Ecofy

Your Chief AI Officer · Friday, October 30, 2026 · Act today

Oracle Health breach count rises to nearly 20 million as systems move to Epic

Reported2 sourcesFor patients

The number of people affected by Oracle Health's 2025 data breach rose to nearly 20 million, while two large health systems moved hospitals from its EHR to Epic's, Becker's reported. Oracle also spent October pitching its AI to hospitals that run Epic, and HIStalk reported Larry Ellison's AI platform remarks at Oracle AI World.

The number of people affected by Oracle Health's 2025 data breach has risen to nearly 20 million, Becker's Hospital Review reported. Over the same 30 days, two large health systems moved hospitals off Oracle Health's EHR and onto Epic's. Oracle Health spent October pitching its AI to hospitals that run Epic. Becker's describes Oracle Health as the nation's second-largest EHR.

At Oracle AI World, Oracle Chairman and CTO Larry Ellison told attendees that AI will allow Oracle to build a comprehensive healthcare platform connecting care, research, insurance and public health, HIStalk reported. That is a statement of intent, not a shipped product. A platform earns a place in your plans because of what it delivers, and the record this month is a growing breach count alongside customer departures.

For organizations on Oracle Health, the questions are practical. Patients whose records sit in a vendor's environment are exposed to that vendor's security posture, and the obligations to notify, investigate and answer patient calls land on the provider as well. For organizations on Epic or planning a migration, the lesson is the same. A move between EHRs creates legacy data that often stays in the prior vendor's hosted systems for years, and that archive is part of your attack surface whether or not clinicians still log into it.

The evidence has limits. Becker's reports the breach count rising, but no independent assessment of Oracle's remediation has been published. Leaders cannot yet judge from public sources whether the conditions behind the breach have been fully addressed. That uncertainty is itself a reason to ask directly rather than wait.

The move: ask every EHR and hosting vendor, not only Oracle Health, for its breach notification terms in writing, including how quickly it will tell you and what it will share. Ask how long legacy data is retained after a migration, where it is stored and who can reach it. Ask what access logging exists and whether you can review those logs. Then confirm your incident response plan covers a vendor-side breach, with named owners in security, compliance, legal and the patient access teams who will field the calls. Weigh any AI platform offer, from any vendor, against these answers. The return is fewer surprises for patients and less scramble for the staff who would otherwise absorb them.

Do this week. Ask every EHR and hosting vendor for its breach notification terms, legacy data retention and access logging, and confirm your incident plan covers a vendor-side breach.

Run this

The prompt to act on this item, for your own model.

Paste it into Claude, ChatGPT or Copilot and fill the bracketed slots with your own numbers. The output is a draft for your team to check, built only from the sources on this page. Never paste patient data. How these prompts are written.

You are a security and compliance advisor to the CISO and executive team of [your organization], a [type of health organization].

Context: Becker's Hospital Review reports that the number of people affected by Oracle Health's 2025 data breach has risen to nearly 20 million, and that over the same 30 days two large health systems moved hospitals off Oracle Health's EHR and onto Epic's. Becker's describes Oracle Health as the nation's second-largest EHR. Oracle Health spent October pitching its AI to hospitals that run Epic. HIStalk reports that at Oracle AI World, Larry Ellison said AI will let Oracle build a platform connecting care, research, insurance and public health. That is a statement of intent, not a shipped product. No independent assessment of Oracle's remediation has been published.

Task: Prepare the questions to send this week to every EHR and hosting vendor we use, not only Oracle Health. Then check whether our incident response plan covers a vendor-side breach.

Output: a one-page vendor question list for the executive team with four sections. (1) Breach notification terms in writing: how quickly the vendor will tell us and what it will share. (2) Legacy data retention after a migration: how long, where it is stored, who can reach it. (3) Access logging: what exists and whether we can review the logs. (4) Incident plan gap check: whether the plan covers a vendor-side breach, with named owners in security, compliance, legal and patient access. Close with two sentences on how to weigh any AI platform offer against these answers.

Fill in: [your EHR vendor], [your hosting vendors], [date of your last incident response plan review], [current incident owners by role], [any planned EHR migration and its date].

Guardrails: Use only the facts above and the slots I fill. Cite Becker's Hospital Review and HIStalk by name. Flag anything uncertain or that needs verifying, including the state of Oracle's remediation. Include no patient data. Say this is a draft for the team to check. Nothing here is legal or medical advice.

Open in ClaudeOpen in ChatGPT

The claim.
Oracle's Larry Ellison says AI will let Oracle build a platform connecting care, research, insurance and public health.
The evidence.
Becker's reports the breach count; no independent assessment of Oracle's remediation has been published.

By seat

For the Chief AI Officer. Weigh vendor security history in any decision to add AI modules from an EHR vendor.

For the CISO and security. Inventory legacy or migrated data held by EHR vendors and verify it is encrypted, logged and scheduled for deletion.

Disclosure: Oracle Health and Epic are among the platforms Ecofy orchestrates for clients.

Checked before publishing. 2 independent outlets. 1 figure matched to the source text.

Sources

  1. Becker's Hospital Review, Breach, defections and an Epic pitch: 7 Oracle Health updates in 30 days
  2. HIStalk, News 10/30/26

Drafted by Lumen from the sources above, scored by a second pass on six criteria, then checked by rule against those sources (every figure, two independent outlets or a primary source) and published only when it passes. A person can pull any item, and corrections are published here. Apolitical, always. Nothing here is medical advice. How Your Chief AI Officer is made.

Also in this brief

Your Chief AI Officer

What AI and robotics can do for your organization today, and what is coming in thirty days.

Every weekday morning, ordered for your role. Free.

One click to confirm, one click to leave, and you can change your role or cadence any time. Your address stays with Ecofy and is never shared with partners.