On October 26, 2026, the ransomware group Qilin listed "Smith Feddeler & Smith" on its leak site. The victim record carries the firm's domain, www.all-injuries.com, and a description field whose entire contents are the string N/A. No volume, no data types, no intrusion date. As of November 2, 2026 the firm has published no notice — its homepage returns HTTP 200 with zero occurrences of "data breach," "security incident" or "notice of" — and Qilin has published no claim about the data.
So this is not an article about what was taken. The useful question is what a firm in this practice area necessarily holds, and whose statute governs it.
Reasoning from the practice area instead of the listing
Smith, Feddeler & Smith, P.A. titles its homepage "Florida Workers' Compensation Lawyers | Personal Injury, SSD, Labor." It lists workers' compensation, personal injury, car accidents, employment disputes and Social Security Disability as its practice areas, and offices in Brandon, Clearwater, Gainesville, Kissimmee, Lakeland, Ocala, Orlando and Tampa.
That fixes the data class. An SSD claim is filed under the claimant's Social Security number. A comp claim is won or lost on medical causation, so the file holds treating records, the IME, and a diagnosis. In this practice area the sensitive data is not a byproduct of the engagement — it is the work product.
The two clauses that decide whose statute applies
Most firms holding client medical records have had the HIPAA conversation and never the Fla. Stat. § 501.171 one. Two definitions do the work.
"Covered entity" means a sole proprietorship, partnership, corporation, trust, estate, cooperative, association, or other commercial entity that acquires, maintains, stores, or uses personal information. — § 501.171(1)(b)
No professional-services carve-out, no healthcare carve-in. A law firm is a commercial entity that stores personal information, so the plain text puts it inside. Then § 501.171(1)(g)1.a. defines personal information as a first name or initial and last name combined with any one or more of: a social security number; a driver license, ID card, passport or military ID number; a financial account or card number with the code permitting access; a health insurance policy or subscriber number; biometric data; geolocation; and —
Any information regarding an individual's medical history, mental or physical condition, or medical treatment or diagnosis by a health care professional. — § 501.171(1)(g)1.a.(IV)
No HIPAA nexus is required. As a general proposition a law firm is neither a HIPAA covered entity nor, as to its own individual clients, a business associate, so those records carry no HIPAA obligation in its hands. They are still personal information under Florida law, and three things change. The clock is 30 days from determination or reason to believe under § 501.171(3)(a) and (4)(a), not the 60 calendar days from discovery that 45 CFR 164.404(b) allows. The regulator is the Florida Department of Legal Affairs, not the Secretary of HHS under 45 CFR 164.408. And the contents differ: § 501.171(4)(e) wants the date range and a description of the personal information accessed, where 45 CFR 164.404(c)(1) asks what happened and what to do about it — one reason a breach letter so rarely tells you what happened. The one escape hatch, § 501.171(4)(g), deems notice compliant if it followed the rules of the entity's "primary or functional federal regulator." A plaintiff-side firm has none.
When the data is the work product, segmentation is the only control left
This is the inverse of the case where a firm's breach notice goes to individuals who were never its clients. Here the data subjects are the clients, there is nobody downstream to pass a duty to, and minimisation is unavailable: you cannot take the SSN out of an SSD matter or the medical record out of a comp matter and still have a case.
What remains is segmentation — by office, by matter, by matter age. Eight offices on one case-management system is one blast radius unless access is scoped to the matters each office works. The cost is operational: it breaks the habit of any attorney covering any hearing on short notice, and generates permission requests someone must action the same day. The workable version is scoping by office with a documented break-glass path, not per-matter ACLs nobody maintains.
Retention is the harder half, and § 501.171(8) points at it — a covered entity must take all reasonable measures to dispose of customer records containing personal information "when the records are no longer to be retained." Closed matters stay. So the breach scope is not the active caseload but every matter the firm has ever handled, the same data inventory problem that turns a short detection into a long notification. Set a retention schedule per matter type and move anything past it offline; a closed matter in the live system is in scope.
What to check this week
- Ask your practice-management administrator for the count of closed matters readable from any ordinary logged-in account, and the open date of the oldest. Those two numbers are the breach scope.
- Determine which offices can open which offices' files. If the answer is "all of them," that is one finding, not eight.
- Check whether the SSN field is indexed and searchable firm-wide, often true because somebody needed it once for an SSA filing.
- Confirm who can start a § 501.171 determination, and whether they know the clock is 30 days, not 60.
North InfoSec runs AI-assisted penetration testing and security assessments, including the data classification and segmentation reviews described above. northinfosec.com