The attorney leading a Madison County-based lawsuit against Huntsville Hospital Health System over last year’s data breach says his team plans to combine efforts with other lawyers who have filed similar state court cases, all while keeping the fight in front of an Alabama jury.
Eric Artrip told FOX54 his firm has fielded contact from patients potentially affected by the breach, which Cerner — now part of Oracle Health — disclosed involved unauthorized access to the hospital’s legacy records systems dating back to January 2025.
“We have been contacted by dozens, if not hundreds at this point, of people who have been involved in the Huntsville Hospital data breach,” Artrip said. “They received notices from Huntsville Hospital, and we are going to join up with some of the other attorneys that have filed these cases and litigate them together.”
Artrip said consolidating the state court cases, rather than pursuing them separately, gives patients the best shot at a favorable outcome.
“We don’t think it’s in the class’s best interest for us to fight amongst ourselves,” he said. “We think it’s in our best interest to join forces and see if we can figure out what happened and ask a Madison County jury to ultimately enter a verdict in our favor.”
State vs. federal tracks
Artrip’s case, filed by Huntsville resident Billy Parker in Madison County Circuit Court in July, is one of at least two lawsuits stemming from the breach now moving on separate tracks. A second suit, filed by Crystal Mullins on Aug. 14 in the U.S. District Court for the Western District of Missouri, names both Cerner Corporation — doing business as Oracle Health — and the Health Care Authority of the City of Huntsville as defendants.
That federal case, reported first by FOX54 on Tuesday, is tied to an already-underway multidistrict litigation against Oracle Health in Missouri.
Artrip drew a clear distinction between the two.
“The cases that are filed here in Madison County are filed in Alabama State Court under Alabama law, and they seek a determination from Alabama judges and Alabama jurors,” he said. “The other case that has been filed is, as you mentioned, in federal court. That involves a different set of laws — obviously, you know, four states away, involving different lawyers — and we hope that they’re successful. But we think that the cases that we have here in Madison County will ultimately be tried to a jury here in Madison County.”
Breach timeline
According to the Madison County lawsuit, unauthorized third parties began accessing Huntsville Hospital Health System’s network as early as Jan. 22, 2025, through legacy systems maintained by Cerner. Cerner notified the hospital of the breach in August 2025, and patients weren’t notified until letters went out in June 2026 — roughly 10 months later. Those letters cited a law enforcement request to delay notification during the investigation.
Exposed data reportedly included patients’ names, Social Security numbers and test results, and Artrip has said the breach has the potential to affect more than 100,000 patients. The hospital has maintained the breach occurred entirely within Cerner’s systems and did not stem from any failure on its own end
The Madison County suit accuses the hospital system of negligence, invasion of privacy, breach of implied contract and unjust enrichment, and seeks class-action status along with damages and a court order requiring upgraded cybersecurity measures.
Huntsville Hospital Health System has noted that its own, internal systems were not compromised, stressing that the breach involved a third-party vendor. The health care provider has told FOX54 that patient privacy and safety are priority concerns.
