Key Points

• Third-party and vendor-related breaches dominate the cluster, especially incidents involving Cerner/Oracle Health and other healthcare service providers.
• Legacy electronic health record systems are a recurring exposure point, with access to historical patient records, SSNs, medical record numbers, and treatment data.
• Notification timing is a persistent issue, with several disclosures describing long delays between initial access and patient notice.
• Most organizations responded with credit monitoring, identity protection, call centers, and internal or external forensic investigations.
• Some incidents remain partially unverified, with limited public confirmation of exact data types, individual counts, or whether data was exfiltrated versus accessed.
• The legal and regulatory layer is active, with HIPAA obligations, state notice requirements, and class action filings appearing across multiple incidents.
• The cluster is fairly coherent because many items share the same breach pattern, but it is broad enough to include both large multi-hospital events and smaller single-provider incidents.