you cannot locate your LoginID and PIN you can request them by emailing info@BHSettlement.com with your full name and mailing address. Official FAQ 9 adds that you may request a Claim Form by toll-free telephone at (866) 606-0682, by email, or by U.S. mail from Baptist Health Data Incident Settlement, c/o Settlement Administrator, P.O. Box 25226, Santa Ana, CA 92799-9958. The printable Claim Form asks for a Notice ID only 'if known' - it is an optional field - and the court-authorized long-form notice imposes no ID or PIN requirement anywhere. So a lost notice is a reason to mail or email the paper form, not a reason to give up
4. ELECT EACH BENEFIT SEPARATELY - NONE OF THEM ARRIVE ON THEIR OWN. Credit Monitoring has to be claimed on the form, Lost Time has to be claimed on the form, and so does whichever documented-loss option you pick
5. YOU MUST PICK ONE OF THE TWO DOCUMENTED-LOSS OPTIONS. The official claim page states it in both directions: you cannot claim Ordinary Documented Out-of-Pocket Losses if you claim Losses for Identity Theft or Fraud, and you cannot claim Losses for Identity Theft or Fraud if you claim Ordinary Documented Out-of-Pocket Losses. Choose one, and choose the one your documents actually support
6. MIND THE EARLIER NOVEMBER 9, 2026 DATE. Opting out and objecting are both due November 9, 2026, a month before the claim deadline. An opt-out must be mailed to the administrator and must carry the case name and number, your full name, mailing address, telephone number and email address, your personal signature, and the words 'Request for Exclusion', 'Opt Out' or a clear equivalent
7. the official FAQ says you cannot opt out by telephone or by email. Objections must be filed with the Clerk of the Court at 300 South Drew Street, Star City, Arkansas 71667 by November 9, 2026, with copies to the Settlement Administrator, Class Counsel and counsel for Baptist Health, and FAQ 16 lists nine separate items an objection must contain for the Court to consider it
8. NOTHING IS PAID YET. The Final Approval Hearing is set for February 4, 2027 at 10:00 a.m. CT in the Circuit Court of Lincoln County, Arkansas. Settlement Agreement Paragraph 81 says benefits are distributed no later than 45 days after Final Approval or 30 days after the Effective Date, whichever is later, and official FAQ 11 warns that appeals could delay that further. No payment date has been announced.
9. Visit the official claim form: https://bhsettlement.com/

How Much Will I Actually Get?

THREE BENEFITS STACK - BUT THE TWO DOCUMENTED-LOSS TIERS ARE EITHER-OR. This is not the usual pick-one-cash-option data breach settlement, and getting the shape right changes what you should claim. Credit Monitoring, Lost Time and one documented-loss tier can all be claimed by the same person. The official claim page says so in a single line: Settlement Class Members may make a claim for Credit Monitoring Services, Lost Time, and either for Ordinary Documented Out-of-Pocket Losses OR Losses for Identity Theft or Fraud. BENEFIT ONE - CREDIT MONITORING. Two years of one-bureau credit monitoring, available to every class member, carrying $1 million in identity theft insurance and including real-time monitoring of your credit file, dark web scanning, comprehensive public records monitoring, and access to a fraud resolution agent if something suspicious happens. It takes no receipts, but it still has to be elected on the Claim Form. BENEFIT TWO - LOST TIME. $20.00 per hour for up to four hours spent responding to the Data Incident, a maximum of $80.00, for things like changing your passwords, investigating suspicious activity in your accounts, or researching the incident. This tier takes a brief written description of how you spent the time plus your attestation rather than receipts. BENEFIT THREE - DOCUMENTED LOSSES, AND IT IS ONE OF TWO. Either up to $400.00 for ordinary documented out-of-pocket expenses - fees for credit reports, credit monitoring or freezing and unfreezing your credit, the cost to replace your IDs, postage to contact banks by mail - OR up to $4,000.00 for money you lost to identity theft or fraud. Official FAQ 7 is blunt about it: 'There are two types of documented losses. You may claim one of the following.' THE $4,000 IS A CAP ON ONE TIER, NOT ON THE SETTLEMENT AND NOT A PROMISE TO YOU. It ceilings the identity-theft-and-fraud tier alone. The $400 ceilings the ordinary-expense tier alone. The $80 ceilings lost time alone. Nobody is guaranteed any of the three. The realistic stacked maximum in cash is $4,080 - $80 of lost time plus the $4,000 fraud tier - on top of the two years of monitoring. It is not $80 plus $400 plus $4,000, because the $400 and the $4,000 are alternatives. For most people with no documented fraud, the realistic outcome is the monitoring plus up to $80. BOTH DOCUMENTED TIERS SHARE ONE LOSS WINDOW AND ONE EVIDENCE RULE. Losses must have occurred between April 22, 2024 and December 8, 2026, and you must send proof such as receipts showing what you spent or lost. Notes or papers you wrote yourself can support other proof but cannot stand alone as a Valid Claim. The identity-theft tier adds three showings the ordinary tier does not require: that the theft or fraud was probably caused by the Data Incident, that the losses are not already covered as out-of-pocket expenses, and that you tried to prevent the loss or get your money back, such as through insurance you already have. THERE IS NO FUND HERE, AND THAT CUTS BOTH WAYS. Settlement Agreement Paragraph 53 says the Settlement is administered on a wholly claims-made basis - Baptist Health pays each Valid Claim at the stated amounts. Notice and administration costs, the $125,000.00 in attorneys' fees and costs Class Counsel will request, and the $1,500.00 Service Award requested for each of the two Class Representatives are all paid by Baptist Health separately and subject to Court approval, and none of them reduce class members' benefits. In your favor: there is no pool to divide and no pro rata reduction, so a flood of claims cannot shrink your payment. Against you: there is also no pro rata top-up, so your payment is only what your documents support, capped at the tier limits. PAYMENT MECHANICS. Under Paragraph 82, cash is paid by electronic payment or by paper check. After Final Approval the administrator emails class members to elect a form of payment; you have 90 days to make that election, a paper check goes to your last known address if you do not elect or the electronic payment fails, paper checks must be negotiated within 90 days of issuance, and funds the administrator cannot deliver because of incorrect or incomplete information revert to Baptist Health and are forfeited. Credit Monitoring redemption codes are emailed under Paragraph 83. ONE RISK THAT APPLIES TO EVERY BENEFIT. Settlement Agreement Paragraph 66 lets Baptist Health void the entire Settlement if more than 25 requests for exclusion are received within 10 days after the November 9, 2026 Opt-Out Deadline. In a class of roughly 6,886 people, 26 opt-outs - about four-tenths of one percent - is enough to trigger that right, and if it is exercised nobody is paid anything.

Last reviewed: October 16, 2026 | Information verified from court records and official settlement documents.

Frequently Asked Questions