Date Posted: 9/4/2025

Appalachian Regional Healthcare (ARH) has been notified by Blue & Company, LLC (“Blue”), a third-party financial consulting firm, of a cybersecurity incident that occurred on November 7, 2024. This incident may have involved the protected health information (PHI) of patients who received services at an ARH facility prior to the November 2024 date.

Blue & Company discovered unauthorized access to one of its servers, during which data was removed in less than a half-hour. The impacted data may include your name, date of birth, medical record number and other sensitive personal identifiers.

Blue & Company has completed a forensic investigation and is offering complimentary identity protection services through Kroll. Impacted individuals are encouraged to enroll in credit monitoring and identity restoration services, remain vigilant by reviewing account statements and explanation of benefits, and monitor free credit reports for suspicious activity.

To enroll in identity protection services or for more information, please contact Blue & Company’s dedicated call center:

Toll-Free Number: 1-866-819-2990 Website: https://response.idx.us/blueandco

For More Information. If you have questions, please call (866) 819-2990 Monday through Friday between the hours of 9:00 a.m. and 6:30 p.m. Eastern Time, excluding major U.S. holidays. You can write to Blue & Co, LLC., 12800 N. Meridian Dr., Suite 400, Carmel, IN 46032.

For additional questions, you may also contact the ARH Compliance Office at email compliance@arh.org.

This notice will remain posted for 90 days in accordance with HIPAA requirements due to the likelihood of incorrect or missing contact information for some individuals.

The notice to the media Blue & Co. issued can be read here: https://www.prnewswire.com/news-releases/blue–co-llc-provides-notice-of-data-event-302497835.html.