Notice of Data Incident

Posted 8/12/2025

Arkansas Heart Hospital is providing notice about a recent incident experienced by a third-party electronic health record (EHR) vendor, Cerner. Because the vendor provides EHR services to us, personal information, including protected health information (PHI) for patients of Arkansas Heart Hospital, may have been involved in this incident.

What happened

We learned that an unauthorized third party gained access to and obtained data that was maintained by Cerner. Cerner has determined through an investigation that, at least as early as January 22, 2025, an unauthorized third party gained access to Protected Health Information on legacy Cerner systems. Law enforcement investigators asked affected customers, including Arkansas Heart Hospital, to delay notifying patients of this incident because it could have impeded their investigation. While investigating this incident, we confirmed this incident did not involve any unauthorized access to systems maintained by Arkansas Heart Hospital, and this incident did not involve any disruption to services at Arkansas Heart Hospital.

What information was involved

The impacted data varied for each individual impacted, but may have included the following: name, address, phone number, email address, date of birth, Social Security number, medical treatment/diagnosis information, prescription information, provider/physician name, dates of service, medical record/patient identification number, and health insurance information.

What we are doing and what can you do

We are coordinating closely with the impacted vendor, Cerner. As soon as Cerner learned of the incident, Cerner initiated its critical incident response process and took steps to secure the impacted systems. Cerner also began an investigation and engaged external cybersecurity specialists to help, and has taken steps to prevent this kind of event from happening again. Cerner and Arkansas Heart Hospital also engaged with federal law enforcement.

To help protect potentially impacted patients, Cerner is offering six (6) months of identity protection services through an identity protection service, Experian. Cerner will also provide 3-bureau credit monitoring for two (2) years to individuals who wish to enroll in credit monitoring. As an additional precaution, Experian will also provide monitoring services known as “Internet Surveillance.” We have made efforts to contact potentially impacted individuals via an individual notification letter from us containing an engagement number and contact information if they have any further questions. The letters from Arkansas Heart Hospital were mailed on August 12, 2025. However, if you believe you were impacted but did not receive a letter concerning this incident, please contact 833-918-1117.

For more information 

If you have further questions or concerns, or would like to enroll in monitoring services, please call 833-918-1117 toll-free Monday through Friday from 8 am – 8 pm Central (excluding major U.S. holidays). Callers will be asked for an engagement number, which is B149815.

Please do not hesitate to contact us using the information above for the dedicated assistance line if you have any questions. Please do not call Arkansas Heart Hospital directly, as we need to prioritize our main switchboard to support hospital operations.

 

REFERENCE GUIDE

Review Your Account Statements

Carefully review statements sent to you from your healthcare providers, insurance company, and financial institutions to ensure that all of your account activity is valid. Report any questionable charges promptly to the provider or company with which you maintain the account.

Order Your Free Credit Report

You may also periodically obtain credit reports from the nationwide credit reporting agencies. If you discover information on your credit report arising from a fraudulent transaction, you should request that the credit reporting agency delete that information from your credit report file. In addition, under federal law, you are entitled to one free copy of your credit report every 12 months from each of the three nationwide credit reporting agencies. You may obtain a free copy of your credit report by going to www.AnnualCreditReport.com or by calling (877) 322-8228. You may contact the nationwide credit reporting agencies at:

 

Equifax	Experian	TransUnion
(800) 685-1111	(888) 397-3742	(800) 888-4213
P.O. Box 740241	P.O. Box 9701	P.O. Box 1000
Atlanta, GA 30374-0241	Allen, TX 75013-9701	Chester, PA 19016-1000
www.Equifax.com	www.Experian.com	www.TransUnion.com

You also have other rights under the Fair Credit Reporting Act (“FCRA”). These include, among others, the right to know what is in your file; to dispute incomplete or inaccurate information; and to have consumer reporting agencies correct or delete inaccurate, incomplete, or unverifiable information. For information about your rights under the FCRA, please visit: https://files.consumerfinance.gov/f/201504_cfpb_summary_your- rights-under-fcra.pdf.

Contact the U.S. Federal Trade Commission

You may contact the Federal Trade Commission (“FTC”), law enforcement, or your state Attorney General to report incidents of identity theft or to learn about steps you can take to protect yourself from identity theft. To learn more, you can go to the FTC’s website at www.ftc.gov/idtheft, or call the FTC at (877) IDTHEFT (438-4338) or write to Federal Trade Commission, Consumer Response Center, 600 Pennsylvania Avenue, NW, Washington, DC 20580.

Fraud Alerts and Security Freezes

You may obtain additional information from the FTC and the credit reporting agencies about fraud alerts and security freezes. You can add a fraud alert to your credit report file to help protect your credit information at no cost to you. A fraud alert can make it more difficult for someone to get credit in your name because it tells creditors to follow certain procedures to verify your identity. You may place a fraud alert in your file by calling any of the nationwide credit reporting agencies listed above. As soon as that agency processes your fraud alert, it will notify the other two agencies, which then must also place fraud alerts in your file.

You can also contact the nationwide credit reporting agencies at the numbers listed above to place a security freeze to restrict access to your credit report free of charge. You must separately place a credit freeze on your credit file at each credit reporting agency. You will need to provide the credit reporting agency with certain information, such as your name, address, date of birth and Social Security number. After receiving your request, the credit reporting agency will send you a confirmation containing a unique PIN or password that you will need in order to remove or temporarily lift the freeze. You should keep the PIN or password in a safe place. If you request a lift of the credit freeze online or by phone, the credit reporting agency must lift the freeze within one (1) hour. If you request a credit freeze or lift of a credit freeze by mail, the credit reporting agency must place or lift the credit freeze no later than three (3) business days after getting your request.

State Specific Information

For residents of the District of Columbia, Iowa, Maryland, New York, North Carolina, Oregon and Rhode Island You may contact your Attorney General for additional information about avoiding identity theft.  If you are a Rhode Island resident, you may also file a police report by contacting local or state law enforcement agencies.   You may use the following information to contact your attorney general:
District of Columbia   Office of the Attorney General Office of Consumer Protection 400 6th Street, NW Washington, DC 20001 (202) 442-9828 www.oag.dc.gov	Iowa   Office of the Iowa Attorney General Hoover State Office Building 1305 E. Walnut Street Des Moines, IA 50319 (515) 281-5926 / (888) 777-4590 www.iowaattorneygeneral.gov	Maryland   Maryland Office of the Attorney General Consumer Protection Division 200 St. Paul Place Baltimore, MD 21202 (410) 528-8662 www.marylandattorneygeneral.gov	Oregon   Oregon Department of Justice 1162 Court Street NE Salem, OR 97301-4096 (877) 877-9392 www.doj.state.or.us
New York   New York Attorney General Consumer Frauds & Protection Bureau 120 Broadway, 3rd Floor New York, NY 10271 (800) 771-7755 www.ag.ny.gov	New York   New York Department of State Division of Consumer Protection 99 Washington Avenue Suite 650 Albany, New York 12231 (800) 697-1220 www.dos.ny.gov	North Carolina   North Carolina Department of Justice 9001 Mail Service Center Raleigh, NC 27699-9001 (919) 716-6000 www.ncdoj.gov	Rhode Island   Rhode Island Office of the Attorney General Consumer Protection Division 150 South Main Street Providence, RI 02903 (401) 274-4400 www.riag.ri.gov
For residents of Massachusetts: Under Massachusetts law, you have the right to obtain any police report filed in connection to the incident. If you are the victim of identity theft, you also have the right to file a police report and obtain a copy of it.
For residents of New Mexico: You have rights under the federal Fair Credit Reporting Act (FCRA). These include, among others, the right to know what is in your file; to dispute incomplete or inaccurate information; and to have consumer reporting agencies correct or delete inaccurate, incomplete, or unverifiable information. For more information about the FCRA, please visit https://files.consumerfinance.gov/f/201504_cfpb_summary_your-rights-under-fcra.pdf or www.ftc.gov.