A federal judge ruled June 22 that a data breach lawsuit against Oracle Health and eight health systems can move forward, denying most of the defendants’ attempts to dismiss the consolidated case.
U.S. District Judge Beth Phillips of the Western District of Missouri allowed core claims — including negligence against all defendants — to proceed while dismissing several others, according to the order reviewed by Becker’s.
The litigation stems from a January 2025 ransomware attack on legacy systems of Cerner, which Oracle acquired in 2022 and rebranded as Oracle Health. A hacker exfiltrated patient data including names, Social Security numbers, dates of birth, driver’s license numbers, medication details and diagnostic information, the complaint alleges.
The eight named systems are Albany (N.Y.) Med Health System, Little Rock-based Arkansas Heart Hospital, Coral Gables-based Baptist Health South Florida, Glens Falls (N.Y.) Hospital, St. Joseph, Mo.-based Mosaic Life Care, Pasadena, Calif.-based Huntington Hospital, Tallahassee (Fla.) Memorial HealthCare and Terre Haute, Ind.-based Union Health.
The court rejected the systems’ argument that the breach was Oracle Health’s responsibility alone, writing that the providers had not shown their duty to protect patient data was delegable and could not be “absolved of liability by contracting them out to a third party.”
The judge also ruled that patients of Mosaic Life Care and Tallahassee Memorial can pursue breach-of-contract claims against Cerner as third-party beneficiaries of the systems’ business associate agreements, clearing them to sue the vendor directly.
The judge dismissed claims including unjust enrichment and invasion of privacy and narrowed several state statutory claims, leaving a reduced but active case headed toward discovery against both the vendor and the providers.
Spokespeople for Albany Med, Glens Falls Hospital, Huntington Hospital, Mosaic Life Care and Tallahassee Memorial declined to comment to Becker’s.
Editor’s note: Becker’s reached out to Oracle Health and the other named health systems for comment and will update the story if any of them respond.
At the Becker's 11th Annual IT + Revenue Cycle Conference: The Future of AI & Digital Health, taking place September 14–17 in Chicago, healthcare executives and digital leaders from across the country will come together to explore how AI, interoperability, cybersecurity, and revenue cycle innovation are transforming care delivery, strengthening financial performance, and driving the next era of digital health. Apply for complimentary registration now.
