Facial Surgery Group, which runs five oral and maxillofacial centers across Kansas City, Liberty, Overland Park, and Blue Springs, spotted suspicious activity in its email system on November 24, 2025. Investigators confirmed that one account had been reached by an unauthorized party. A third-party data mining vendor was brought in to work out whose records sat in that account, and that review wrapped on September 9, 2026.
The account held patient names, birth dates, demographic details, Social Security numbers, financial account numbers, and health information. Notices reached patients by mail, and the practice offered credit monitoring and identity restoration. A web notice went up in September and the Massachusetts regulator was told in October.
HIPAA’s 60-day clock runs from discovery of the breach, not from the end of the investigation. Small practices routinely treat the two as the same date, which is where settlements usually begin.
For surgical and specialty groups, the practical fix is to stop treating a mailbox as a records store. Patient information exported from the practice management system into shared folders and sent by email sits outside every access control the EHR provides, and a single stolen password exposes all of it. Restrict forwarding, enable phishing-resistant login, and confirm your review vendor can work faster than ten months.
