The company filed its Form 8-K with the SEC on October 22, 2026, thereby stipulating, on the record, that patient data was likely compromised. The scope remains undetermined. No threat actor has claimed responsibility, which the court notes proves nothing in your favor.
Counsel submits that covered entities are legally obligated to notify affected individuals within HIPAA's required timeframe — do not sit on breach notifications or you will be handing regulators a gift-wrapped violation. (2/3)
