Poland is investigating a breach at MyDr, a medical records platform used across the country's healthcare system. Attackers reportedly exploited a vulnerability in certificate handling to gain access to the company's source code and cloud infrastructure, then claimed to have stolen 2.5 terabytes of data, including prescriptions, appointment records, and national ID numbers.
Here is the detail that matters most for every practice using third-party software: Polish data protection authorities have made clear that the obligation to notify patients falls on the healthcare providers using MyDr, not on MyDr itself. The vendor is the processor. The clinic is the controller. When the vendor gets breached, the compliance burden lands on the practice.
This is not unique to Poland. Under HIPAA, the same principle applies. A Business Associate Agreement does not transfer your responsibility to a vendor. It documents that you assessed the risk and required them to meet security standards. If your practice management software, imaging platform, or billing service is compromised, you are still the one who has to notify patients and respond to regulators.
Most practices never ask their software vendors a basic question: what happens to our patients if you get breached?
A few things worth checking:
Do you know which of your vendors would trigger a notification requirement if they were breached? Are your Business Associate Agreements current, or were they signed once and forgotten? Would you know within days if a vendor you rely on was compromised, or would you find out from the news?
Vendor risk is part of the security picture that gets overlooked most often. It is not just about your own network. It is about every system that touches your patient data, including the ones you do not control.