On November 4, HIPAA Journal rounded up breach notices from four health care organizations. Two of the notices say how the attacker got in, and in both cases it was through an account. At Blossom Health, a telepsychiatry provider, it was a phishing attack on a contractor who was not an employee. At El Camino Health, it was four Microsoft 365 accounts that someone accessed on and off for a week.

Small practices tend to picture a breach as someone breaking into the network. These two started with a login that already had permission to be there. If your practice gives outside people access to its records, that is the part of this story worth an afternoon of your time.

What the four notices say

Blossom Health. In August 2026, an attacker phished a non-employee contractor and used that access to reach Blossom's electronic health record (EHR) software. The attacker downloaded a limited number of medical records and a user spreadsheet holding patient names, contact details and health insurance information. Blossom says Social Security numbers and financial information were not accessible. It reported 2,103 affected Texas residents to the state attorney general and mailed letters on October 29.

El Camino Health. Four Microsoft 365 accounts were accessed intermittently between August 26 and September 2. The exposed information included Social Security numbers, driver's license numbers, medical record numbers, diagnoses, prescriptions and insurance details, and for some patients, bank account and routing numbers. The total count has not been made public.

HCA Healthcare. HCA confirmed unauthorized access to certain systems on August 12. The attacker copied HR files on medical residents, including Social Security numbers and immigration information, along with patient records from affiliated facilities and physician offices. HCA has reported 15,096 affected Texas residents and has not released a total. Its notice does not say how the attacker got in.

University of Mississippi Medical Center (UMMC). Attackers were inside UMMC's network from February 11 to February 19. The Medusa ransomware group claimed the attack in March and demanded payment to keep the stolen data from being sold or released. UMMC did not pay. It is the only one of the four with a named attacker. Nothing published so far ties Medusa to HCA or Blossom.

Why a contractor's login is a soft spot

Most practices have people who are not on the payroll but can sign in to something that matters. A billing company, a coder, a transcription or scribe service, a telehealth clinician who covers a few shifts, the EHR vendor's support desk and the IT provider all tend to hold logins. Those accounts usually belong to people who never sat through your training, using email accounts and laptops you do not manage.

Attackers know this. The FBI and CISA advisory on Medusa (AA25-071A, last updated in August 2026) says the group's affiliates get in three main ways: phishing to steal passwords, buying working access from criminals who sell it on forums, and exploiting unpatched systems that face the internet. Once inside, they use the same remote access tools IT staff use every day, so the activity can look like routine support. The advisory counts more than 500 victims, and medical organizations are on its list of affected industries.

A stolen password for a login you expect to see rarely looks unusual on its own. Two things stop it: a second sign-in check the attacker cannot pass, and removing the accounts nobody needs anymore.

List every outside login this month

This takes one meeting and two lists. You do not need special software for it.

1. Get the user list from your EHR. Ask your EHR vendor, or whoever administers the system, for every active account with its last sign-in date and its role. Mark each account that belongs to someone who is not on your payroll.
2. Do the same for Microsoft 365 or Google Workspace. Include shared mailboxes and any account a vendor uses to support you.
3. Turn off what is not needed. A former biller, a clinician who stopped covering shifts, a vendor you replaced last year. If nobody on your side can say why an account still exists, ask the vendor, then disable it.
4. Require multifactor authentication on every outside account that stays. Where your EHR supports an authenticator app or a security key, use that instead of text message codes.
5. Trim access to the job. A billing company typically needs claims and insurance data, not clinical notes. If your EHR has roles, use the narrowest one that lets the work get done.
6. Put an end date on temporary access. Covering clinicians and short projects get accounts that expire on a set day, so nobody has to remember to close them.

Questions for every contractor who keeps a login

• Do your staff use multifactor authentication to sign in to our systems, and is it turned on for their own email too?
• Who on your team has a login to our records today, and how will you tell us when one of them leaves?
• If one of your people is phished, how quickly will you tell us, and who will you call?
• Is our business associate agreement current, and does it say how you report a security incident to us?

The answers do not need to be perfect. A contractor who can answer in writing within a week is usually a safer bet than one who needs a month to find out.

Where the rules come in

For practices covered by HIPAA, outside logins are already in scope. The Security Rule asks covered entities to control who can reach electronic health information, to end access when it is no longer needed and to review records of system activity. Contractors who handle protected health information on your behalf are typically business associates, which calls for a business associate agreement. If a contractor's account is used to reach patient records, the Breach Notification Rule may require notice to affected patients without unreasonable delay and no later than 60 days after the breach is discovered.

In Ohio, the Data Protection Act can give a business that maintains a written cybersecurity program based on a recognized framework a defense against certain claims after a breach. A current list of who can sign in to your records, and why, is the kind of record such a program can point to. Cyber insurers may also ask at renewal how outside access is controlled, and the answers can shape coverage.

The full breakdown of how Medusa operates, from first access to data theft, is in our Threat Intelligence Center write-up. If you are unsure who outside your practice can sign in to your records today, ask your EHR vendor and whoever manages your email for a list of active accounts this week. Our security assessment is a 15-minute call, then written findings on five areas: dark web exposure, phishing risk, security controls, remote access and employee training readiness.