Data breach of patient info reported at Miami-area hospital. What to know
.JPG "An electronic health record vendor of Baptist Health South Florida has reported a data breach.")
Patients who received care at Baptist Health South Florida may have had their personal data, including names, Social Security numbers and medical information, accessed in a breach that impacted one of the hospital system’s vendors.
Baptist, in a letter recently sent to patients, said an “unauthorized third party gained access to and obtained data that was maintained” by Oracle Health, an electronic health record vendor formerly known as Cerner.
Oracle Health’s investigation determined its systems “may have been compromised as early as January 22, 2025, affecting the information of many health care providers, including Baptist Health,” the hospital told the Miami Herald in a statement Tuesday.
That information may have included names, Social Security numbers and details found “within patient medical records, such as medical record numbers, doctors, diagnoses, medicines, test results, images, care and treatment,” according to the letter, which was obtained by the Herald.
Health records are private under a federal law known as HIPAA, or the Health Insurance Portability and Accountability Act. But they are increasingly being targeted in healthcare hacks.
Last year, the country reported a record-breaking number of breached healthcare records, with many breaches linked to hacking and ransomware attacks, according to the HIPAA Journal, which has compiled healthcare data breach statistics for more than a decade.
Baptist did not say how many of its patients may have been affected in the breach. The Herald has contacted Oracle Health to learn more about the breach, including how many patients may be affected and if any other South Florida healthcare provider was affected.
When did Baptist Health learn of the breach?
Baptist said it was notified of the breach on March 7 but held off on notifying patients until late July, upon the request of federal law enforcement. Baptist said the breach did not impact its own computer systems.
Third-party vendor Cerner, which was acquired by software maker Oracle in 2022 and is now known as Oracle Health, has taken steps to secure its systems and is working with external cybersecurity specialists and federal law enforcement in an investigation, according to the letter sent to Baptist patients.
Healthcare hacks on the rise
This is the latest healthcare-related breach to affect South Florida patients as healthcare hacks become more common.
In June, more than 2,000 patients at Jackson Health System were notified that their personal data, including names, addresses and medical information, but not Social Security numbers, were accessed in a lengthy breach that spanned nearly five years. Jackson said the breach was conducted by an employee who accessed the information to promote a personal healthcare business. No arrests have been announced yet.
As for this latest breach, potentially impacted Baptist patients should have received — or will soon receive — a notice about the breach, including information on how to enroll in free credit monitoring services with credit bureau Experian.
“Individuals who have questions about the event may contact 833-931-5335 and provide engagement number B149213,” reads Baptist statement. “We sincerely apologize for this incident. Protecting patient information remains a top priority for Baptist Health.”
