AmeriHealth Caritas Louisiana Data Breach 2025: 1,552 Medicaid Members Affected · Unauthorized Access · HHS OCR Filing Open

AmeriHealth Caritas Louisiana (ACLA), one of the managed-care organizations contracted by the Louisiana Department of Health to administer Medicaid benefits under the Healthy Louisiana program, filed a HIPAA breach notification with the U.S. Department of Health and Human Services Office for Civil Rights on March 21, 2025. The filing reports 1,552 affected individuals in an Unauthorized Access / Disclosure incident with the location of breached PHI listed as Network Server, Other.

The incident falls below the 500-individual press-notice threshold rules and below the 10,000-individual threshold that typically draws major trade-press coverage. HIPAA Journal’s March 2025 healthcare data breach roundup confirms the filing volume bracket but does not single out ACLA for narrative coverage. The OCR portal entry remains the primary public record.

Timeline of what we know

• March 21, 2025 — ACLA files the HIPAA breach notification with HHS OCR. The portal entry lists 1,552 individuals affected, the incident type as Unauthorized Access/Disclosure, and the location of breached PHI as Network Server, Other.
• March 21, 2025 — The breach is posted to the public OCR portal and shows in the “Cases Currently Under Investigation” view.
• Spring 2025 — Srourian Law Firm publishes an investigation page soliciting affected members for a potential class action. No consolidated federal docket against ACLA has been reported as of this update.

What was exposed

The HHS OCR portal entry discloses only that the breached information was located on a Network Server with an additional “Other” category, which is the standard portal taxonomy and does not enumerate the underlying data elements. As of this page’s last update, the following are not publicly disclosed:

• The specific PHI data elements involved (e.g., name, address, date of birth, Social Security number, Medicaid ID, claims data, clinical information)
• Whether financial account numbers, driver’s license numbers, or government identifiers were included
• The root-cause vector (insider, third-party vendor, misconfigured access, credential compromise)
• Attacker attribution, if any

We will not speculate. This section will be updated if ACLA publishes a substitute notice, if the Louisiana Attorney General receives a separate filing that becomes public, or if the OCR investigation closes with a public resolution agreement.

Why this matters: Medicaid managed-care population

ACLA serves a Medicaid managed-care population under the Healthy Louisiana program. Medicaid beneficiaries are a particularly sensitive cohort for data-breach harm because:

• Many enrollees rely on the same address and phone number for benefits, housing assistance, and SNAP — a single exposure can ripple across multiple safety-net programs.
• Identity-theft remediation steps that assume a working credit profile and access to a bank account are not universally available to low-income enrollees.
• Medicaid IDs, when exposed, can enable medical identity theft that surfaces only when a beneficiary is later denied care or billed for services they did not receive.

The fact that this incident affected fewer than 10,000 individuals does not reduce per-person severity for the Medicaid members in scope.

What ACLA is offering

ACLA has not publicly disclosed whether it is providing affected individuals with complimentary credit monitoring, identity-theft protection, or a dedicated call center. Notification letters from the entity, if they have been mailed, are the canonical source for what services are available. This page will be updated when that information is publicly published.

Class-action posture

Srourian Law Firm has published an investigation page soliciting affected ACLA members for a potential class action. As of this page’s last update, no consolidated federal docket against AmeriHealth Caritas Louisiana arising from this breach has been reported in court-records databases or trade press. The investigation page is a pre-litigation solicitation, not a filed complaint.

If you receive an individual notification letter from ACLA and you choose to participate in a class-action investigation, the law firm’s intake page is the appropriate starting point. You do not need to retain counsel to qualify for any credit-monitoring offering that may be made available in the notification letter itself.

What to do if you may be affected

Until ACLA publishes a substitute notice or your individual notification letter arrives, the protective steps are generic but high-leverage:

1. Watch your mail at the address you have on file with ACLA. Notification letters typically follow an OCR filing by a few weeks to a few months. The letter will list the specific data elements involved and any credit-monitoring offered.
2. Freeze your credit at Equifax, Experian, and TransUnion. It is free, takes about ten minutes per bureau online, and blocks new-account fraud. This is the single highest-leverage step for any exposure that may include Social Security numbers.
3. Review your Medicaid statements. Request a copy of recent claims activity from Healthy Louisiana / ACLA and verify that the services billed under your Medicaid ID were actually received by you or your dependents. If you see services you did not receive, report them to ACLA and to the Louisiana Department of Health.
4. Be skeptical of phone, text, or email outreach claiming to be from ACLA, Healthy Louisiana, or “your Medicaid plan.” Threat actors frequently follow disclosed breaches with targeted phishing using the breach itself as a pretext.
5. Bookmark this page. We update it as ACLA’s notification letter, state filings, or court filings become available.

Sources on this page

• HHS Office for Civil Rights Breach Portal — the federal regulatory record of this breach.
• Srourian Law Firm — AmeriHealth Caritas Louisiana data breach investigation — pre-litigation investigation page.
• AmeriHealth Caritas Louisiana — official entity site — entity context and member resources.
• Louisiana Department of Health — Healthy Louisiana managed-care program — program context for the Medicaid population served.
• HIPAA Journal — March 2025 healthcare data breach report — confirms the filing’s bracket below the 10,000-individual threshold.