A Michigan pediatric practice has told patients that up to a year of their children's treatment records may be gone, and the practice's own computers were never touched. Downriver Pediatric Associates says the company that hosted its electronic health records (EHR) system, Technical Solutions Group LLC (TSG), was hit by a cyberattack in June 2026 and later said it couldn't get the data back.
Most small practices now trust someone else to run their chart system, their imaging server or their billing software. This notice is a plain-English look at what happens when that someone has a bad day, and what to ask your own vendor before you find out the hard way.
What the practice has said
- The attack was at the vendor. According to the practice's notice, TSG said that in June 2026 attackers "encrypted information on TSG's systems and left a note claiming to have exfiltrated data held by TSG," affecting "many of its customers." Downriver stresses that the incident "did not involve access to, or a compromise of, any Downriver owned, operated or administered systems."
- The records couldn't be recovered. On Sept. 16, 2026, TSG told Downriver it was "unable to recover the encrypted data" it hosted for the practice. As a result, the practice says, treatment records "created between June 2025 and June 2026 may no longer be available to review or access."
- Nobody knows what was taken. TSG also couldn't determine what Downriver information, if any, was accessed or taken. The practice says it doesn't know for certain whether patient information was taken and is notifying every patient in the hosted EHR "out of an abundance of caution."
- What the files could include. Depending on the patient: names, Social Security numbers, driver's license numbers, dates of birth, treating physician, dates of service, medication, insurance, and treatment or diagnostic information.
- What happened next. Downriver began mailing letters on Oct. 8, 2026, set up a patient call line, and says it no longer uses TSG to host its EHR.
Neither TSG nor the practice has said how the attackers got in, how many other practices were affected, or whether any ransom was discussed. We're sticking to what the notice says.
Why this matters for your practice
Under HIPAA, a practice stays responsible for its patients' records even when a vendor holds them. The hard part of this story isn't the possible privacy exposure; practices deal with those letters all the time. It's that a year of charts may simply be gone. Missing visit notes, immunization histories and medication lists mean re-collecting information from patients, other providers and pharmacies, and they can complicate billing, audits and medical-records requests for years.
The usual answer, "our vendor has backups," only helps if those backups survive the same attack. When the hosted copy and the vendor's backups sit in one environment, one break-in can take both.
Clear takeaway
If a vendor hosts your EHR, dental chart, imaging or billing system, get a written answer this month on where the backups live and how fast they can restore you, and keep your own regular export of patient records somewhere the vendor's systems can't reach.
What to do this month
- List every hosted system that holds patient data. EHR or practice management, imaging, e-prescribing, billing, patient portal and any server your IT company hosts for you.
- Ask each vendor three questions in writing. Where are our backups stored? Are they separated from your main systems so ransomware can't reach them? When did you last do a full test restore for a customer like us?
- Pull your own copy. Find out how to export your records (many systems offer a full patient-data or document export) and do it on a schedule. Store it encrypted, offline or in an account the vendor doesn't control.
- Check your business associate agreement. Make sure it spells out how quickly the vendor must tell you about an incident and what help they'll provide with patient notices and data recovery.
- Write a downtime plan. Decide how the front desk checks patients in, prescribes and documents visits if the chart system is offline for a week, and print the forms now.
- Know your exit path. Ask how you'd get your data out if you switched vendors tomorrow, and in what format. If the answer is vague, that's a risk in itself.
How Brotherly Technology can help
Brotherly Technology helps medical and dental practices map which vendors hold their patient data, review backup and restore answers, set up encrypted record exports the practice controls and test that they actually open. If you're not sure where your charts would come from after a vendor outage, call us and we'll walk through it with you.