Information released by the Texas Attorney General suggests the 2025 breach of Oracle Health's legacy Cerner servers exposed the protected health information (PHI) of almost 20 million people, according to the HIPAA Journal. The HHS Office for Civil Rights (OCR) breach portal still lists the incident with a placeholder of 501 individuals.

The 20 million figure comes from state filings reported by Bloomberg and has not been independently verified. Oracle Health has not publicly disclosed how many people or how many provider clients were affected.

What the state filings show

Only a handful of state attorneys general publish the number of people affected by each breach. Four of those that do account for more than 5.3 million people between them, according to the HIPAA Journal:

State Residents affected
Texas 2,992,244
Oregon 1,978,661
South Carolina 283,903
Washington 69,238

 

Fourteen months earlier, those same kinds of state filings added up to 14,485 people. The HIPAA Journal's August 2025 tally was built from Massachusetts, Texas, South Carolina, and Washington, and it called the real total "undoubtedly considerably larger."

The Texas Attorney General received the updated total on October 2, 2026, so the HIPAA Journal expects the OCR portal to catch up "in the next few weeks."

How a breach this size stays at 501 for so long

Oracle Health told its provider clients that each one was responsible for deciding whether the incident was a reportable HIPAA breach and for notifying its own patients. That means the breach reaches OCR in pieces, filed by each affected covered entity on its own schedule, instead of as one entry from the vendor.

Split filing is how the Breach Notification Rule is built. A business associate notifies its covered entity clients within 60 days of discovering a breach, identifying the affected individuals to the extent possible, and each covered entity then notifies its patients and HHS.

In this case, some hospitals received their list of affected patients in November 2025, 11 months after the intrusion, the HIPAA Journal reported. Each filing to OCR follows from those lists. The breach is known to have affected up to 80 hospitals.

The timeline from intrusion to a usable total looks like this:

  • January 22, 2025: An unauthorized individual first accessed two legacy Cerner servers that had not been migrated to Oracle Cloud
  • March 7, 2025: Oracle Health identified the breach, according to its notice
  • August 2025: State filings confirm 14,485 affected people
  • November 2025: Some hospital clients receive their lists of affected patients
  • October 2, 2026: The Texas Attorney General receives an updated total
  • October 2026: The OCR portal still shows 501

That is nearly 19 months from detection to the first total near 20 million.

Why the portal number matters to your team

Any 2025 benchmark or board slide built on the OCR portal currently counts this incident as 501 people. The HIPAA Journal's count of more than 140 million individuals affected by large healthcare breaches reported for 2025 rests on the same portal, so it carries the same placeholder until the filings arrive.

It also means a covered entity can learn the scale of its exposure from the news before it hears from the vendor. The question to put to your team is how you would know, and how fast.

Related: Healthcare cybersecurity statistics for 2026

Concentration and lag are the pattern to plan for

One vendor's servers held records for up to 80 hospitals, and the scale took more than a year and a half to surface. The same lag shows up at smaller scale: Millstone Medical disclosed a breach nine months after the intrusion, after a review of the affected files ran until July 2026.

What to check with your vendors now

Your vendor inventory should cover every route PHI takes to a vendor, and email is one of the main ones. Vendor and business associate email exposure was the most common email breach pattern in 2025, responsible for 28% of email-related breaches reported to HHS, according to Paubox's analysis in The top 3 healthcare email attacks in 2025. If you know which vendors receive PHI by email, you know whose breach notices to watch for.

A signed business associate agreement (BAA) sets the 60-day notice to you, while the time to produce a list of your affected patients depends on the vendor's own investigation. Questions worth asking at your next vendor review:

  • How long, after detecting an incident, would it take you to give us a list of our affected patients?
  • Do you hold our data on legacy or unmigrated systems, and when will those be retired?
  • Who files with OCR if you have a breach: you, or each of your clients?
  • What do your breach notifications to us include: timeline, data types, encryption status, and evidence of access or copying?

The part you control is how PHI leaves your organization. Paubox Email Suite encrypts every outbound email by default, so PHI your staff send to a vendor is protected in transit whether or not the vendor's own email is configured for it, and nobody has to remember a keyword or extra step. For what HIPAA expects of email, see our HIPAA compliant email guide.

Why does the OCR portal show 501 for the Oracle Health breach?

The OCR portal lists the incident with a placeholder total of 501 individuals and has not yet been updated with the latest figures, according to the HIPAA Journal. Breaches of 500 or more people must be reported to HHS, so 501 marks a large breach whose final count is still unknown.

Is the 20 million figure confirmed?

No. It comes from information released by the Texas Attorney General, as reported by Bloomberg and the HIPAA Journal, and has not been independently verified. Oracle Health has not published a total.

Who reports a breach to OCR when a vendor is breached?

The business associate notifies its covered entity clients, and each covered entity is responsible for notifying its patients and HHS, unless it delegates that task to the vendor. Our business associate agreement page explains how those duties are split.