Two files now where the market regulator surfaced an incident the data regulator would not have.
A patient chooses a practice. The practice chooses the software. The patient has no relationship with the supplier and cannot change it.
It did not grow because the intrusion grew. It grew because working out whose records sit in four terabytes takes eleven months.
Encryption is the moment the attacker chooses to be seen. It happens after the theft, because the theft is the leverage.
A written requirement that MFA be enabled everywhere is not a control. It is intent somebody then has to enforce against an estate nobody has fully inventoried.