Healthcare providers hand law firms their most sensitive material: charts, bills, identifiers, the paper trail behind malpractice defense and billing disputes. Tarter Krinsky & Drogin just showed what happens when that trust is spent. The Manhattan firm told regulators that an intruder moved in and out of its servers between July 9 and September 9, 2025, taking files that included attorney-client privileged material and the protected health information of 196,645 patients treated by its healthcare clients.
Suspicious activity was spotted September 10, 2025, one day after the last confirmed access. Forensic review finished only now, and notification letters are going out two years later. The firm has not named which provider clients were affected, leaving those organizations to coordinate their own notices.
What was in the files
Data varied by person but spanned nearly every category that matters: names, Social Security numbers, driver’s license and passport numbers, birth dates, taxpayer IDs, financial accounts, payment cards, usernames and passwords, medical and insurance details, and biometric data. Credential exposure alongside identity data fuels account takeover, not just credit fraud.
Business associates with law degrees
Outside counsel handling PHI for a covered entity is a business associate under HIPAA, obligated to run the same safeguards a hospital does: encryption, access logging, segmentation, and a tested incident plan. Legal practices are often the softest node in a provider’s vendor chain because security budgets scale with attorney headcount, not with the volume of clinical data moving through discovery.
Actions for provider legal teams
Pull your outside counsel list and confirm each firm holds a signed BAA. Ask whether privileged repositories sit on segmented infrastructure. Require breach notification within days, not at the end of forensic review, and confirm who funds patient notification if the firm is the one compromised.
