Cerner Breach Impacting MercyOne Patients

This notice pertains to a recent incident experienced by a third-party electronic health record (EHR) vendor, Cerner. Because Cerner provides services to MercyOne, your personal information may have been involved in this incident.      

What happened 

Cerner learned that an unauthorized third party gained access to and obtained data that was maintained by Cerner. Cerner determined through an investigation that, at least as early as January 22, 2025, an unauthorized third party gained access to personal health information on legacy Cerner systems. Cerner later informed us that law enforcement investigators directed a delay in notifying patients, as well as hospital customers, about this incident because it could have impeded their investigation. 

What information was involved 

The impacted data may have included names, Social Security numbers, and information included within patient medical records, such as medical record numbers, doctors, diagnoses, medicines, test results, images, care and treatment. 

What we are doing and what can you do 

We are coordinating closely with Cerner. As soon as Cerner learned of the incident, Cerner initiated its critical incident response process and took steps to secure the impacted systems. Cerner also began an investigation and engaged external cybersecurity specialists to help. Cerner also engaged with federal law enforcement. 

To help protect potentially impacted patients, impacted patients are being offered two complimentary services through an identity protection service, Experian. These are identity protection services and 3-bureau credit monitoring for two (2) years to individuals who wish to enroll in credit monitoring. As an additional precaution, Experian will also provide monitoring services known as “Internet Surveillance.” 

We have made efforts to contact potentially impacted individuals via an individual notification letter from us containing an engagement number and contact information. If you believe you were impacted by this incident but did not receive a notification letter, please contact the call center (information for the call center and additional instructions are directly below) and provide engagement number B158372. 

For more information  

MercyOne regrets this incident and any concern it causes you. If you have further questions or concerns, or would like to enroll in monitoring services, please contact the call center at 833-931-3700 toll-free Monday through Friday from 8 am – 8 pm Central (excluding major U.S. holidays) for the most efficient support services.

---

REFERENCE GUIDE 

Review Your Account Statements 

Carefully review statements sent to you from your healthcare providers, insurance company, and financial institutions to ensure that all of your account activity is valid. Report any questionable charges promptly to the provider or company with which you maintain the account. 

Order Your Free Credit Report 

You may also periodically obtain credit reports from the nationwide credit reporting agencies. If you discover information on your credit report arising from a fraudulent transaction, you should request that the credit reporting agency delete that information from your credit report file. In addition, under federal law, you are entitled to one free copy of your credit report every 12 months from each of the three nationwide credit reporting agencies. You may obtain a free copy of your credit report by going to www.AnnualCreditReport.com or by calling (877) 322-8228. You may contact the nationwide credit reporting agencies at: 

Equifax 
(800) 685-1111 
P.O. Box 740241
Atlanta, GA 30374-0241
www.Equifax.com

Experian
(888) 397-3742
P.O. Box 9701 
Allen, TX 75013-9701
www.Experian.com

TransUnion 
(833) 799-5355  
P.O. Box 2000   
Chester, PA 19016-2000   
www.TransUnion.com

You also have other rights under the Fair Credit Reporting Act (“FCRA”). These include, among others, the right to know what is in your file; to dispute incomplete or inaccurate information; and to have consumer reporting agencies correct or delete inaccurate, incomplete, or unverifiable information. For information about your rights under the FCRA, please visit: https://files.consumerfinance.gov/f/201504_cfpb_summary_your- rights-under-fcra.pdf.  

Contact the U.S. Federal Trade Commission 

You may contact the Federal Trade Commission (“FTC”), law enforcement, or your state Attorney General to report incidents of identity theft or to learn about steps you can take to protect yourself from identity theft. To learn more, you can go to the FTC’s website at www.ftc.gov/idtheft, or call the FTC at (877) IDTHEFT (438-4338) or write to Federal Trade Commission, Consumer Response Center, 600 Pennsylvania Avenue, NW, Washington, DC 20580.  

Fraud Alerts and Security Freezes 

You may obtain additional information from the FTC and the credit reporting agencies about fraud alerts and security freezes. You can add a fraud alert to your credit report file to help protect your credit information at no cost to you. A fraud alert can make it more difficult for someone to get credit in your name because it tells creditors to follow certain procedures to verify your identity. You may place a fraud alert in your file by calling any of the nationwide credit reporting agencies listed above. As soon as that agency processes your fraud alert, it will notify the other two agencies, which then must also place fraud alerts in your file. 

You can also contact the nationwide credit reporting agencies at the numbers listed above to place a security freeze to restrict access to your credit report free of charge. You must separately place a credit freeze on your credit file at each credit reporting agency. You will need to provide the credit reporting agency with certain information, such as your name, address, date of birth and Social Security number. After receiving your request, the credit reporting agency will send you a confirmation containing a unique PIN or password that you will need in order to remove or temporarily lift the freeze. You should keep the PIN or password in a safe place. If you request a lift of the credit freeze online or by phone, the credit reporting agency must lift the freeze within one (1) hour. If you request a credit freeze or lift of a credit freeze by mail, the credit reporting agency must place or lift the credit freeze no later than three (3) business days after getting your request.

State Specific Information

For residents of the District of Columbia, Iowa, Maryland, New York, North Carolina, Oregon and Rhode Island

You may contact your Attorney General for additional information about avoiding identity theft. If you are a Rhode Island resident, you may also file a police report by contacting local or state law enforcement agencies. 

You may use the following information to contact your attorney general: 

District of Columbia 
Office of the Attorney General 
Office of Consumer Protection 
400 6th Street, NW 
Washington, DC 20001 
(202) 442-9828 
www.oag.dc.gov

Iowa 
Office of the Iowa Attorney General 
Hoover State Office Building 
1305 E. Walnut Street 
Des Moines, IA 50319 
(515) 281-5926 | (888) 777-4590 
www.iowaattorneygeneral.gov 

Maryland 
Maryland Office of the Attorney General 
Consumer Protection Division 
200 St. Paul Place 
Baltimore, MD 21202 
(410) 528-8662 
www.marylandattorneygeneral.gov 

Oregon 
Oregon Department of Justice 
1162 Court Street NE 
Salem, OR 97301-4096 
(877) 877-9392 
www.doj.state.or.us 

New York 
New York Attorney General 
Consumer Frauds & Protection Bureau 
120 Broadway, 3rd Floor 
New York, NY 10271 
(800) 771-7755 
www.ag.ny.gov 

New York 
New York Department of State 
Division of Consumer Protection 
99 Washington Avenue 
Suite 650 
Albany, New York 12231 
(800) 697-1220 
www.dos.ny.gov 

North Carolina 
North Carolina Department of Justice 
9001 Mail Service Center 
Raleigh, NC 27699-9001 
(919) 716-6000 
www.ncdoj.gov 

Rhode Island 
Rhode Island Office of the Attorney General 
Consumer Protection Division 
150 South Main Street 
Providence, RI 02903 
(401) 274-4400 
www.riag.ri.gov 

For residents of Massachusetts: Under Massachusetts law, you have the right to obtain any police report filed in connection to the incident. If you are the victim of identity theft, you also have the right to file a police report and obtain a copy of it. 

For residents of New Mexico: You have rights under the federal Fair Credit Reporting Act (FCRA). These include, among others, the right to know what is in your file; to dispute incomplete or inaccurate information; and to have consumer reporting agencies correct or delete inaccurate, incomplete, or unverifiable information. For more information about the FCRA, please visit https://files.consumerfinance.gov/f/201504_cfpb_summary_your-rights-under-fcra.pdf or www.ftc.gov.