Breach Reports Still Trickling In

Months after news first broke that a hacking incident earlier this year compromised legacy patient data hosted by Cerner electronic health record servers that were set to migrate to parent company Oracle’s cloud environment, data breach reports related to the hack are still slowly trickling in to regulators.

See Also: On Demand | From Patch to Prevention: Modernizing Remediation Across Hybrid Environments

To date, those health data breach reports appear to show the hack affected at least 410,000 people, although the total is likely much higher since some of the reports do not disclose up-to-date counts on the number of patients affected at specific Oracle/Cerner clients.

Among the latest entities reporting breaches related to the Cerner hack is Missouri-based Heartland Regional Medical Center, which does business as Mosaic Life Care. Mosaic told the U.S. Department of Health and Human Services’ on June 27 that the Cerner incident affected nearly 145,300 people.

Also, Florida-based Tallahassee Memorial Hospital in June began notifying an undisclosed number of patients about their protected health information being potentially compromised in the Cerner hack, according to local media reports.

As of Tuesday, a breach report from Tallahassee Memorial did not appear on the HHS’ Office for Civil Rights’ HIPAA Breach Reporting Tool website listing HIPAA breaches affecting 500 or more individuals.

In June, Cerner filed its own report to HHS OCR saying the hacking incident affected 501 individuals, a common placeholder estimate used when an organization is still assessing a breach and counting its victims.

In recent days, Cerner has also filed breach reports to the attorneys general of several states including California, South Carolina and Texas.

While the California report does not specify a number of people affected, Cerner respectively told South Carolina and Texas the incident affected 2,989 and 4,082 individuals.

Those reports follow Indiana-based Union Health System, which operates two hospitals and a medical group, reporting a Cerner related breach to HHS OCR on April 21 as affecting nearly 263,000 individuals (see: Indiana Health System Notifies 263,000 of Oracle Hack).

Oracle acquired Cerner in 2022.

The Cerner data breach is one of at least two hacks involving Oracle so far this year (see: Oracle Health Responding to Hack on Legacy Cerner EHR Data).

Among other considerations, the Oracle/Cerner incident spotlights challenges business associates and covered entities often face in assessing the scope of a data breach following a hack or other incident, some experts said.

“It takes time to identify and understand the scope of impact of the breach, helping ensure breach notifications accurately account for the actual number of patients affected,” said Keith Fricke, a partner of consulting firm tw-Security.

Breach, or No Breach?

Oracle had not been completely transparent about the hack, some experts complained, when news of a potential breach first surfaced (see: Cybersecurity Experts Slam Oracle’s Handling of Big Breach)

In April, Oracle sent a terse letter to customers saying, the company “would like to state unequivocally that the Oracle Cloud – also known as Oracle Cloud Infrastructure or OCI – has NOT experienced a security breach. No OCI customer environment has been penetrated. No OCI customer data has been viewed or stolen.”

“No OCI service has been interrupted or compromised in any way,” the letter said.

Nonetheless, the letter conceded that a hacking incident had indeed occurred. “A hacker did access and publish user names from two obsolete servers that were never a part of OCI. The hacker did not expose usable passwords because the passwords on those two servers were either encrypted and/or hashed. Therefore, the hacker was not able to access any customer environments or customer data.”

Oracle on Tuesday did not immediately respond to Information Security Media Group’s requests for an update on the hacking incident involving Cerner data, including the total numbers of clients and individuals affected.

Incident Details

Covered organizations – including Mosaic and Union Health – reporting breaches so far to HHS OCR involving the Cerner hack have each stated in their breach notices that they found out about being affected by the incident only after being contacted by cybercriminals.

In its breach notice posted on its website, Mosaic Life Care said that an “unknown party” contacted Mosaic claiming they had some patient information in their possession. Mosaic said it verified the claim on April 29, and then determined the information “as likely obtained from Oracle Health/Cerner systems related to data migration services it was performing.”

Mosaic said it notified law enforcement and reached out to Oracle about the incident.

“On May 2, Oracle Health/Cerner confirmed that the files received from the unknown party came from Oracle Health/Cerner’s environment,” Mosaic said.

“Oracle Health/Cerner further informed Mosaic that an unknown party accessed Oracle Health/Cerner’s migration environment at least as early as Jan. 22, 2025, using compromised credentials. On June 6, Oracle Health/Cerner provided us with a list of Mosaic patients whose information was involved.”

The incident did not involve access or compromise “to any of Mosaic owned, operated or administered systems, including Mosaic’s live EHR,” the notice said.

The affected files contained information that varied by individual but could have included patients’ names, Social Security numbers, driver’s license numbers, dates of birth, treating physicians, dates of service, medication information, insurance information and treatment and/or diagnostic information, Mosaic said.

Planning Ahead

As of Tuesday, Oracle was facing consolidated proposed federal class action litigation that includes about 20 individual lawsuits involving the health data breach stemming from the hack.

So, what actions should covered entities take when news breaks about one of their critical health IT vendors suffering a hacking incident and potential data breach?

“Healthcare providers should formally contact their vendor and ask whether their patients’ or other sensitive data was involved in the breach,” said Steve Cagle, CEO of consulting firm Clearwater.

“They should review their business associate agreement with that vendor and remind the vendor of their obligations. They should also ensure they understand the vendor’s investigation process and determine whether they are satisfied with it,” Cagle said.

In the event the healthcare provider’s patient data has been compromised, the organization should coordinate efforts related to breach reporting with the vendor to ensure they are meeting appropriate timelines and notifying affected individuals without any unreasonable delay, he said.

Fricke also said it is critically important to have contact information for a compromised vendor to keep communication channels open. “Healthcare organizations should update language in their business associate agreements if the contracts are deficient in defining service-level agreements for breach notification,” he said.

It is also important to have relationships with alternate vendors capable of providing products and services in the supply chain where possible, he added. “Be sure your incident response plans are kept current and tested. If you have not IR plan, make it a priority to create one and test it periodically.”

Finally, if a third-party incident is still active, healthcare clients “should consider whether to disconnect any connections with that vendor and activate business continuity plans for those services,” Cagle said.