Arkansas Primary Care Clinic Data Breach 2025: 2,491 Affected · Network Server Hack · Little Rock, AR. Filed With HHS OCR. What To Do.

Arkansas Primary Care Clinic, a Little Rock primary-care practice, discovered a network intrusion on March 25, 2025 and on August 20, 2025 filed a HIPAA breach notification with the U.S. Department of Health and Human Services Office for Civil Rights covering 2,491 individuals. The OCR portal entry classifies the event as a Hacking/IT Incident at Network Server. According to the clinic’s notice and law-firm investigations posted in early September 2025, the exposed data set includes names, Social Security numbers, medical information, and health-insurance information.

Timeline

• March 25, 2025 — Arkansas Primary Care Clinic detects unusual activity on its network. The clinic engages third-party cybersecurity experts to assess, contain, and remediate the incident, and notifies law enforcement.
• August 20, 2025 — Filing posted to the HHS OCR breach portal: Hacking/IT Incident, Network Server, 2,491 individuals affected.
• September 5, 2025 — Federman & Sherwood publicly announces an investigation into the breach on behalf of affected individuals.

What was exposed

Based on the clinic’s notice and law-firm summaries of the notification letter, the exposed elements include:

• Name
• Social Security number
• Medical information
• Health insurance information

The full breakdown for any given individual depends on what the clinic held in that person’s record. Your personal notification letter is authoritative for your own exposure.

What Arkansas Primary Care Clinic offered affected individuals

Credit monitoring and identity-protection details were not summarized in the publicly available notice excerpts at the time of this writing. Affected individuals should consult their personal notification letter for the offer code and enrollment deadline.

Class action status

No class action has been filed of public record against Arkansas Primary Care Clinic. Federman & Sherwood has announced an investigation, which is a precursor step that may or may not lead to a filed complaint depending on the underlying facts and willing plaintiffs.

What to do if you may be affected

• Freeze your credit with Equifax, Experian, and TransUnion. With Social Security numbers in the exposed data set, this is the single highest-leverage step against new-account identity theft. It is free and takes about ten minutes per bureau.
• Enroll in the credit-monitoring offer if your notification letter includes one. Use the enrollment code in your letter before the stated deadline.
• Watch your health-insurance Explanation of Benefits statements for services you did not receive. Medical-identity theft can take months to surface.
• File an IRS Identity Protection PIN request at IRS.gov if your SSN was exposed. This blocks fraudulent tax-return filings using your number.
• Keep your notification letter. You may need it for a future class-action claim form or for an IRS or insurance dispute.

Sources on this page

• HHS Office for Civil Rights Breach Portal — federal regulatory record of this breach.
• Federman & Sherwood — Arkansas Primary Care Clinic Investigation — law-firm summary of the notification letter, including discovery date and exposed data elements.
• Arkansas Primary Care Clinic — entity website.
• Arkansas Attorney General — Data Breach Reporting — state filing channel for Arkansas residents.