Mid Florida Dermatology & Plastic Surgery, a 33-location practice group across central Florida, posted a breach notice on September 10, 2026. The HIPAA Journal's coverage of that notice puts the count at 85,585 affected individuals and an intrusion window of March 26–30, 2026 — identified the same day it ended. Between detection and the mailed notice sat 164 days, and the notice had no obligation to explain what filled them.
The number that looks bad is doing a different job
Five days of unauthorized network access, caught the day it stopped, is fast detection by the standard most breach notices set. The 164 days that followed look like delay on first read, but they're answering a different question than "how long did this take to notice." HIPAA's Breach Notification Rule starts its 60-day countdown not on the day an intrusion is spotted, but on the day the covered entity determines that protected health information was actually compromised — a separate, later date the rule treats as the real discovery.
North InfoSec covered the same mechanic in Operation PAR's breach, where detection and determination sat exactly 365 days apart and the notification that followed 15 days later was still compliant. Mid Florida's notice names March 30 as the date unauthorized activity was identified and September 10 as the date letters went out. It never names the date the practice finished determining whose records were actually involved — the one date the 60-day clock is anchored to, and the one its letter had no duty to publish. The data types the notice lists — names, addresses, dates of birth, passport numbers, Social Security numbers, driver's license numbers, Medicare numbers, financial account numbers and access information, health insurance information, and medical information, varying by individual — are themselves the output of that determination, not a description of the intrusion.
What eats the 164 days
Determination is the work of answering one question for each of 85,585 people: did this specific account, during this five-day window, touch this specific record? That answer comes from one of two places. Either the organization can run a query against access logs — who opened which chart, from where, between March 26 and 30 — and get a scoped list back in days, or it has to reconstruct the answer by hand: pulling EHR audit trails system by system, cross-referencing them against what a compromised credential could reach, and building the affected-record list file by file. The first path runs weeks. The second runs months, and 164 days is roughly what months looks like.
A 33-location group makes the second path worse in a way a single clinic never has to deal with. One site has one log source to centralize before an incident ever happens. Thirty-three sites each potentially running their own instance of a practice-management or scheduling system, their own local IT contact, and their own copy of "who noticed something looked wrong first" turns determination into 33 separate reconciliation exercises that all have to resolve to one number before a single letter can go out. Centralizing that in advance isn't free — it means a SIEM ingesting EHR and practice-management audit logs from every location, or a shared identity provider whose access logs already span all of them, and either one is a budget line, not a checkbox on an audit.
Miles Partnership's breach shows what happens on the other end of this same clock, when the discovery date is the murky one rather than the determination date: the gap compounds instead of just stretching. Winn-Dixie's notice shows the matching failure in the letter itself — Massachusetts law forbids the consumer notice from naming a cause, so the determination work stays invisible there too, by statute rather than by choice. Mid Florida's gap is neither of those; it's a 33-site version of Operation PAR's problem, and the size of the practice is what makes 164 days unsurprising rather than suspicious.
What to check this week
- Can you produce, today, a list of every record a specific user account touched in the last 30 days as a single query — not a multi-system reconstruction?
- If your organization runs more than one location, is access logging centralized under one identity system, or does each site hold its own logs that would have to be pulled and reconciled separately after an incident?
- For your EHR or practice-management platform, do you know whether "accessed" in its audit log means opened, viewed, or modified — the distinction a determination has to make per record?
- If a credential were compromised tomorrow, could you state the scope of affected records in days, or would it take the kind of multi-month reconstruction this notice's dates imply?
The notice does not disclose how the intrusion began or how access was regained after March 30, so what's above is about the determination phase specifically, not the full incident. That phase is the part a plan built and tested before an incident can actually shorten.
North InfoSec runs security consulting focused on audit readiness and incident-response planning, including assessing whether an organization's logging can answer a determination question before it ever has to. northinfosec.com