Oracle Health, previously known as Cerner Corporation, experienced a data breach that began on January 22, 2025. This incident affected various healthcare providers, including Baptist Health South Florida. Baptist Health was notified of the breach on March 7, 2025. Oracle Health, acting as a third-party electronic health record vendor, confirmed an unauthorized party accessed data maintained on its systems.
The breach exposed sensitive patient information such as names, Social Security numbers, medical record numbers, doctor details, diagnoses, medicines, test results, images, and information related to care and treatment. While Baptist Health did not disclose the exact number of affected individuals, state attorney general filings indicate at least 14,485 individuals were affected across multiple states. This includes 6,562 in Massachusetts, 4,082 in Texas, 2,989 in South Carolina, and 802 in Washington. The breach also impacted patients in Florida, California, New York, Arkansas, District of Columbia, Missouri, Michigan, Maryland, Montana, and Indiana.
Baptist Health delayed patient notification until late July 2025 at the request of federal law enforcement. Affected patients were offered free credit monitoring through Experian. Oracle Health is collaborating with cybersecurity specialists and federal law enforcement on the ongoing investigation.