EHR vendor Accumedic Computer Systems took four months to work out that an intruder had been inside its network, and the counselling practices running on its platform are only now posting notices.
Long Island’s Hispanic Counseling Center, which operates mental health and substance use clinics, says its vendor detected suspicious activity on June 8, 2026. Investigators and the vendor finished their review on August 7: the first access traced back to April 8, with customer information possibly taken between June 4 and June 8. Exposure of patient health information was confirmed September 1. Records compromised took in full names, birth dates, Social Security numbers and insurance details, alongside clinical data. Notices went out October 30. Neither party has published a patient count.
What the four month gap means
Brooklyn Counseling Services, operating formally as BCS Group, sent its own notices after the same vendor relationship and described a similar compromise of personal data in its medical record system.
The timeline is the story for anyone buying clinical software. From intrusion to first alert was sixty-one days, from alert to confirmed patient data exposure another eighty-six, and notice letters arrived in early November for an April break-in. A small practice has no independent visibility into its vendor’s network, so it learns what happened on the vendor’s schedule and inherits the regulatory clock. Under HIPAA the covered entity still owes the notification; a business associate’s delay does not extend the deadline.
Three asks belong in your next business associate agreement review. What commitment does the vendor make to flag a suspected intrusion, counted in days rather than on confirmation? Does the vendor owe a summary of technical findings? And does the practice hold its own audit log extract, so it can reconstruct who touched which chart when the vendor’s timeline slips?
